Is Astrill VPN safe? Logging policy, audits and jurisdiction
Privacy and jurisdiction 1.3/10 and security 3.9/10 (segment medians 2.7 and 2.1). No red flag in our data. Independent no-logs audit: ✕ No.
In 10 seconds
- Kill switch
- Stores session times
Privacy
- Jurisdiction
- Not stated
- Legal entity
- Veloxee Corp.
- No-logs policy
- Partial logs policy section; design doesn't allow seeing sites visited
- Data retention
- last 20 connection records per account; campaign data 90 days
- Shared with third parties
- resellers/partners, service providers; Google/Meta ads if cookies accepted; no selling
- Trackers on the website
- Matomo (self-hosted), Google Ads, Meta pixel (opt-in); honors GPC
What the privacy policy says is collected
Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.
- Email✕ Yes
- IP at sign-upNot stated
- Connection IP✕ Yes
- Session times✕ Yes
- Bandwidth✕ Yes
- Device info✕ Yes
- App analyticsNot stated
- Crash reportsNot stated
Security
- Kill switch
- Yes (yes (App Guard))
- DNS leak protection
- Not stated
- Encryption
- AES-256 (OpenWeb, StealthVPN); ChaCha20 (WireGuard); AES/Blowfish/Camellia (OpenVPN)
- Open-source apps
- No
- Two-factor sign-in
- Not stated
Astrill VPN protects your connection better than most consumer VPNs, but its privacy record is weaker. At VPNRadarLab it scores 3.9 out of 10 for security, with a segment median of 2.1, and 1.3 for privacy, with a median of 2.7. Our data shows no red flags and no public incidents.
What the service stores
Its privacy policy contains a no-logs section, which says the service is designed so that it cannot see which sites you visit. At the same time, for every account it keeps the last 20 connections: time, duration, country, device and app version. The connection IP is kept for the duration of the session and deleted after disconnect. The service also counts the total traffic volume of an account. For this reason, we credit its no-logs claim only partially.
Audits and jurisdiction
There is no independent audit of the no-logs claim, and no transparency report or warrant canary either. The service does not say whether a security audit has taken place. Its legal entity, Veloxee Corp., lists an address in Vaduz (Liechtenstein), a country outside the 5/9/14 Eyes alliances. The policy rules out selling data, though it does share data with resellers, partners and service providers. Registration requires an email address, although you can pay with Bitcoin or Monero.
Connection protection
The apps have a kill switch called App Guard and support WireGuard, OpenVPN and the proprietary StealthVPN and OpenWeb protocols, the last two with AES-256 encryption. Multi-hop is available in the VIP add-on from $10 per month, and a bug bounty program is in place. The service does not say whether Astrill protects against DNS leaks, whether two-factor login exists, or whether servers run on RAM. The apps are not open source.
Who it suits
If anonymity matters to you, the connection history and the mandatory email get in the way: check out VPNs with an independently audited no-logs policy or alternatives to Astrill VPN.