White-Label VPN: What You Inherit vs What You Own

Column A: what arrives because a network already exists. Column B: what still has your name on the invoice, the listing, or the lawsuit caption.

Column A is usually WireGuard, OpenVPN, OpenConnect, and Shadowsocks on the clients, exit nodes, IP reputation work, protocol fallback when UDP dies, and the unglamorous job of keeping a handshake boring from a phone on LTE. You inherit the behavior of that stack. You do not inherit the right to lie about it.

Column B is the brand system, the price, the mailbox, Apple and Google accounts, and every sentence that says 'we' to a customer. You can outsource design. You cannot outsource the fact that the customer paid you.

I make people write this on a single page, in verbs, not in architecture diagrams. 'We set retail price.' 'They rotate a burned IP.' If a line cannot take a verb, it is a slogan.

Klox consumer and partner clients are in the WireGuard-plus-OpenVPN world because some networks hate UDP and some devices still want the older stack. You inherit that product choice when you brand the apps. You do not inherit the right to say you invented the handshake.

Help Center articles are yours. If you tell users 'always use WireGuard' and their hotel only passes TCP 443, you will refund them and blame the protocol. The protocol did not fail. Your copy did.

TLS 1.3 (RFC 8446) may sit under control-plane traffic or parts of OpenVPN. Users do not need a lecture. Reviewers and careful buyers might. Do not paste cipher poetry you cannot defend. Cloudflare's explainer is enough for 'what is a tunnel.' Your FAQ still has to match the toggles in the app you ship.

Users do not email the rack. They email the brand. When an exit is sick, you need a sentence that is true. 'We are looking into it' is allowed. 'Our global backbone is fully redundant' is a novel if you cannot define backbone.

I will not invent a city count for Klox in this article. Operators typically want enough exits that travel is not a coin flip, plus a way to move users off a hot IP. Confirm what you actually get. If you publish a number you guessed from a marketing map, a user in that city will test it on day one.

Capacity and abuse live with the operator on hosted. Your job is routing the complaint and not promising a dedicated IP you did not buy as a SKU.

Logo, name, icon, domain, from-address, in-app strings, receipt footer. If any of those still say the platform's name, you are running a confusing product. Confusion is how chargebacks get extra adjectives.

You own trademark clearance. You own the look that does not clone a giant consumer VPN so hard that Apple thinks you are a knockoff. Guideline 2.3 energy applies: metadata should describe your app. Inherited UI chrome does not give you their brand equity.

White-label means the customer believes they bought you. Act like it in every surface, including password-reset mail.

Klox consumer pricing starts from $2.83 a month on the published plans, with a seven-day money-back window. That is our consumer story, not a mandate for your brand. You can charge more. You can charge less until support eats you.

You own annual vs monthly mix, family framing around five devices, and whether you copy a seven-day window you cannot honor in Stripe. If you advertise 30-day refunds and your processor fights you, that is your problem. The inherited network will not refund on your behalf unless the contract says so.

Do not publish an SLA credit schedule you invented. Operators typically want clarity on refunds for multi-day outages. Confirm what, if anything, the platform will do. Then write only that.

This is the line people hate. They want the vendor to 'handle tech' and their VA to 'handle billing.' VPN tickets do not split clean. 'Can't connect' is protocol, Wi-Fi, expired account, and a kill switch. Your agent is the router. If they only know billing, they will escalate everything and you will hate the vendor for a problem you staffed wrong.

Ticket volume is not a vibe. A messy 1,000-user base can throw 80 to 150 tickets a month. At a few dollars fully loaded per ticket, a $3 plan is a hobby. You own hiring. You own macros that match the app. You own not asking for destination URLs if your policy says you do not look at them.

The operator may give you a status note. They will not sit in your Zendesk.

Apple and Google are slow identity systems. Organization accounts, DUNS, Play Console identity. White-label brands that want a real product put listings under their legal entity. If the vendor publishes as themselves, users install them. That can be a valid reseller-like motion. It is not white-label in the sense customers mean.

You own review notes, demo accounts, nutrition labels, Data safety forms, screenshot sets. We have a rejection-patterns piece for policy failures and a screenshots piece for listing assets. Ownership point here: those forms are your signatures. Inherited binaries do not inherit our App Store history. You start at zero.

Packet Tunnel Provider and VpnService live in the inherited client. The declarations live in your console. Split those in your head or you will wait on a vendor to 'fix review' when the fix is your privacy text.

You own the sentences. You may inherit a network notice you should link, not launder. Do not copy a RAM-disk poem from a company that runs its own fleet. Do not copy a SaaS generator that never mentions tunnels.

The no-logs article is the deep cut on first-person promises. Here the ownership rule is smaller: you write the policy that matches your Stripe, your mailbox, your chat widget, and the operator's linked notice. If you cannot name those processors, you are not done.

Stores will compare App Privacy / Data safety to the policy. That comparison is your problem. The inherited client might include a crash SDK. You still tick the box.

Review history. Trust. A refund rate of zero. A support culture. Trademark clearance. The right to use someone else's screenshots. A merchant account that will not get tested by fraud in week three.

You also cannot inherit a SOC 2 logo from this blog. If you need attestations, ask what exists and put only that on a security page. I will not decorate this article with certifications we have not handed you.

You cannot inherit user love from a protocol. WireGuard is widely liked among people who like protocols. Your one-star reviews will still be about billing.

You cannot inherit a quiet abuse desk. Complaints will name the brand on the app. Your contract should say how notices route. If it does not, you still own the email that arrived. Reply or get pulled by a host. Those are the choices.

Partners fill security pages with numbers they found on someone else's PDF. Uptime percents. Admin routes. City counts. SOC 2 badges. I will not invent those for Klox here. If you need an API to provision accounts, say that in the call: operators typically want create, disable, device revoke, and a support lookup that is not a browsing history. Then write down what you were actually shown.

SLA talk is the same. Operators typically care about how incidents are declared, how long you can stay dark before you owe users a true sentence, and whether credits exist. A percent without a measurement window is decoration. Confirm Klox's commitments on a call. Put only those words on your enterprise one-pager.

This is ownership again. You own the published sentence. The platform owns the datapath. If you publish a fake route, your integrator will build against it and then blame you at 2 a.m.

Write the two columns. Walk every surface: site, app strings, stores, receipts, macros, ads. If a sentence claims an inherited layer as a personal feat, cut it. If a sentence dumps an owned layer on the vendor, staff it or stop selling.

Then pick the motion. White-label if you want column B in full. Reseller if you want attach revenue without owning a binary. Contact if you are an odd shape and you know it.

Consumer users who just need a VPN can go to pricing and download. Do not send them a partner form. Do not send procurement to a $2.83 checkout and call it enterprise. Different rooms.

If you skip the workshop, you will still do it, just later, after a one-star review explains the split better than you did. I would rather you spend the hour now. The ads can wait. The confusing homepage should not ship.