Draco — Post-Quantum VPN by URSA Mobile

A VPN built for the quantum era

Every design choice serves one goal: privacy that survives the next decade, not just this one.

Post-quantum handshake

A hybrid Rosenpass exchange — ML-KEM768 and Classic-McEliece layered over WireGuard's X25519 — so a future quantum computer can't unlock today's captured traffic.

15 locations, 14 countries

A hand-picked footprint across privacy-friendly jurisdictions and major business hubs — from Falkenstein and Zurich to Tokyo and Sydney. More added by the week.

RAM-only, seizure-resistant

Every exit runs diskless from a tmpfs root. Keys and state live only in memory; a reboot wipes the box. A pulled or imaged drive yields nothing.

No logs by construction

The exits keep no disk to log to. The control plane holds only your account and entitlement — never your traffic, never your DNS. Privacy that's structural, not just a policy.

One-tap connect

Pick a location or hit Quick Connect and Draco brings up the tunnel in a second. Your keys are generated on-device — the control plane never sees a private key.

Included with URSA

Every URSA Secure Mobile OS license and every paid Lyra seat carries full Draco — all locations, no extra charge. One account, one post-quantum backend.

Why post-quantum, why now

The threat isn't a future one. It's a record-now one.

A classical VPN

✕ Encrypted for today only

Key exchange rests on elliptic-curve / RSA math
A quantum computer breaks that math retroactively
Traffic captured today can be decrypted later
Post-quantum is a roadmap item, one protocol at a time
Logs and disks are a policy promise, not a design

Draco

✓ Encrypted for the next decade

Hybrid handshake — ML-KEM768 + Classic-McEliece + X25519
Quantum-safe on every server, every plan, today
Harvest-now-decrypt-later attacks get nothing usable
PQC is the default, not a premium tier
No-log is structural — the exits keep no disk

Harvest now, decrypt later

Adversaries are already recording encrypted traffic in bulk, betting that a large enough quantum computer will one day unlock it. A classical VPN doesn't protect against that bet — the ciphertext is copied while the key math is still breakable. Draco closes the window: with a post-quantum hybrid handshake on every connection, the data captured today stays sealed even against the machines of tomorrow.

Your whole network, one screen

Draco's app is deliberately simple: a live map, a list of every location with real latency, and one big button. The complexity — the post-quantum key exchange, the peer reconciliation, the kill-switch — happens underneath.

Live server map with per-location latency and load
Quick Connect, or pick a country by hand
A visible PQC badge on every active session
Free and paid locations in one honest list

Open the app

Draco app — server list, connect toggle, and post-quantum status

How Draco compares

The leading VPNs got the fundamentals right — no-logs, kill-switch, audits. Draco keeps all of that and adds the one thing none of them ship by default: post-quantum encryption on every server.

	Draco	Proton VPN	Mullvad	NordVPN	ExpressVPN
Post-quantum encryption on every server, every plan	✓	PartialWireGuard only, rolling out	Partialexperimental	—	—
Named PQ algorithms ML-KEM + Classic-McEliece	✓	—	—	—	—
No-logs, RAM-only exits	✓	✓	✓	✓	✓
WireGuard data channel	✓	✓	✓	✓	Lightway
Free tier	✓	✓	—	—	—
Paid price entry annual, per month	$3.99	$4.99	$5.00	$3.39	$6.67
Included with a secure device	✓URSA OS & paid Lyra	—	—	—	—
Kill switch & DNS-leak protection	✓	✓	✓	✓	✓

Competitor details reflect each provider's publicly documented posture at the time of writing and are provided for honest comparison. Draco is the only one where the post-quantum handshake is the default on every server and plan — not an opt-in, a beta, or a premium tier.

Simple, honest pricing

Post-quantum encryption on every plan — never held back behind an upgrade. Pay only for more locations and unlimited use.

Monthly Annual · save 40% 2-year · best value

Free

The funnel — try post-quantum

Full post-quantum handshake
1–2 locations
RAM-only, no-log exits
One-tap connect
No credit card

Get started

Paid · Most popular

$9.99 /mo

billed monthly

Everything in Free
All 15 locations
Unlimited bandwidth
Post-quantum on every exit
30-day money-back guarantee

Get Draco

Included

With URSA OS or paid Lyra

Full Draco — all locations
Every URSA OS license (all seats)
Every paid Lyra Team member
One login across URSA, Lyra & Draco
Already yours — nothing to buy

Talk to us

Frequently asked

The short answers.

What makes Draco "post-quantum"?

Draco's key exchange uses a hybrid Rosenpass handshake that combines the post-quantum KEMs ML-KEM768 (FIPS 203) and Classic-McEliece with WireGuard's classical X25519. The session keys that protect your traffic are derived from all of them, so an attacker would need to break both the classical and the post-quantum math. This runs on every server and every plan — it's the default, not an add-on.

Is Draco really included with URSA OS and paid Lyra?

Yes. Every active URSA Secure Mobile OS license — individual, business, or government — and every member of a paid Lyra Team gets full Draco: all locations, unlimited use, no extra charge. Your URSA or Lyra login is your Draco login; the entitlement is set automatically by what you own.

What's the difference between Free and Paid?

Both get the full post-quantum handshake and the same RAM-only, no-log exits. Free gives you 1–2 locations to try it; Paid unlocks all 15 locations and unlimited bandwidth for $9.99/mo, $71.88/yr ($5.99/mo), or ~$95 for two years ($3.99/mo). Paid plans carry a 30-day money-back guarantee.

Which countries can I connect through?

The launch footprint is 15 locations across 14 countries — the US (east and west), Germany, the Netherlands, the UK, Switzerland, France, Canada, Sweden, Japan, Singapore, Australia, Spain, Italy, and Poland — weighted toward privacy-friendly jurisdictions and major business hubs. New locations are added on a rolling basis.

Do you keep logs?

No — and it's structural, not just a promise. Every exit server runs diskless from RAM, so there's no disk to write logs to; a reboot wipes the box entirely. The control plane stores only your account and entitlement — never your traffic, never your DNS queries, never your connection history.

Does Draco ever see my private keys?

Never. Your device generates its own WireGuard and Rosenpass keypairs locally and sends only the public keys to the control plane. The control plane brokers connections and assigns overlay IPs, but a private key never leaves your device — there's nothing to leak.

Post-quantum VPN.
Every server. Every plan.

Post-quantum handshake

15 locations, 14 countries

RAM-only, seizure-resistant

No logs by construction

One-tap connect

Included with URSA

✕ Encrypted for today only

✓ Encrypted for the next decade

Harvest now, decrypt later

Your whole network, one screen

Web

Windows

macOS

Linux

Android

iOS & iPadOS

URSA OS

Apple TV

Fire TV

Android TV

Talk to us about Draco