Features

Kill switch

Plus, Pro, and Business can keep traffic from leaking outside the tunnel. The Windows service applies the rule, not the window you click.

Off leaves routing to the app you are using.
Automatic blocks non-tunnel traffic while a connection is active.
Strict holds that block until you disconnect. If the privileged service stops responding, the rules are removed so a crash does not leave the computer offline.
The desktop window cannot show Protected unless the interface, handshake, route, DNS, account session, and connectivity check all pass.

Create an account and connect a device.

The device keeps its private key. The API assigns a server that is actually online.