Trust, layer by layer.
Precise architecture makes a stronger promise than a superlative. Understand what each layer does, who participates and where responsibility changes hands.
Conceptual access path. These layers complement one another; none replaces the others.
Transport is one layer
WireGuard encrypts traffic between a connected device and the gateway. Native admission authorizes that device using a separate signed challenge. This is not the same as application-level end-to-end encryption.
Identity and admission
The yura-native/1 contract separates Ed25519 installation identity from the WireGuard transport key. An account-authenticated registration challenge establishes ownership. An admission challenge binds the transport key to an authorized credential; sessions expire and can be revoked.
Private routes and names
The documented split-routing contract sends private destinations through Native and leaves public traffic on the ordinary interface. Private DNS maps .yura names into the service-routing environment. The public website does not enumerate private registrations.
HTTPS and service authorization
Private HTTPS uses the Yura trust bundle and normal certificate verification. Network admission establishes reachability; it does not replace an application’s authentication or authorization. A gateway remains a trust boundary.
OS and local security
The Linux-based OS direction includes security-conscious installation, credential handling and privilege separation. Disk encryption such as LUKS2 is an installation property to verify in release-specific OS documentation, not a guarantee about every running device.
Creation and versioning
The Studio static staging contracts define account-scoped projects, constrained asset paths, draft validation, immutable versions, private previews, publication, rollback and access policies. These contracts are distinct from the existing production self-hosted registration flow.
Hosting isolation
Dynamic apps, APIs, databases and workers require isolated runtimes, resource controls, separate secrets handling and lifecycle management. The architecture keeps arbitrary tenant code out of the privileged control plane. Managed dynamic hosting is a platform direction, not a public action on this site.
Privacy has several boundaries
Transport encryption, HTTPS, device authentication, service permissions, disk encryption, application end-to-end encryption and data-retention policy solve different problems. Privacy comes from understanding and controlling these layers; the existing privacy policy remains the policy reference.