v1.9 · 28 October 2026
Colitu Security Whitepaper
Architecture, threat model, protocols, key management, logging, known limitations and the roadmap. Every statement describes the code and servers running today.
OWASP ASVS 5.0 · MASVS v2.1 · 25 October 2026
Security Assessment Report
Internal assessment of the server side, web, assistants and mobile apps against OWASP ASVS 5.0 and MASVS v2.1. No open critical, high or medium findings; the result for each of the 253 ASVS requirements is in the report.
01
Colitu security at a glance
Green: works as described on every platform named. Yellow: partly, or with documented limits. Red: not available yet.
| Open-source apps | Android, iOS, Windows and Linux are open source (GPL-3.0). The server software is closed. |
|---|---|
| Encrypted tunnel | Hysteria2, VLESS Reality, VLESS XHTTP, Trojan and Shadowsocks 2022, using established implementations (Xray-core, sing-box, Hysteria). |
| Traffic content and browsing history | Not recorded. The VPN servers keep no per-connection logs. |
| Per-user traffic volume | Recorded per server in roughly 15-second windows and kept 90 days for quotas, then only period totals. |
| DNS through the tunnel | Yes in the Android and iOS apps and in TUN mode. Not for apps outside the proxy in system proxy mode (the Linux default; new Windows installs start in TUN mode). |
| IPv6 leak protection | Blocked on Android and iOS, and on Windows and Linux in TUN mode with the kill switch on. Not covered in system proxy mode. |
| Kill switch | Windows: its own service with persistent firewall rules; Linux (TUN mode): nftables rules; both keep blocking if the app crashes. Android relies on the system's Always-on VPN setting; iOS has an optional "Block internet without VPN" switch (off by default). |
| Regional sites routed outside the VPN | Off by default for new installations (privacy mode is on) since Windows and Android 2.7.0, iOS 5.6.0 and Linux 1.3.0; installations from before keep their previous setting. When privacy mode is turned off, sites on a built-in list go outside the VPN in all four apps, except when you are connected to a server in that region. Disclosed in §9. |
| Two-step verification for users | Optional for every account (set up on the website); all four apps ask for the code at sign-in. Mandatory for admin accounts. |
| Passkeys and session control | Passkeys for the website (up to 10 per account); the security page lists and ends browser sessions; changing the password ends all other sessions. The apps sign in with the password as before. |
| Pinned API connection in the apps | Since the app releases of 10 October 2026 all four apps pin the Let's Encrypt (ISRG) and Google Trust Services root certificate authorities for the API. Limits: §12. |
| Split tunnelling | Apps, sites and IP addresses on Windows, Android and Linux (apps in TUN mode only on Windows and Linux); sites and IP addresses on iOS, which allows per-app VPN only for managed profiles. |
| Colitu Shield (DNS protection) | Optional. Blocks ad, tracker, malware, phishing, scam and cryptomining domains (about 380 thousand rules). No query log and no statistics on its resolvers. |
| Third-party analytics | None in any app (Android, iOS, Windows, Linux). Removed from the iOS app in version 5.4.1. |
| Signed updates | Signed update manifest (ECDSA P-256) plus SHA-256 on Android, Windows and Linux; App Store signing on iOS. |
| Windows code signing (Authenticode) | Not yet. |
| Reproducible builds | Android from 2.9.3 and Windows from 2.9.8: the tagged source builds a byte-identical file. iOS and Linux not yet. |
| SBOM | SPDX for every Android and Windows GitHub release; Linux not yet. |
| Independent security audit | Not yet completed. |
| Vulnerability disclosure | security@colitu.com, policy in §18 and security.txt. |
| Self-hosting | Not offered. Colitu runs every server itself. |
02
Security and privacy documents
Privacy policyThe full list of what we store, why and for how long.Open source and build verificationSource code of the Windows, Android, iOS and Linux apps and how to check a download.Known limitationsWhat Colitu cannot protect today and what is still missing.Security roadmapThe next security and privacy improvements.Adaptive Connect 3.0 technical reportAnonymous network hints, a recovery set, outage detection in about 11 seconds and shared decision rules across four apps; what is live and what is alpha.Previous version's technical report: Adaptive Connect 2.0Historical report of 10 October 2026: warm spare, server ranking and a one-hour fault test. The current version is 4.0.Responsible disclosure policyHow to report a vulnerability, scope, rules, safe harbour and response times.Bug bountySend a security report from your account; rewards are 1 to 12 months of Plus and cash for critical issues, with an optional Hall of Fame.Transparency and warrant canaryFigures on official requests and a regularly renewed warrant canary.
status.colitu.com
System status03
Transparency
We publish the official requests and abuse actions we receive in periodic reports.
Transparency reports
Published per period, newest first.- Transparency report · Q3 20261 July 2026 – 30 September 2026Published: 1 October 2026
- Requests from authorities
- 0
- Requests where data was given
- 0
- Content and copyright notices
- 0
- Abuse reports
- 0
- Accounts restricted
- 0
Colitu opened on 12 September 2026; this first report covers the time from opening to 30 September. In this period we received no request for user data from any authority and shared no user data with anyone.
Each report covers
- Requests from authoritiesRequests for user data from courts, police or other bodies.
- Requests where data was givenHow many of those requests led to any data being shared.
- Content and copyright noticesDMCA and similar notices.
- Abuse reportsReports of spam, attacks or fraud from our servers.
- Accounts restrictedAccounts restricted for abuse.
When we receive a request
We review every request for its legal basis, and we can only hand over data we have. Traffic content, visited sites, DNS queries and IP addresses on the VPN servers are not recorded. The full list of what we do hold is in the whitepaper.
What we store04
Incident log
Incidents that affect privacy or security are described here and in the whitepaper.
Vulnerability disclosure
If you find a vulnerability, please report it to security@colitu.com before sharing it publicly. We reply within 3 working days and do not take legal action against good-faith research. Disclosure policy
Privacy, security and abuse contacts
- Privacy and data requestsprivacy@colitu.comRequests to access, correct or delete your personal data.
- Report a vulnerabilitysecurity@colitu.comReport vulnerabilities in our apps or infrastructure here before sharing them publicly; we reply within 3 working days. Disclosure policy
- Abuse reportsabuse@colitu.comSpam, attacks or copyright notices coming from Colitu servers.
Last updated: 28 October 2026