Is Aura VPN safe? What it logs, who sees it and what is unproven

Privacy and jurisdiction 1.3/10 and security 1.4/10 (segment medians 1.3 and 2.5). No red flag in our data. Independent no-logs audit: ✕ No.

In 10 seconds

Kill switch
Stores session times
Jurisdiction in 5 Eyes

Privacy

Jurisdiction: USA, 5 Eyes
Legal entity: Aura Sub, LLC (dba Aura)
No-logs policy: Yes do not log or record online activities over VPN tied to you
Data retention: VPN: connection IP deleted at session end; anonymized domain stats aggregated ~monthly; device hashes kept
Shared with third parties: service providers; affiliates (Circle Media Labs); co-brand partners; ad pixels may count as sale/share
Trackers on the website: Yes third-party advertising cookies/pixels; GPC honored

What the privacy policy says is collected

Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.

Email✕ Yes
IP at sign-up✕ Yes
Connection IP✕ Yes
Session times✕ Yes
Bandwidth✕ Yes
Device info✕ Yes
App analytics✕ Yes
Crash reportsNot stated

Security

Kill switch: Yes (yes (may not be in all plans))
DNS leak protection: Not stated
Encryption: AES-128 fixed (review)
Open-source apps: No
Two-factor sign-in: Not stated

Our data shows no red flags or public incidents for Aura. Its weak spot is privacy, and for that the service gets 1.3 out of 10. Aura promises not to record your VPN activity in a way that is linked to you, yet it lists what it does collect: the duration of each session, the traffic volume per session, device details and app analytics. Your IP address is stored in encrypted form when you connect and, according to Aura, deleted after the session ends. Device hashes are kept. There is no independent audit of these promises.

An account with your name on it

The VPN is sold only as part of an identity protection bundle, so the account is not anonymous by design. An email address and phone number are required, your identity is verified, and for identity protection Aura asks for your Social Security number. The company Aura Sub, LLC is registered in Boston, and the US is part of the 5 Eyes alliance. Aura says it has no VPN activity data to give law enforcement and discloses other data when the law requires it. Data is shared with service providers, the affiliated Circle Media Labs and co-branded partners, and the website carries advertising pixels.

Connection security

There is a kill switch, although Aura notes it is not available on every plan. According to the review, encryption is fixed at AES-128, and the apps are closed source. Aura does not say whether the service protects against DNS leaks or whether two-factor login exists. It scores 1.4 for security, against a segment median of 2.5. The bundle's strongest features are blocking of known malicious sites and ads.

Where to find a VPN with a verified no-logs policy?

Services whose no-logs claims have been confirmed by an audit are collected in our ranking of audited no-logs VPNs, and the wider security ranking is in the secure VPN section.