Is iTop VPN safe? Logging policy, audits and jurisdiction
Privacy and jurisdiction 2.3/10 and security 4.3/10 (segment medians 2.7 and 2.1). No red flag in our data. Independent no-logs audit: ✕ No.
In 10 seconds
- Kill switch
Privacy
- Jurisdiction
- Not stated
- Legal entity
- iTop Inc.
- No-logs policy
- Yes
- Data retention
- no specific periods; backups for legal obligations
- Shared with third parties
- service providers (billing, support, hosting, stats); Google Analytics; Firebase; Crashlytics; App Center; haveibeenpwned (DualSafe)
- Trackers on the website
- Google Analytics; cookies; web beacons
What the privacy policy says is collected
Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.
- Email✕ Yes
- IP at sign-upNot stated
- Connection IP✓ No
- Session timesNot stated
- BandwidthNot stated
- Device info✕ Yes
- App analytics✕ Yes
- Crash reports✕ Yes
Security
- Kill switch
- Yes yes Windows, built-in; plus WebRTC leak, IPv4/IPv6/DNS…
- DNS leak protection
- Yes (yes (DNS masking, WebRTC leak defense))
- Encryption
- AES-256
- Two-factor sign-in
- Not stated
A protocol you can't verify
iTop VPN does offer basic protection: AES-256 encryption, a kill switch in the Windows app, DNS and WebRTC leak protection, and a Double VPN mode. On security, the service scores 4.3 out of 10, noticeably above the median for its segment. The weak spot lies elsewhere. None of the apps include WireGuard, OpenVPN, or IKEv2: iTop uses its own protocol called Smart VPN Protocol with TCP, UDP and HTTPS modes, and does not publish its specification. The service names no external security audit and no open-source code for its apps, so you have to take the protocol's design on trust.
What the privacy policy says
iTop claims a no-logs policy and states that it does not store the connection IP address. There is no independent verification of that promise, so the service scores 2.3 out of 10 on privacy, below the median for its segment. The policy gives no data retention periods and only mentions backups kept for legal obligations. It was last updated in June 2022.
The service collects quite a lot. An email address is required for an account, support receives details about your device and system, and the apps have Google Analytics, Firebase, Crashlytics and Microsoft App Center built in. The policy says iTop shares data with authorities in response to valid subpoenas or warrants. The policy does not say whether iTop stores session times or traffic volumes.
Jurisdiction and red flags
The legal entity is listed as iTop Inc., but the service does not name its country of registration, and it is unclear which intelligence alliance that country belongs to. More about the company is on the page about who owns iTop VPN. Our data shows no public incidents. If a no-logs promise confirmed by an audit matters to you, see VPNs with an audited no-logs policy.