Is Malwarebytes Privacy VPN safe? Logging policy, audits and jurisdiction

Privacy and jurisdiction 5.7/10 and security 5.4/10 (segment medians 1.3 and 2.5). No red flag in our data. Independent no-logs audit: ✓ Yes.

In 10 seconds

Independent no-logs audit: ✓ Yes
RAM-only servers
Warrant canary
Kill switch
Jurisdiction in 5 Eyes

Privacy

Jurisdiction: USA, 5 Eyes
Legal entity: Malwarebytes Inc.
No-logs policy: Yes Can't log. Won't log.
Data retention: free-tier bandwidth 30 days; otherwise as needed
Shared with third parties: service providers; web analytics; legal disclosures; not sold
Trackers on the website: Yes performance/targeting cookies, pixels

What the privacy policy says is collected

Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.

Email✕ Yes
IP at sign-upNot stated
Connection IP✓ No
Session timesNot stated
Bandwidth✕ Yes
Device info✕ Yes
App analytics✓ No
Crash reportsNot stated

Security

Kill switch: Yes
DNS leak protection: Not stated
Encryption: ChaCha20 256-bit
Security audits: independent third-party audit 2026
Two-factor sign-in: Not stated

Malwarebytes Privacy VPN scores 5.7 out of 10 for privacy and 5.4 for security. For a VPN bundled with an antivirus package, those are high numbers: the medians for the segment are 1.3 and 2.5. Our data shows no red flags.

What works in its favor

An independent audit verified the no-logs policy in 2026, though Malwarebytes does not name the auditor. The servers are diskless, run from RAM, and belong to the Swedish company AzireVPN, which is part of Malwarebytes. AzireVPN publishes a monthly warrant canary and a transparency report. There is a kill switch and a vulnerability disclosure program, and WireGuard uses ChaCha20 encryption.

The main weakness: the US and an account tied to an email

Malwarebytes Inc. is registered in the US, a 5 Eyes country. The policy states directly that the company may disclose data in response to a subpoena, warrant or court order. According to the policy, it does not collect the connection IP. At the same time, an account requires an email, and the policy lists the app version, the licence ID and the WireGuard public key among the device data it collects. There is no anonymous sign-up. A subscription can be linked to a person. Browsing history, according to the service, is not logged, so there is nothing to hand over. On the free tier, Malwarebytes keeps the amount of data used for 30 days.

Advertising cookies and pixels are present on the Malwarebytes website. The policy denies analytics inside the VPN app itself.

What the service stays silent about

Malwarebytes does not say whether it protects against DNS leaks, whether there is two-factor authentication, or whether it stores session times. The service also makes no claim of obfuscation, and DPI systems easily recognise plain WireGuard traffic.

Services with a verified no-logs policy are collected in our rating of audited VPNs. To find out who is behind the brand, read the page about the owner of Malwarebytes Privacy VPN.