What Umbra guarantees
Each promise, and the condition it holds under.
What it's for
Read this the morning of a drop. It lists every promise Umbra makes and the exact condition each one holds under — because a guarantee without its condition is marketing, not a property. If a claim you're relying on isn't here with a condition and a line of code behind it, treat it as unproven.
Each promise below is anchored in our source to the code that enforces it, so a claim can't quietly outlive the check behind it. For the fuller picture of what leaves your machine, read What we can & can't see.
Separation & isolation
The network
Rotation never strands
If the pool has no eligible exit, rotation keeps the current one — it never drops an Account to direct to force a change.
Dead & blocked excluded
Every place that picks an exit refuses dead and blocklisted ones. Untested exits are not excluded — see the limits below.
Alignment follows a tested exit
Time zone and location are copied from a proxy's tested region, and can be re-aligned when they drift.
Drop day
Automation
Sync & storage
What Umbra does NOT guarantee
The honest limits. Know these before you lean on them.
The captcha harvester is not isolated
CAPTCHA and Google sign-in solve in one shared helper Session, and in this build it runs on your real connection — there is no per-harvester exit control wired. See The engine & CAPTCHA.
WebRTC isn't checked until you measure
The leak check only blocks after you run "Measure open accounts", and the hardened policy only applies to Accounts that have an exit. An un-measured Session can pass GO.
Untested exits are assignable
Eligibility excludes dead and blocked exits, not untested ones. An exit Umbra has never tested can be handed out; nothing is known about it until you test it.
The team decision board isn't end-to-end encrypted
What the board shows — session names, page titles, URLs, queue positions and cart timers — travels through the relay in the clear. Keep genuinely sensitive values off it. Remote checkout is the exception, and it is sealed: the screen and your taps are AES-256-GCM encrypted under a key your phone and desktop swap by QR at the desk, so the relay only ever carries ciphertext.