Is VPN Gate safe? Logging policy, audits and jurisdiction
Privacy and jurisdiction 0.3/10 and security 1.1/10 (segment medians 2.7 and 1.2). Red flag: Stores connection IP addresses. Independent no-logs audit: ✕ No.
In 10 seconds
- Open-source apps
- Stores connection IP
- Stores session times
Privacy
- Jurisdiction
- Japan, outside 5/9/14 Eyes
- Legal entity
- VPN Gate Academic Experiment Project, University of Tsukuba (with SoftEther Corporation)
- No-logs policy
- No logs kept
- Data retention
- connection logs ≥3 months (central, SoftEther); packet header logs ≥2 weeks on each volunteer server
- Shared with third parties
- volunteer operators keep packet logs; SoftEther holds central logs
What the privacy policy says is collected
Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.
- Email✓ No
- IP at sign-upNot stated
- Connection IP✕ Yes
- Session times✕ Yes
- Bandwidth✕ Yes
- Device info✕ Yes
- App analytics✓ No
- Crash reports✓ No
Security
- Kill switch
- No
- DNS leak protection
- Not stated
- Security audits
- No
- Open-source apps
- Yes SoftEther VPN, http://www.softether.org/
- Two-factor sign-in
- Not stated
VPN Gate encrypts the channel to the server, but it does not give you anonymity. It is an academic experiment run by the University of Tsukuba together with SoftEther Corporation, and the service states outright that it keeps logs. There is no no-logs policy and no independent audit, which is why we give it a red flag for storing connection IPs.
Who can see your data
Logging happens on two levels. SoftEther keeps a central connection log for at least 3 months: the client's source IP, session times, traffic volume, and the name and version of the software. On top of that, each volunteer server keeps a log of packet headers for at least 2 weeks. A private individual runs each server, many of these servers sit on home connections, and anything not sent over HTTPS passes through that person's machine in the open.
Japan is outside the 5/9/14 Eyes alliances, but that helps little here. Under the service's terms, logs are handed to police, prosecutors and the courts on request, and Japanese law allows an injured party to obtain disclosure of the source IP. Registration is not required and the service never asks for an email. With source IPs being stored, that still leaves you identifiable.
Protection in the app
The SoftEther VPN client is open source, which is a plus. There is no kill switch, the service says nothing about DNS leak protection, and it names no security audit. For L2TP and SSTP, a shared login and password of vpn/vpn is used.
What VPN Gate is suitable for
One-off access to a blocked site, when you are not worried about being identified. For privacy or working with personal accounts, it is better to pick a service from the list of VPNs with an audited no-logs policy or check out VPN Gate alternatives.