Accidentally accepted the answer. I am working on iOS. Why it matters, entirely depends if other apps can generate traffic prior to first unlock. If yes then traffic can bypass the VPN. Can other apps generate traffic prior to first unlock? And also judging from the first reply I assume there is no way for the VPN to be active prior to first unlock? Do I have the right of it?