Cherubim blocks distractions and harmful content before they reach your device — enforced at the DNS level with optional partner accountability so you can't quietly undo your rules.
No app required for iOS. Installs as a system profile in 60 seconds.
How it works
Three steps from zero to protected — no technical knowledge required.
Sign up with an email and password. No credit card, no trial — just an account.
On iOS, download a DNS profile and install it from Settings in under a minute. On Mac, download and run the app. On other platforms, point your DNS resolver at your unique URL.
Block domains, subscribe to curated blocklists, and set quiet-time schedules. Lock any rule behind a partner's approval so it can't be quietly undone.
Who it's for
Cherubim works for anyone who wants real enforcement, not just a suggestion box.
Struggling to stay off social media or adult content? Lock your own rules so you can't remove them in a weak moment. Cooldown timers force a waiting period before any change takes effect.
Link with a partner. Mark rules as partner-protected. Neither of you can change them without the other's explicit approval — and they get a notification the moment a request comes in.
Set up a child's device with a supervised iOS profile that cannot be removed without wiping the phone. Add blocklists and quiet-time schedules from the web dashboard — no touching the phone.
Why DNS
Browser extensions can be disabled. App restrictions can be worked around. A DNS filter intercepts every domain lookup before the connection is made — it works in every browser, every app, and every WebView on your device simultaneously.
Chrome, Safari, Firefox, every in-app browser — DNS doesn't care which app makes the request.
On Mac, Chromium browsers are also configured via managed policy to prevent DoH bypasses.
For iOS, the supervised profile mode makes removal require a full device wipe — not just a passcode.