Is X-VPN safe? Logging policy, audits and jurisdiction
Privacy and jurisdiction 8.0/10 and security 4.6/10 (segment medians 2.7 and 2.1). No red flag in our data. Independent no-logs audit: ✓ Yes.
In 10 seconds
- Independent no-logs audit: ✓ Yes
- RAM-only servers
- Kill switch
Privacy
- Jurisdiction
- Singapore, outside 5/9/14 Eyes
- Legal entity
- LIGHTNINGLINK NETWORKS PTE. LTD.
- No-logs policy
- Yes
- Data retention
- aggregated metrics max 48h; account for life of account
- Shared with third parties
- Stripe; PayPal; CoinPayments; AdMob; InMobi; Chartboost; Liftoff; Firebase; Google Play Install Referrer
- Trackers on the website
- Yes cookies; cookie declaration
What the privacy policy says is collected
Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.
- Email✕ Yes
- IP at sign-up✓ No
- Connection IP✓ No
- Session times✓ No
- Bandwidth✕ Yes
- Device info✕ Yes
- App analytics✕ Yes
- Crash reports✕ Yes
Security
- Kill switch
- Yes
- DNS leak protection
- Not stated
- Encryption
- AES-256
- Security audits
- ISAE 3000 attestation completed; SOC 2 underway
- Two-factor sign-in
- Not stated
For privacy, X-VPN scores 8.0 out of 10 with us, and 4.6 for security. Both scores are above the medians for the consumer segment (2.7 and 2.1), and our data shows no red flags. The gap between them is the short answer: data collection is described in detail, while there is almost no outside evidence for how well the apps themselves are protected.
What X-VPN logs
The service belongs to the Singapore-based LIGHTNINGLINK NETWORKS PTE. LTD., and Singapore is not part of the 5/9/14 Eyes alliances. The no-logs policy is backed by an ISAE 3000 attestation, but the company does not name the auditor. The connection IP, the IP used at sign-up and session times are not stored under the policy. Bandwidth statistics are kept in aggregate for no longer than 48 hours, device data and app analytics are also aggregated, and crash reports from phones go to Firebase. An email address is only needed for the Premium plan, and a disposable address works.
There is a catch with the free version: it runs on ads, and the data recipients named include the AdMob, InMobi, Chartboost and Liftoff networks. The policy says nothing about how the company responds to police and court requests, and the service does not publish a warrant canary. A transparency report exists in the Trust Center, but with the caveat "where applicable".
Where the security points are lost
Kill switch, AES-256, WireGuard, OpenVPN, the proprietary Everest protocol, servers running on RAM only and a bug bounty program are all in place, and post-quantum encryption is claimed by the company itself. The points are lost where there is no external confirmation: the service does not publish a separate security audit (SOC 2 is still in progress) and does not say whether its apps are open source. The service also does not say whether it protects against DNS leaks or offers two-factor login, although X-VPN runs its own DNS servers.
If the auditor has to be named, compare with VPNs with an independently audited no-logs policy and the secure VPN ranking.