Documentation

The questions people ask first.

Do I have to open a port on my router?

No, and there is nothing to open. The Connector only ever dials out. It never accepts an inbound connection, so there is no listening port to forward, no firewall hole, and nothing exposed if your home IP changes.

Is my traffic decrypted at your edge?

Briefly, and only for routing, authentication and abuse prevention. We do not collect request or response bodies from tunneled traffic, do not send them to our control plane, logging or analytics systems, and do not retain them. Bodies shown in Request Inspector exist only in the memory of your Connector, on your own machine.

There is one exception, and it does not come from your traffic: evidence a third party submits in an abuse report may contain bodies. That is stored in an encrypted, physically isolated vault, is not searchable by default, and is retrievable only by case ID. The full statement is on the privacy page.

What happens when I run out of traffic?

Paid plans use graduated throttling. During the 100% and 300% throttle stages, requests continue at the rate for that stage; at 500%, traffic is suspended. Free endpoint traffic stops when the Free plan's included monthly traffic is used.

If an Endpoint is suspended at 500%, you cannot resume it yourself — the Resume control is disabled. It comes back when any one of these happens:

• you upgrade your plan,
• you buy a traffic pack,
• your billing period resets.

This is deliberate. A suspension you could click your way out of would not be a limit.

Will my URL change?

No. An Endpoint's address is assigned once and is permanent. It survives pausing, sleeping, deleting and restoring within the restore window.

After an Endpoint is deleted and its 30-day restore window closes, the address is retired permanently and never issued to anyone again. That is why deleting is worth a moment's thought: bookmarks and webhooks pointing at it will stop working, and recreating the Endpoint will not bring the old address back.

The reason it is never recycled is worth stating: if addresses were reused, an old bookmark or a webhook someone configured months ago could quietly start reaching a different customer's service. Storing a retired address forever costs almost nothing; that failure would not be almost nothing.

What happens if my machine goes offline?

The Endpoint stays; the traffic does not. Visitors get a clear error page rather than a timeout, and the Connector reconnects on its own when the machine comes back.

On Free, an Endpoint with no traffic for 30 days goes to sleep — it stops forwarding and releases runtime capacity, but keeps its address. It wakes when the Connector reconnects or when you wake it, at the same address.

Can I use my own domain?

Yes, on paid plans, with automatic TLS. Platform subdomains get automatic TLS on every plan including Free.

Is security a paid feature?

No. Automatic TLS, passcodes, IP allowlists, token revocation and abuse handling are all available on Free. The paid plans buy capacity, regions and scale — not the ability to protect what you expose.

Who can see my services?

Nobody, until you choose. Every Endpoint gets an Access Policy as the second step of creating it — not a setting buried somewhere you might never open. The options are Public, Passcode, IP allowlist, and OAuth via Google or GitHub.

Workspaces cannot see each other's anything.

Can I give a customer temporary access without adding them to my team?

Yes — that is what the Consent Portal is for. You send a request bound to their email address; they choose an expiry and approve, reject, suspend or revoke it themselves.

Two properties are worth knowing:

• Every grant expires. There is no permanent option; the longest you can choose is 30 days.
• Revoking is precise. Revoking one customer's grant closes their sessions within 60 seconds and does not disturb anyone else's, including your own team's.

They do not consume a management seat. Members and authorized visitors are different things and only Members are billed as seats.

Do you support raw TCP?

On paid plans, with payment card verification. Not on Free — creating one there is rejected with upgrade guidance rather than silently failing.

The full protocol table, including what is not supported (h2c, WebSocket over HTTP/2, HTTP/3, TLS passthrough, UDP), is on the documentation front page.

What uptime do you promise?

None, and we would rather say so than imply otherwise. v1 is best-effort, with a public status page and announced maintenance windows. There are no service credits and no published uptime figure, because none is promised.

The status page reports current state. It does not yet cover the relay path itself — that arrives with the relay.

How do I delete my account and data?

Self-service export and account closure are available. Closure is not a single switch that erases everything: some records are deleted outright, and others are retained where we are legally required to, with the traffic-derived ones irreversibly anonymised. The retention table is on the privacy page and lists each category rather than making a blanket claim.

Why "viastead"?

Via — the way through. Stead — a place that stays put. Which is the whole product: a fixed address for something that lives at your place.