Is Bright VPN safe? Logging policy, audits and jurisdiction

Privacy and jurisdiction 0.3/10 and security 0.7/10 (segment medians 2.7 and 2.1). Red flag: Stores connection IP addresses. Independent no-logs audit: ✕ No.

In 10 seconds

Stores connection IP
Stores session times

Privacy

Jurisdiction: Not stated
Legal entity: Bright Data Ltd.
No-logs policy: Yes no logs of browsing activity, traffic destination, content, DNS
Data retention: technical details short periods; extension stats 6 days
Shared with third parties: service providers, affiliates; user's connection used by Bright Data customers
Trackers on the website: Google Analytics, cookies, pixels

What the privacy policy says is collected

Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.

Email✓ No
IP at sign-upNot stated
Connection IP✕ Yes
Session times✕ Yes
BandwidthNot stated
Device info✕ Yes
App analytics✕ Yes
Crash reportsNot stated

Security

Kill switch: Not stated
DNS leak protection: Not stated
Encryption: AES-256 (IKEv2)
Security audits: No AppEsteem seal shown
Open-source apps: No
Two-factor sign-in: Not stated

The main risk: other companies use your IP address

Bright VPN is free because Bright Data uses the user's connection while the device is idle, and routes its customers' requests through it to collect public web data. To websites, these requests come from your IP address. You cannot see or control what the clients are requesting; you can only limit the traffic allowance and the schedule. For an app marketed as protection, this is the main weak point. You can read about the company itself on the page about the Bright VPN owner.

What the service records

The policy promises not to keep logs of visited sites, destination addresses, content or DNS queries. At the same time, it clearly states that the connection IP and session time are collected, and that technical data is stored for "a short period" with no exact figure. That is where our red flag and the 0.3 out of 10 for privacy come from. You do not need to register or hand over an email, which is a plus. The privacy policy was last updated on October 7, 2021.

Audits and jurisdiction

There is no independent audit of the logs; the site only shows an AppEsteem badge, which checks an app for intrusive behavior. There is a Bright Data bug bounty program with rewards starting at $100. The legal entity is named, Bright Data Ltd., but the service does not say in which country it is registered. If you want a provider whose no-logs claims someone has verified, check our audited no-logs VPNs.

Does Bright VPN encrypt traffic on Android?

On Windows and Mac, IKEv2/IPsec with AES-256 is used. On Android, according to the service's description, Smart DNS is used, which only alters DNS responses and does not encrypt traffic by itself.