01
Local-first, no exceptions
The binary runs entirely on your machine. No product telemetry, no phone-home, no user database on our servers. Our infrastructure only receives payment and license-validation requests — nothing else.
Security · architecture
No magic promises. A public spec.
What you can rely on, and what we will never promise. Vether's security rests on explicit architectural choices.
02
Single distribution source
Vether is distributed only from vether.org. Any other source (mirror, torrent, forum) should be treated as untrusted and potentially modified.
03
Published SHA-256 hashes
The SHA-256 hash of every Windows x64 release is published at release time, on the download page and in the changelog. You can then verify the file's integrity with Get-FileHash in PowerShell before running it.
04
Ed25519 license validation
Periodic license validation is Ed25519-signed. An opaque license token travels, along with a random anti-replay nonce.
05
No server-side logs
Our servers keep no product-usage logs. Technical access logs (infrastructure security: intrusion attempts, anomalies) expire automatically within 30 days and are never correlated with customer accounts.
06
Responsible disclosure
Found a vulnerability? Write to us PGP-encrypted at [email protected]. First response within 72 h, coordinated fix. Acknowledgements program published in /security.txt at the site root.
Open stack
Built on foundations
proven over time.
Rather than reinventing cryptography, Vether orchestrates the open-source tools that have passed the test of time — and adds the interface, usage discipline and support they lack for a general audience.
Architecture: C# .NET 6+ · WPF · Autofac DI · WMI · P/Invoke Win32 · elevated PowerShell exec.
VeraCrypt
Disk encryption · AES-256, cascade
Mullvad / WireGuard
VPN · ChaCha20-Poly1305 · Curve25519
Firefox Portable ESR
Hardened browser · 7 extensions
VirtualBox VBoxManage
VM isolation · 47 options
Windows Schannel
TLS 1.2+ · AEAD ciphers
Microsoft Defender ASR
17 Attack Surface rules
Sysinternals SDelete
Secure multi-pass wiping
Blackbird (Telemetry)
Microsoft telemetry cutoff
Cryptography
Algorithms used
& what each is for.
No home-grown cryptography. Every algorithm is standard, published and widely audited. Vether's job is to invoke them correctly, with the right parameters, at the right moment.
- AES-256-XTSVeraCrypt volumes (default)
- AES-Twofish-SerpentCascade volumes (higher paranoia)
- ChaCha20-Poly1305WireGuard tunnel
- Curve25519WireGuard key exchange
- BLAKE2sWireGuard MAC
- Ed25519Vether license signature
- SHA-256 / Whirlpool / StreebogVeraCrypt hash
- Quantum-Resistant TunnelsMullvad — post-quantum option