Real encrypted WireGuard tunnels, honestly described: no connection logs, no traffic logs, no per-session data — just what billing legally requires and nothing past that.