Current signed Windows client: Kaitiaki Iron Sentinel 0.6.20. Per-device keypair, split routing that preserves your LAN and remote-admin sessions, a real-time kill-switch, and a verified-encryption indicator. Australian exit, Australian-owned infrastructure. No bundled adware, no "free-tier" funnel.
A proper Windows / macOS / iOS / Android client built around the WireGuard kernel driver. Split-tunnel-by-default with intelligent destination-based exclusions.
Curve25519 ECDH + ChaCha20-Poly1305 + Blake2s. No legacy ciphers, no custom-protocol "innovations" — the same proven primitives behind Mullvad, NordLynx and Tailscale.
Each device generates its own Curve25519 keypair at install. Private keys never leave the device. The broker only ever sees public keys plus an identity claim.
RFC1918 ranges, multicast, link-local and your active inbound RDP / SSH / SMB sources are auto-excluded from the tunnel. Your LAN keeps working. Your remote session stays alive.
When the tunnel drops, supervised auto-reconnect with capped backoff (3s → 10s → 30s). Toggle off for "stay disconnected if I lose the tunnel" semantics. No infinite loops, no thrash.
One-click verification — Shield fetches your real public IP from outside and compares it to the expected exit. Green means encrypted; red tells you exactly why if anything's off.
Live Rx / Tx bytes, last-handshake age, uptime and ping. A system tray with Connect / Disconnect / Open / Quit. Close minimises to tray; tray Quit actually quits.
A single-file installer. One UAC click registers the manager service, desktop shortcut and delayed auto-start. Uninstall is a documented two-command sequence with no leftovers.
Identity lives in a local file — never compiled into the binary, never shared between installs. Sign-out wipes it. No account, no credentials on a server.
Settings → Diagnostics shows the combined UI + tunnel-manager log in-app, with copy-to-clipboard for support. Logs never leave your machine unless you send them.
The current beta is the build we'd want our own families using today. What's next adds the broker-side intelligence — honestly labelled as coming, not claimed as shipped.
The current Windows installer is published below. Contact us for tenant identity provisioning before production use. No accounts to manage, no credit card on file.