Is VeePN safe? Logging policy, audits and jurisdiction
Privacy and jurisdiction 4.3/10 and security 2.1/10 (segment medians 2.7 and 2.1). No red flag in our data. Independent no-logs audit: ✕ No.
In 10 seconds
- Warrant canary
- Kill switch
- Stores session times
Privacy
- Jurisdiction
- Panama, outside 5/9/14 Eyes
- Legal entity
- VeePN Corp.
- No-logs policy
- Yes
- Data retention
- while app installed / as needed; removed after uninstall except legal copies
- Shared with third parties
- AWS, GCP, DigitalOcean, SendGrid, Zendesk, Tidio, PayPal, Paddle, BlueSnap, Cloudflare, Akamai, AppsFlyer, Amplitude, GA, Clarity
- Trackers on the website
- Yes GA/GTM, Clarity, cookies
What the privacy policy says is collected
Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.
- Email✕ Yes
- IP at sign-up✓ No
- Connection IP✓ No
- Session times✕ Yes
- BandwidthNot stated
- Device info✕ Yes
- App analytics✕ Yes
- Crash reports✕ Yes
Security
- Kill switch
- Yes
- DNS leak protection
- Not stated
- Encryption
- AES-256
- Security audits
- no named audit (expert-verified claim)
- Open-source apps
- No
- Two-factor sign-in
- Not stated
VeePN is registered in Panama, outside the 5/9/14 Eyes alliances, and promises not to keep logs. The weak point is that almost all of its promises have to be taken on faith: there is no independent audit of the no-logs policy, no security check with a named auditor, and the website offers only a vague line about expert review. The app source code is closed. Our data shows no public incidents, and no red flags either.
What the service collects
According to its privacy policy, VeePN does not store your IP at registration or the connection IP. As for timestamps, the policy says only the registration date and time are stored. Analytics raises more questions: the app sends usage data and an advertising identifier to AppsFlyer and Amplitude, plus it collects device model, operating system and crash reports. The website runs Google Analytics and Clarity. Your account is tied to an email address, so even if you pay with crypto, you cannot sign up anonymously.
Where the service is weakest
The security score is 2.1 out of 10, at the median level for the segment. A kill switch, AES-256 encryption and Double VPN are in place. The service does not state whether there is DNS leak protection, WireGuard support or two-factor login. VeePN owns no servers of its own: AWS, Google Cloud and DigitalOcean appear in its list of data processors, meaning the hardware belongs to cloud providers.
Government requests
Under the terms, data is handed over only through Panamanian legal process (MLAT requests or letters rogatory), and VeePN says it has received no such requests. There is a warrant canary but no transparency report, so there is no way to verify that claim beyond the canary. For comparison with services whose policies have been audited, see our list of VPNs with an audited no-logs policy and our ranking of secure VPNs.