Where our addresses come from, and how you can check

Residential and mobile peers reach us through partner applications. Before a device joins, the person using it is shown a plain-language notice explaining that their connection will be used to route traffic, and they must act to accept it. The choice is reversible from the application's own settings, not buried in a support flow. Partners compensate peers, in cash, in credit, or by removing advertising. We review each partner's disclosure text and consent flow before onboarding and again at every audit cycle, and we test the withdrawal path ourselves.

Twice yearly an independent assessor samples addresses across every pool and traces each one back to its acquisition record, its partner, its disclosure, and its consent timestamp. They test whether withdrawal actually removes an address from rotation, and they report exceptions rather than a pass mark. The resulting attestation is available under NDA to any customer or prospect at evaluation stage. SOC 2 Type II is a separate track, currently in its observation window, with the report expected in Q1 2027.

Our supply-chain policy is a public document, not a sales asset. It names the acquisition channels we permit — consented SDK partners, direct ISP leases, registered ranges we announce ourselves, and modems we operate — and it names what is prohibited: addresses obtained through malware, bundled software the user did not knowingly install, compromised devices, botnet infrastructure, or any resale chain we cannot trace to its origin. We do not buy pools from brokers. Where we cannot establish how an address was acquired, we do not sell access to it.

Provenance without customer diligence is half an answer. Every account is verified against a registered legal entity with a named signatory before traffic is enabled. We screen against sanctions and PEP lists at onboarding and continuously thereafter, and we decline sectors and use cases our acceptable use policy prohibits. Free trials do not exist; evaluations run under the same verification as paid accounts. This makes us slower to sign than some providers, which is the point.

We execute a data processing addendum incorporating the EU standard contractual clauses and the UK international data transfer addendum. It records what we process, for how long, where it sits, and which sub-processors are involved — that list is published and versioned, with 30 days' notice before anything changes. Traffic metadata is retained for 30 days to support abuse investigation and billing disputes, then deleted. We do not inspect, store, or sell request payloads.

Abuse reports reach a staffed queue, not a form that disappears. Each gets a case number and an acknowledgement within four hours. We can attribute traffic to an account and, where a report is substantiated, suspend it — most providers can do the first and are slow to do the second. Suspension decisions and their outcomes are logged, and the aggregate numbers appear in each audit cycle.