Measured, not claimed
Four things you can check.
- Session cipher
- XSalsa20-Poly1305
A symmetric key is agreed per session. Relays forward ciphertext and hold no key that opens it.
- Identity
- Ed25519
The rendezvous server signs each peer’s identity. The client verifies that signature against the key built into it before a single pixel moves.
- When verification fails
- The session is refused
Not downgraded, not retried in the clear. The client aborts — because a client that falls back to plaintext is a client that can be pushed into plaintext.
- Rendezvous and relay
- relay-eu1.altovar.net
Our own machines running our own image, inside the EU. Point the client at a different one and it will use that instead.

