Is Bitdefender VPN safe? Logging policy, audits and jurisdiction

Bitdefender VPN is run by the Romanian company BITDEFENDER S.R.L., and Romania is not part of the 5/9/14 Eyes alliances. The service has a solid technical base: a kill switch on Windows, Android, iOS and macOS 10.15.4 and later, AES-256 encryption, perfect forward secrecy, WireGuard and its own Hydra protocol. The weak spot of Bitdefender VPN is privacy.

What Bitdefender collects

The policy promises "no traffic logs", yet it also lists IP addresses among the data it collects, saying they are needed to establish a connection. Besides those, Bitdefender receives the account email, hashed user and device identifiers, and the device location used for auto-connect. The policy says nothing about session duration or traffic volume.

Bitdefender has no servers of its own: the VPN part is handled by IPVanish, and the policy names it as a data processor. How this arrangement works is covered on the page about the owner of Bitdefender VPN.

Audits and government requests

There is no independent audit of the no-logs claim, and Bitdefender does not publish a transparency report or a warrant canary. According to the policy, the company can disclose data in response to a lawful request. We are not aware of any public security incidents involving this VPN.

The apps are closed source; the code has not been published. Bitdefender does not say whether the service protects against DNS leaks or whether two-factor login is available.

Who this is enough for

For cafe, airport and hotel Wi-Fi, the feature set is sufficient. If you need a VPN provider that cannot link a session to your IP, look at the services in the list of VPNs with audited no-logs.

Does Bitdefender VPN keep a history of the sites you visit?

The policy promises not to keep traffic logs, but no audit has confirmed this.