Sovereign security,
sealed end to end.
Shanti Africa carries your organisation's traffic through encrypted WireGuard tunnels — under quantum-resistant Triple-Lock encryption, with private keys that reside inside your own jurisdiction. We run the plane. We never hold the keys.
- Version
- 1.0.0
- Size
- 113 MB
- SHA-256
- 1701df81…1b2e18d
- Server key
- rVUW+nQH…qFq7RQ=
Three locks over one sovereign plane.
Encryption, metering and residency are not features bolted on top — they are the substance of the transport itself. Each stands on its own; together they are the seal.
Triple-Lock Encryption
WireGuard under three composable locks — AES-256, ML-KEM post-quantum key exchange, and a residency lock bound to your jurisdiction. Harvest-now, decrypt-later has nothing left to harvest.
Fiscal Recovery Engine
Every session is metered at the byte and written to an auditable usage ledger — the foundation for cost recovery, billing and compliance your organisation owns outright, not a bill you're handed.
Sovereign Key Residency
Private keys are generated on the device and held inside your region. The control plane provisions peers and policy; it is architecturally incapable of reading your traffic or impersonating a device.
Choose your platform.
Signed, self-contained clients with the WireGuard engine bundled. No dependencies, no config files to pass around — sign in and the device provisions itself.
| Platform | Version | Size | SHA-256 | Download |
|---|---|---|---|---|
macOS arm64 · M-series | 1.0.0 | 113 MB | 1701df81a8b6e28b2c06… | Download |
macOS x64 | 1.0.0 | 119 MB | 088f86d3447727240cae… | Download |
Windows x64 | 1.0.0 | 100 MB | 5d9d0f2e40e8215cdb6e… | Download |
get.shantiafrica.com/latest.json.From download to tunnel in three steps.
No config files, no shared secrets over email. The client and the control plane do the handshake for you — and your private key never leaves the machine.
Download
Get the signed client for your platform. It ships with the WireGuard engine and the privileged helper it needs to open the tunnel.
Sign in
Authenticate with your Google Workspace identity. The device generates its keypair locally and registers the public half — the private key is never transmitted.
Connect
One tap. The tunnel comes up with your policy, routes and DNS — resolved through the sovereign resolver, inside the encrypted path.