Security

How Walltunnel is built.

A security product should be able to explain itself. This is what runs on a firm's devices, what runs in the cloud, and what we chose not to do.

The tunnel

Every connection leaves the device through one encrypted tunnel to the nearest Cloudflare data center, using MASQUE over HTTP/3.
The tunnel's key agreement is post-quantum: ML-KEM-768 combined with P-256, with no fallback to classical-only cryptography. Traffic recorded today can't be decrypted later by a quantum computer.
The engine on the device is Cloudflare's own client, signed by Cloudflare and notarised by Apple. We don't modify it.

Each firm has its own account, with its own rules, devices and logs. No firm's activity is stored beside another's.
Devices join with an enrollment credential that is specific to the firm. On the Mac it is readable only by the system, never by the person using it.

If a device can't reach the checks, it doesn't send traffic around them.
Firm devices are locked on: staff can't pause protection, and if anything drops the tunnel it reconnects within a minute.
For a real outage there are ways out, held by us: a one-time code that frees a single device, and a switch that releases every device at once.

Before installing the engine, the Walltunnel installer confirms the package carries a valid Apple-issued signature from Cloudflare's developer account, is notarised, and is accepted by Gatekeeper. A package that fails any check is refused.
The engine is downloaded fresh from Cloudflare for every build of the installer.

Connections are checked by name, by connection and by content. Pages and files are inspected in memory and never stored.
Apps known to reject inspection, such as banking apps and Apple services, are passed through from a list Cloudflare maintains, and are still checked by name. We use exact hostnames, never broad exceptions.
Activity logs hold the time, the device, the address and which rule matched. They are kept for a day unless the firm asks for longer.

If you think you've found a security issue in Walltunnel or this website, write to support@aai.dev. Our security.txt has the same contact.

Last updated 14 October 2026.