The audit page is built from signatures, not sentences

Every VPN provider has a page that says it keeps no logs. The page is prose. You either believe it or you do not, and there is no third option, because there is nothing on it to check.

Our audit page is not prose. It is generated at build time — before Jekyll renders a single template — from machine-readable reports that the hosts publish and sign themselves. That difference is the whole post, so here is exactly how it works.

What the page is made of

Each host runs a scheduled job that checks the things we claim about it: that the no-log invariants hold, that the resolver settings are what they are supposed to be, that the unit files have not drifted. It writes a JSON report, signs it with a detached ed25519 signature, and publishes the report, the signature, and the accepted signer alongside each other.

At build time, tools/audit-report.rb fetches those artifacts over HTTPS and verifies each signature with stock ssh-keygen -Y verify against the signer key pinned in this site’s repository (_data/audit-pins.json). Only then does it substitute real numbers into the page you are reading.

No YMRTECH software is involved in the verification step. That is deliberate: a verification you have to trust our code to perform is not much better than a sentence. ssh-keygen is on your machine already.

What the build refuses to do

The gate is not decorative. The build stops, and the deploy does not happen, if:

• a signature does not verify — the artifact is not the bytes that were signed;
• a key rotates without being announced — a new signer is not accepted just because it signed something; the pin has to change in a reviewed commit first;
• a report claims to be a host it is not — a valid signature from mail does not authorize a report about vpn;
• a signed index disagrees with the file it describes — a report whose hash is not the hash the index recorded is a rewritten report.

There is one case that is deliberately not a failure: a host that is simply unreachable. The page records it as unavailable and says so, because the alternative — rendering a green box for a host nobody could reach — is exactly the lie the rest of this design exists to prevent.

Why the failure is still published

The most interesting property of the whole thing is what happens when a check fails.

The job writes and signs the report first, and only then fails. A failing run therefore leaves a valid, signed, published report at its URL saying that something is wrong. Deleting the evidence of a failed check is not an option the machinery offers, and that was the design goal: the moment when you would most want to quietly tidy up is the moment the artifact is already out there.

Why month-long claims are still claims you can check

“Nothing in the log” on the day you visit the page is a small statement. The month-long version is a bigger one, and it gets its own machinery: a monthly roll-up recounts every dated daily report in the period and re-verifies each signature, and a closed month is frozen once published with its SHA-256 recorded in the index. A month that has already shipped cannot be revised later without the index disagreeing with it — and the index disagreeing is one of the conditions that fails this build.

What a signature does not prove

A signature proves origin, not correctness. It proves a named host produced these bytes and that nobody changed them afterwards. It does not prove the host was telling the truth, and it does not make us independently audited.

These reports are produced by the infrastructure they describe. We hold no third-party audit, no accredited certification, no SOC 2 report, and we do not claim one — the standards page is explicit about which words we are allowed to use. And the audit’s own generator is not public source: the boundary around what is public, and what that costs you, is written out at the public-source boundary, on the same page. That section exists because a page full of cryptography invites exactly the wrong conclusion, and the wrong conclusion is the one thing this is not allowed to produce.

The rest of the public posture — what we log, what we do not, and how the site’s own stack is built — is on what we log, standards and the technical dossier.