---
title: "Anonymizing vs. Non-Anonymizing Tunnels: What the \"anonymous\" Flag Means"
type: "explainer"
url: "https://docs.spur.us/knowledgebase/explainers/anonymizing-vs-non-anonymizing-tunnels"
category: "Anonymizing Infrastructure"
product: "context-api"
publishedAt: "2026-09-15T00:00:00.000Z"
updatedAt: "2026-09-15T14:17:19Z"
---

# Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means

Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.

Spur distinguishes anonymizing proxies and tunnels from non-anonymizing ones. Detecting that traffic is routed through a tunnel or proxy is not, on its own, a statement about intent — some tunnel infrastructure exists for entirely legitimate operational reasons and isn't meant to hide the user's origin.

When Spur detects a tunnel or proxy, the response's tunnels object may include an anonymous flag:

"anonymous": false — corporate or Zero Trust Network Access (ZTNA) infrastructure, such as GlobalProtect, that gets structurally attributed as a tunnel but is not intended to anonymize the user

"anonymous": true — a service intended to anonymize the user's origin, such as a commercial VPN or anonymizing proxy

Use the anonymous flag to decide whether "detected as a tunnel" should factor into a risk or enforcement decision, rather than treating any tunnel detection as inherently suspicious. Detection methodology can differ between Spur products and feeds, so if a specific case needs more detail than this flag provides, it helps to know which product or feed is in use.