Is OllaVPN safe? Logging policy, audits and jurisdiction
Privacy and jurisdiction 4.0/10 and security 6.8/10 (segment medians 2.7 and 2.1). No red flag in our data. Independent no-logs audit: ✓ Yes.
In 10 seconds
- Independent no-logs audit: ✓ Yes
- RAM-only servers
- Warrant canary
- Kill switch
- Stores session times
Privacy
- Jurisdiction
- Not stated
- Legal entity
- Not stated
- No-logs policy
- Yes zero logs, audited zero-logs claim
- Data retention
- signup IP 7d; login IP 1h; sessions 7d; bandwidth 90d; audit log 1y; email deleted within 30d of closure
- Shared with third parties
- processors only (Cloudflare TLS/Turnstile, email delivery); no sale
- Trackers on the website
- Cloudflare Turnstile at signup
What the privacy policy says is collected
Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.
- Email✕ Yes
- IP at sign-up✕ Yes
- Connection IP✕ Yes
- Session times✕ Yes
- Bandwidth✕ Yes
- Device info✕ Yes
- App analytics✓ No
- Crash reportsNot stated
Security
- Kill switch
- Yes (yes (always-on))
- DNS leak protection
- Yes (yes (in-tunnel DNS, OS DNS firewalled))
- Security audits
- none yet (audit by Cure53/Securitum/ROS scheduled before public launch)
- Open-source apps
- planned (PQC wireguard-go patches open; client source promised at public launch)
- Two-factor sign-in
- Not stated
An audit badge with no auditor name
OllaVPN's pricing page displays an "Audited Zero-Logs" badge, but the auditor is not named anywhere. The technology page on the same site says that no audits have taken place yet: it promises a security review by Cure53, Securitum or ROS before the public launch. We credit the no-logs audit based on the service's claim, so the "Yes" rating above rests entirely on OllaVPN's word. The jurisdiction and legal entity are not stated either, and it is unclear whose laws would apply. Services with a confirmed audit are collected in the list of VPNs with a verified no-logs policy.
What is stored under the "zero logs" policy
The privacy policy dated 11 July 2026 names specific periods. The IP used at registration is kept for 7 days, the IP at account sign-in for one hour. The time of each device's last connection is recorded to the minute and kept for 7 days, and the daily traffic counter for 90 days. A verified email is required; sign-in by account number is not provided. There are no analytics in the apps; data goes only to processors such as Cloudflare and the email delivery provider.
Connection protection
The technical side is stronger than the privacy side: the kill switch is always on, DNS runs inside the tunnel, servers are said to work only from RAM, and the WireGuard handshake is a hybrid post-quantum one (ML-KEM-768). There is a warrant canary and an address for vulnerability reports via security.txt with a 90-day safe harbor. Product maturity is weaker: a full app is available so far only for Windows, on iOS there is an alpha version in TestFlight, on Android a beta APK, and the client source code is promised at the public launch.
Which countries does the traffic route through?
The site claims over 120 countries, but the technology page currently lists exit servers only in Germany and the US, with entry for double VPN in Switzerland.