Is McAfee VPN safe? What the audit claim and the policy cover

Privacy and jurisdiction 4.3/10 and security 3.9/10 (segment medians 1.3 and 2.5). No red flag in our data. Independent no-logs audit: ✓ Yes.

In 10 seconds

Independent no-logs audit: ✓ Yes
Kill switch
Jurisdiction in 5 Eyes

Privacy

Jurisdiction: USA, 5 Eyes
Legal entity: McAfee, LLC (EEA/UK: McAfee Ireland Limited)
No-logs policy: Yes We don't log or track what you do online
Trackers on the website: Yes Your Privacy Choices

What the privacy policy says is collected

Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.

Email✕ Yes
IP at sign-upNot stated
Connection IP✓ No
Session timesNot stated
BandwidthNot stated
Device infoNot stated
App analytics✕ Yes
Crash reportsNot stated

Security

Kill switch: Yes (yes (Safe Reconnect, off by default) (review))
DNS leak protection: Not stated
Encryption: AES-256 (review)
Security audits: claims independently audited (links TunnelBear blog)
Open-source apps: No
Two-factor sign-in: Not stated

For its segment, McAfee VPN looks decent: privacy of 4.3 and security of 3.9 out of 10, against medians of 1.3 and 2.5 for VPNs bundled with antivirus packages. Our data shows no red flag and no public incidents, the encryption is AES-256, and according to the policy, the IP address you connect from is not collected. But almost half of the privacy score comes from a single item, and it is worth checking yourself.

An audit that leads to the TunnelBear blog

The McAfee website says the VPN has been "independently audited", and we count this as a no-logs audit: 3 points out of the 6.5 McAfee earned in the privacy section. The link behind this claim leads to a TunnelBear blog post, and McAfee's VPN technology is linked to TunnelBear. Our data shows no link to a separate audit report covering McAfee VPN specifically. If an audit matters to you, compare it with the services in our list of VPNs with an audited no-logs policy.

The US jurisdiction and the 5 Eyes alliance cost McAfee another 2 points, and sign-up requires an email. The service does not publish a warrant canary or a transparency report.

What the policy collects and what it does not say

The policy explicitly names your email and "certain telemetry" from the app. It says nothing about session times, traffic volume, device data, or crash reports, so it is unknown whether these are collected. The McAfee website has trackers.

Connection protection

The kill switch is called Safe Reconnect and is off by default, so turn it on right after installation. McAfee does not say whether it protects against DNS leaks. The apps are closed source, and two-factor authentication is not mentioned. You can compare it with others in our secure VPN ranking.