Is installing the Profile and VPN safe?

About 60 seconds

The short version

Six beats. Read them in order. Nothing here is a filmed video; the explanation is the text and diagrams on this page.

1. 00:00

   The Profile is a testing configuration

   It includes a CA certificate, an IKEv2 VPN payload, EAP credentials, and DNS match domains for Apple wireless-location hosts. You can delete it from iOS Settings at any time.

2. 00:10

   The VPN row is not a privacy VPN

   iOS uses the system VPN UI to carry IKEv2. WLOC uses that tunnel for a bounded location-test path. It is not a consumer privacy VPN, accelerator, or 0.0.0.0/0 proxy.

3. 00:20

   Only location-service hosts go through WLOC

   The tunnel overlay is 10.66.0.0/24. DNS match domains send gs-loc.apple.com and gs-loc-cn.apple.com into that path. Other HTTPS stays on the phone's own resolver and link.

4. 00:30

   Sensitive bytes are not retained

   Profile XML and the EAP password transit memory for one explicit no-store download. They are not kept in control-plane databases, queues, analytics, or logs. Precise coordinates are excluded from Google Analytics.

5. 00:40

   Restore stays reachable

   Sign in and use the Control Restore banner. A submitted Restore is not a device-restored claim. Unpaid, refunded, frozen, restricted, and pending-deletion states do not turn Restore off.

6. 00:50

   If WLOC is unreachable, delete the Profile

   On the iPhone, open Settings → General → VPN & Device Management and remove the testing Profile. That local step does not depend on the website.

System model

Four layers, four separate facts

The browser never talks to the Gateway. Passing one layer never upgrades the evidence produced by the next.

1. 01

   Browser

   You sign in, accept policy, and request a bounded test. The client bundle has no Gateway secret.

   A click does not prove the iPhone is online.

2. 02

   API Worker

   The control plane checks session, workspace, device, entitlement, and mutation safety together.

   Authorization is not a location result.

3. 03

   Device coordinator

   One device runs provision, apply, restore, revoke, and emergency stop in order.

   A queued command is not device confirmation.

4. 04

   Gateway and iPhone

   strongSwan terminates IKEv2. The Profile on the authorized iPhone applies the test path. You confirm the target app.

   Gateway target synced is not device online.

Payload

What the Profile contains

Install only on an iPhone you own or are authorized to test. This site never hosts the download.

• CA root certificate

  Needed so the phone can inspect the wireless-location hosts listed below. It is not a license to inspect every HTTPS site.

• IKEv2 VPN payload

  Creates the iOS VPN row and the overlay used for those location-service queries.

• EAP credentials

  Streamed once in an explicit no-store download. WLOC does not retain them in the control plane.

• DNS SupplementalMatchDomains

  gs-loc.apple.com and gs-loc-cn.apple.com. Replacing a Profile is required if that split ever changes.

Until CMS signature verification is proven, WLOC does not call this a signed Profile. Device-specific credentials are not described as hardware-bound.

iOS Settings

Why a VPN appears

Apple surfaces IKEv2 as a VPN configuration. That system label is why testers see a VPN switch after install.

• What it is for

  Carry the bounded location-test overlay so Apple wireless-location queries can be answered for an authorized test.

• What it is not

  Not a privacy VPN, ad blocker, browsing proxy, or full-tunnel 0.0.0.0/0 route. Not Apple CDN traffic.

Split tunnel

Which traffic goes through WLOC

The tunnel carries overlay 10.66.0.0/24. That is not the public Internet, and it is not every app on the phone.

Kept

What WLOC stores

• Account and Portal records

  Email for OTP sign-in; session data; workspace, device, policy, entitlement, and security-event metadata.

• Authorized test records

  Target coordinates, Restore state, diagnostics, and Activity needed to run and explain a test. Precise coordinates stay out of Google Analytics.

• Billing references

  Stripe or Apple identifiers needed for fulfillment, reconciliation, tax, and audit. Payment cards stay with the processor.

• Optional browser analytics

  Only after you choose Allow analytics. Coarse page class, allowlisted events, and ordinary connection metadata. No Google tag loads before that choice.

Not retained

What WLOC does not keep

• Profile XML and EAP password

  Transit Worker and Gateway memory for one no-store download. Not stored in D1, KV, R2, Durable Objects, queues, analytics, structured logs, or fixtures.

• Control-plane secrets

  Gateway or Access secrets, CA private keys, and session or OTP peppers are not written to product storage or this website.

• Raw VPN traffic

  Not retained in control-plane databases or structured application logs.

• Google Analytics exclusions

  No precise coordinates, location-search terms, account email, WLOC account/workspace/device identifiers, Profile data, credentials, checkout references, arbitrary titles, raw query strings, or raw VPN traffic.

Visible Activity history is not proof of storage deletion. WLOC does not currently promise that every operational record is purged after a fixed period.

Recovery

How to Restore immediately

Restore, Revoke, Emergency Stop, Export, and Delete Account remain reachable under unpaid, refunded, frozen, restricted, and pending-deletion states.

• In the Portal

  Sign in and use the Control Restore banner on the authorized device. Repeat calls are idempotent. A submitted Restore is not Gateway readback and is not a device-side result.

• What WLOC will say

  Restore submitted or Restore unconfirmed until independent evidence exists. WLOC does not label a submitted command as Restored successfully on this path.

How to Revoke

Revoke from the Portal device settings. That invalidates the Gateway identity. Remove the Profile on the iPhone as well; Revoke does not physically wipe Settings for you.

Emergency Stop when the service is abnormal

In the Portal, Emergency Stop lives on Settings → Security and on the Restore banner. It asks the Gateway to terminate the tunnel. Acceptance is not automatic proof that the iPhone already looks normal.

If WLOC cannot be reached

On the iPhone: Settings → General → VPN & Device Management → remove the WLOC testing Profile. That local removal is the recovery step that does not depend on Portal, billing, or this website.

Components

Open-source components and licenses

Material third-party components that testers often ask about. This is not a complete software bill of materials.

Listing a component does not make WLOC Cloud open source. WLOC application code is not published as an open-source product on this page.

Availability

Service status

WLOC is designed to publish a separate status surface for API, Portal, Gateway control-plane, billing webhook, and Restore pipeline availability. That page reports whether a service works. It does not reveal Gateway hostnames, user counts, or device data. A public live status host is not linked here until it is reliable.

Contact

Report a security concern

Email support@wloc.app with a reproducible description and redacted timestamps. No response-time SLA, bug bounty, or external certification is claimed here. support@wloc.app

Do not email Profile XML, EAP passwords, tokens, private keys, raw traffic, or unnecessary personal data.