Is NymVPN safe: audited apps, but no no-logs audit
Privacy and jurisdiction 5.0/10 and security 7.1/10 (segment medians 2.7 and 2.9). No red flag in our data. Independent no-logs audit: ✕ No.
In 10 seconds
- Open-source apps
- Kill switch
- Stores session times
Privacy
- Jurisdiction
- Switzerland, outside 5/9/14 Eyes
- Legal entity
- Nym Technologies SA
- No-logs policy
- Yes Nym can't log; operators contractually bound not to log
- Data retention
- Sentry telemetry ~90 days; accounting 10 yrs (Swiss law); Stripe >=5 yrs
- Shared with third parties
- node operators; payment processors (Stripe, Apple, Google, self-hosted BTCPay); Sentry (opt-in); Zendesk
What the privacy policy says is collected
Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.
- Email✓ No
- IP at sign-up✓ No
- Connection IP✓ No
- Session times✕ Yes
- BandwidthNot stated
- Device info✕ Yes
- App analytics✕ Yes
- Crash reports✕ Yes
Security
- Kill switch
- Yes yes all desktop/iOS; Windows on by default; Android uses…
- DNS leak protection
- Not stated
- Security audits
- Cure53 2024 (apps, VPN, infra, crypto); Oak Security 2023 (mixnet/vesting contracts, wallet); JP Aumasson 2021; Cryspen reviews 2023-24
- Open-source apps
- https://github.com/nymtech
- Two-factor sign-in
- Not stated
The technical side of NymVPN is strong. The app code is open on GitHub, in 2024 Cure53 audited the apps, VPN, infrastructure and cryptography, and in 2023 Oak Security reviewed the mixnet contracts and the wallet. There is a kill switch, routing through multiple nodes, and post-quantum key exchange over the Lewes protocol. Our data shows no public security incidents.
Why privacy scores 5 out of 10
The promise that "Nym cannot keep logs" rests on the network's design: nodes are run by independent operators, and their contracts forbid them from keeping logs. There is no independent audit of this promise. There is no transparency report either; the service only promises so far to publish requests from Swiss authorities, and it says nothing about a warrant canary. The privacy score therefore rests on the service's own statements and its contracts with operators, whose execution has never been verified by anyone outside.
What the apps collect
The policy does not collect email, the IP address at registration, or the connection IP. Session duration, device information, analytics and crash reports are collected only with user consent, and analytics and crash reports are off by default. Sentry telemetry is stored for about 90 days. When paying by card, the data stays with Stripe for at least 5 years.
Jurisdiction and government requests
Nym Technologies SA is registered in Switzerland, outside the 5/9/14 Eyes alliances. The company complies with lawful requests from Swiss authorities and promises to contest and publish them. The service does not state whether it protects against DNS leaks or whether it offers two-factor login. You can compare NymVPN with others in the lists of VPNs with an audited no-logs policy and secure VPNs.