Is CactusVPN safe? Audited no-logs, unnamed company and legacy protocols
Privacy and jurisdiction 5.0/10 and security 3.6/10 (segment medians 2.7 and 2.1). No red flag in our data. Independent no-logs audit: ✓ Yes.
In 10 seconds
- Independent no-logs audit: ✓ Yes
- Kill switch
Privacy
- Jurisdiction
- Not stated
- Legal entity
- Not stated
- No-logs policy
- Yes
- Shared with third parties
- Google Analytics (non-personal)
- Trackers on the website
- Google Analytics
What the privacy policy says is collected
Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.
- Email✕ Yes
- IP at sign-up✕ Yes
- Connection IP✓ No
- Session times✓ No
- Bandwidth✓ No
- Device infoNot stated
- App analytics✕ Yes
- Crash reportsNot stated
Security
- Kill switch
- Yes (yes (system and app level))
- DNS leak protection
- Yes (yes (DoH))
- Encryption
- AES-256
- Security audits
- Securitum (no-logs)
- Two-factor sign-in
- Not stated
CactusVPN scores 5.0 out of 10 for privacy and 3.6 for security in our ranking, against segment medians of 2.7 and 2.1. Our data shows no red flags, and we know of no public security incidents. The weak link here is who stands behind the service.
What the audit confirmed
Securitum checked the no-logs promise, and the report is published, so CactusVPN makes it onto the list of VPNs with an independent no-logs audit. Under its policy, the service does not store your connection IP, session times or traffic volume. An account requires an email, and at the same time CactusVPN records the IP of your last login to the dashboard for fraud protection. Limited anonymized data goes to Google Analytics. Paying with cryptocurrency allows a partly anonymous sign-up, but the service does not refund crypto payments.
Who is responsible for your data
The legal entity and address are not stated on the pages we reviewed. The "About us" page only says the company started in Moldova, and the privacy section is hidden inside the terms of service. CactusVPN says nothing about a transparency report, a warrant canary or responses to government requests. If the provider receives a demand to hand over data, you will not find out which country's laws it will follow.
Encryption and protocols
The kill switch works at both system and app level, DNS requests are protected via DoH, and encryption is AES-256. For everyday use there are WireGuard and OpenVPN. PPTP and L2TP/IPsec remain in the protocol list, and PPTP has long been considered broken, so you should not choose it. The service does not say whether it offers two-factor login, RAM-only servers or open-source apps. If you want a provider with a clear jurisdiction, check out secure VPNs.