What your ISP sees when you use a VPN (and what it does not).
State of things on 19 October 2026: Pevnost is in private beta. The first server, prg1 in Hluboká nad Vltavou (WEDOS data centre), has been live since 18 October; a first short test measured around 300 Mbit/s. Every new account gets two free hours (one trial per connection, one device), then 120 CZK / €5 for 30 days or 1 200 CZK / €50 a year. Pay with Bitcoin on-chain (preferred), by card through Stripe or by bank transfer; Lightning is planned and Monero is coming. Windows app 0.3.1 beta, Android app 0.1.0 beta. Last reviewed 19 October 2026.
Your ISP, whether a home broadband provider or a mobile network, is the first to see every packet that leaves your device. So it is worth asking precisely what your ISP sees when you use a VPN. The answer is not “nothing”. It is narrower and more useful: the operator still knows that you are online, when, how much, and that the traffic goes to a VPN server. It does not know where it goes next.
Without a VPN
Most sites use HTTPS, so the operator does not see page content, passwords or full URLs. It does see the destination IP of every connection; every name your device looks up, if you use the operator’s DNS resolver (the default on most routers); usually the site name in the TLS handshake (SNI), unless both browser and site use Encrypted Client Hello; and the timing and volume of everything. Encrypted DNS in the browser hides the lookups even without a VPN, but not the destinations.
With a VPN
With Pevnost on, your traffic is one stream of UDP packets between your address and our server. The operator sees:
- That you use a VPN, and which. Our node’s address is public and WireGuard is easy to recognise on the wire. We do not disguise it.
- When and how much. Start and end of the connection, volume in each direction, the rhythm of traffic. Our configuration sends a keepalive every 25 seconds, so even an idle tunnel is visible.
- The shape of traffic. Encryption hides content, not packet sizes and timing; a video stream looks different from a call. What and with whom stays hidden.
- Anything outside the tunnel. Traffic before the tunnel starts, during a drop without a kill switch, or from apps you exclude.
It does not see the sites and services you use, your DNS queries (every Pevnost configuration uses our resolver at 10.8.0.1, reachable only through the tunnel, with no query log), or the ports and protocols inside. IPv6 is routed into the tunnel too (::/0), so it does not slip around it.
What the operator knows anyway
- Who you are. Your contract, your name, the line address or the SIM card.
- Where your phone is. Phones register with cells; a VPN runs a layer above and changes nothing about that.
- Retained data. Czech operators keep traffic and location data about your connection for six months under § 97 of the Electronic Communications Act. With a VPN those records show when you were online and that you talked to our server, not where you went. Why that duty binds the operator and not us is in VPN and the Czech courts.
- Calls and SMS. Ordinary calls and texts do not travel over the internet, and no VPN touches them.
Where the visibility moves
A VPN does not destroy information; it moves it. While you are connected our node holds your current address in memory, because it must send packets back, and writes nothing about your traffic (see what no-log means). The data centre our node sits in sees which addresses connect and when, and on the exit side the combined destinations of all customers; it can sample flows. Anyone who watches both your line and our uplink can match timing and volume. That takes reach into two networks, in practice a state, and no single-hop VPN prevents it.
When the operator sees more than you expect
- Before the tunnel is up. Devices talk to the network before a VPN starts. Use Android’s Always-on VPN with Block connections without VPN, or our Windows app’s kill switch; see the kill switch explained.
- Captive portals. The login page of hotel or train Wi‑Fi has to open outside the tunnel; more in VPN on public Wi‑Fi.
- DNS leaks. Security software or a misconfigured system can send lookups to the operator’s resolver anyway. The leak test takes two minutes.
In short
With a VPN your operator knows that you are online, when, how much, and that you use Pevnost. It does not know where you go or what you look up. Your identity, your phone’s location and the retained connection records stay with it. A VPN does not make you anonymous; it narrows what the network you connect through can see and moves the rest to us. Here is why that is still not invisibility.