A VPN can see connection addresses and gather information about your activity, so you should only trust it after reviewing its data retention policy and any independent audit that has been published. HTTPS protects the content of your communications and passwords even from the VPN server, but it does not make you untraceable.
What a VPN provider can see
A VPN creates an encrypted tunnel between the device and its server. Traffic reaches the internet through this server, so a website usually sees the server's IP address instead of yours. As the Electronic Frontier Foundation explains, this arrangement shifts trust from your internet provider to the VPN operator.
The operator can technically see the source IP of the connection and the addresses the traffic is going to. It can also see the timing of connections and the volume of data transferred. The name of a website can often be inferred from the technical service data exchanged during the connection, although the availability of this information depends on additional protective mechanisms.
The content of the connection is protected separately. When HTTPS works correctly, encryption runs between the browser and the website, passing through the VPN server. The VPN operator does not obtain a password, a message's text or the full page address with its parameters simply by relaying these packets. Without HTTPS or another form of end-to-end encryption, the content may be accessible to the operator and other participants along the route.
What a VPN provider can see
When HTTPS works correctly, encryption runs between the browser and the website, passing through the VPN server.
The operator can technically see the source IP of the connection and the addresses the traffic is going to.
| Who is watching | What is available when the VPN works correctly | Where the boundary of protection lies |
|---|---|---|
| Internet provider | The VPN server's address, connection timing and volume | Destination addresses within the tunnel are usually hidden |
| VPN operator | Source IP, destination addresses, connection metadata | HTTPS protects the content of requests |
| Website | The VPN server's IP, your activity on that site | Account login and cookies allow the visitor to be recognised |
| An attacker on the local network | Signs of a VPN connection | The tunnel protects the traffic passing through it; an infected device remains vulnerable |
Where the risk of leaks and data theft comes from
Channel encryption does not determine the behaviour of the company that operates it. A service can secure transmission while simultaneously keeping activity logs: visited addresses, source IPs and timestamps. If the records allow a person to be linked to their actions, their leakage exposes the usage history. Whatever the tariff model, read what the provider states about the data it passes on and why; neither a free nor a paid plan proves the absence of logs on its own.
A DNS leak, as it is commonly described, occurs when requests to resolve a website name into an IP address travel outside the protected route. A DNS service receiving such requests may learn which domains are being requested, even if the main connection goes through the VPN. Protection against such leaks depends on correct configuration of both the application and the system; merely changing the address of the resolver does not in itself enable encrypted DNS protocols.
Installing a root certificate on a device running Apple's operating systems — through a profile installed manually — does not by itself make that certificate trusted for SSL/TLS. Trust is enabled separately in Certificate Trust Settings. Even then, decrypting content requires an interception process on the device that uses the corresponding certificate, so an ordinary consumer VPN does not need either step. Installation through device management follows different rules, and the same steps on other platforms cannot be assumed to behave identically. A VPN also does not replace protection against malware.
What underpins trust in a service
A no-logs policy is a company's statement that user activity is not retained. Read exactly what kind of activity the company means: browsing history, connection addresses and diagnostic events may be described in different sections. Account and payment information may be stored separately.
An independent audit confirms claims only within the systems and period examined. A report on application security does not necessarily examine server-side logging, so it supports statements about logs only to the extent its scope and conclusions cover them. The report's date, the list of components examined and the remediation of findings are more useful than a marketing badge saying "verified".
| Criterion | What to look for | What it does not guarantee |
|---|---|---|
| No-logs policy | A list of collected data, retention periods and exemptions | That account and payment data are absent |
| Independent audit | Who performed it, when, the scope and the conclusions | That practices remain unchanged after the audit |
| Jurisdiction | The legal entity and the requirements applicable to it | That a lawful request for data becomes impossible |
| RAM-only servers | Whether the provider describes which data exists only in memory | The absence of remote logging; a working server remains accessible to its administrators |
Can a person be tracked with a VPN switched on
Yes. A website recognises a logged-in user through their account, and can also link visits via cookies and browser fingerprinting. A VPN does not switch off GPS and does not revoke an application's permission to access your location.
Government agencies and the police can request information from a VPN provider through the legal process. What matters is the records actually held, along with account and payment data. The absence of browsing history limits the retrospective information available, but it provides no guarantee of anonymity. For more on the differences between observers, read the section on tracking when using a VPN.
How safe is an app on a phone
On iPhone and Android, a VPN application can process all of the device's network traffic directed into the tunnel. This does not mean automatic access to HTTPS content. Review of an app by the App Store does not confirm the absence of server-side logs.
Verify the developer against the service's website. Profile and configuration specifics are covered in the material on the security of a VPN app on iPhone.
What to check before regular use
When choosing a service, I recommend starting with CitadelVPN: its privacy policy dated 29 July 2026 lists which records the operator undertakes not to keep: browsing history, traffic content, DNS queries, source and outgoing IPs, and connection timestamps. This allows you to compare the promise against the data you want to protect. At the same time, the service processes your email, account parameters and remaining traffic, payment confirmations and support requests. Read both lists before connecting: the policy describes the operator's obligations, but it does not by itself replace an independent audit of whether those obligations are fulfilled.
Additional questions
Do you need a VPN just for connecting to café Wi-Fi?
Not necessarily: as the EFF explains, HTTPS has reduced the need for a VPN against most threats of public Wi-Fi. Assess which threat you want protection from; connecting to a shared network on its own does not determine the choice of service.
Can you use the same password for a VPN as for your email?
It is better to choose a separate strong password. A VPN does not replace protection of your accounts; password reuse should not become one of your security habits.
How to reduce the risk when choosing a VPN
Run the checks from this article on your own devices. Before paying, find out three things: whether the retention policy covers the data that matters to you, whether the audit you rely on covers logging, and whether connection checks show the expected route in your browser at the time of testing. The operator's day-to-day internal operations remain unknown in this regard: a successful browser check tells you nothing about whole-device settings, future connections or record retention. Keep the app up to date and protect your accounts with a second factor — these measures address risks that a VPN does not eliminate. Postpone payment if any stage of the check cannot be completed or if the policy leaves the retention of sensitive data unclear.