Your connection.
Your privacy.

AZULA stores your account identifier, contact email, support requests, subscription records and issued VPN profile identifier to provide the service. Payment information is handled by Stripe when connected.

Account security

Passwords are stored as salted bcrypt hashes. Session and recovery tokens are stored as hashes; the secure session cookie identifies your signed-in browser. Cloudflare Turnstile checks signup, login, recovery and member writes. Contact emails are not verified by an email delivery service. Save your private recovery code securely; password recovery uses that code and signs out earlier sessions.

VPN connection records

Authorized administrators may see a profile’s assigned tunnel IP, most recent public endpoint IP, handshake time and traffic totals. A public endpoint can identify your internet connection and may change or be shared. It is not a browsing history or proof of who used a device. A recent handshake does not prove a continuously active connection.

Endpoint IP telemetry is visible to authorized owners and admins for 24 hours after sampling. Older telemetry is removed on the next node update; if updates stop, it remains stored until ingestion resumes or an operator deletes it. Profile and billing records are retained for the duration of service and required accounting periods. Contact support to request export or deletion; legal retention requirements may apply. Never post a VPN configuration or private key in a public channel.

Security monitoring

Successful website sign-ins, account creation, and recovery record the public connection IP supplied by Cloudflare, account identifier, event type, and timestamp. Only the owner can view this login history, retained for 30 days and pruned on node updates. Security incident summaries may contain observed source IPs and network registry information. Captures are private on the VPS, bounded in size and duration, and retained for up to seven days; only the owner can download them. Captures may include packet headers and a small payload prefix. These IPs do not prove identity or attack origin. Staff cannot access login IPs, profiles, or incident source records.

Automated security checks run every minute and report privately to the owner. Known package advisories are checked with OSV using software package names and versions; account data, passwords and traffic captures are not sent to that service. Bounded recovery may restore approved enabled services or the approved firewall configuration, with retry limits and recorded actions.

High-confidence exploit path probes record the Cloudflare connection IP, category, time, strike count and restriction deadline. Query strings, request bodies and passwords are excluded. Only the owner can see these records. Events are retained for 30 days and restriction history for 90 days without a new violation; cleanup runs when a new exploit restriction is recorded. Temporary restrictions begin at one hour and escalate to 24 hours. Shared IPs can affect multiple people; contact Discord support for review. An active owner retains recovery access.

Manual latency tests send small HTTPS requests directly to the selected OVH locations, which receive your connection IP. Packet graphs show aggregate server traffic, without individual users or packet contents. Testing requests are private support tickets and require separate written staff approval.

Service limits

OVHcloud upstream protection reduces the impact of attacks. It does not guarantee uninterrupted availability, zero latency, open NAT or protection against every attack. Use the service for lawful defensive connectivity. Abuse, attacks against others and credential sharing are prohibited.