how it works
Your network. Your watcher.
Our blindfold.
Vigila is three pieces working together — and only the piece that can't read anything is ours. Here is the whole system, no jargon required.
Three steps from "link down" to your pocket
A little box watches your routers
The relay is a small program you run at home or in your rack (Docker, happy on a Raspberry Pi). It checks your routers every 15 seconds — even while your phone sleeps. Why? iPhone apps aren't allowed to watch networks in the background, so Vigila gives you a watcher you own.
It decides what's worth waking you for
Link down? Router rebooted? CPU pinned for ten minutes? Rules withdebouncing make sure a flapping cable means one alert, not forty. Quiet hours hold the small stuff till morning — critical always gets through.
It seals the alert and sends it
The relay encrypts the alert with a key only your iPhone has, and hands the sealed envelope to our tiny forwarding service, which passes it to Apple. Your phone opens it. Nobody in the middle can.
Who runs what
Everything that touches your routers or passwords stays inyour hands. The only thing crossing the internet is an envelope nobody en route can open.
→ no ports opened to the internet · the relay only dials out · works behind NAT
What each party can see
This is the whole point of the design — don't take our word for it, take the architecture's.
| Your router passwords | Alert contents | Your network data | |
|---|---|---|---|
| Your iPhone & Watch | yes — in the Keychain | yes | yes |
| Your relay | yes — encrypted at rest | yes — it writes them | yes |
| Our bridge | no — no field exists for them | no — ciphertext only | no |
| Apple (APNs) | no | no — ciphertext only | no |
Fair questions
What if the relay itself goes down?
Then nothing inside your network can report it — the honest limit of any self-hosted watcher. Run the relay on hardware separate from what it watches (or off-site), and the app always shows live status whenever you open it on your network.
Do I need a static IP or open ports?
No. The relay only makes outgoing connections. It works behind NAT, CGNAT, and a firewall that blocks everything inbound.
How does my phone know it's talking to my router?
On first connect, Vigila pins the router's certificate fingerprint — like SSH does. If it ever changes, the app blocks and asks you before sending anything.
Is any of this "trust us"?
As little as possible. The protocol is documented, the client talks only to your routers, your relay, and Apple — and the bridge's inability to read alerts is enforced by tests, not promises. See Privacy for the formal version.