A VPN on an iPhone can be safe if you have checked the provider, its data retention rules and the permissions it requests. The mere presence of an app in the App Store does not prove this.
What data a VPN receives
A VPN creates an encrypted tunnel between the iPhone and the provider's server. For connections inside the tunnel, the local network sees a connection to the VPN, while the website usually receives the VPN server's IP address. Part of the trust is therefore transferred from the network operator to the VPN provider. This principle is exactly what the EFF's guide to choosing a VPN explains.
The phrase "a VPN app has access to all of the device's network traffic" requires clarification. With a full tunnel, the bulk of traffic is routed through the VPN, but the exact routing depends on the configuration. With split tunnelling, some connections go directly. Moreover, traffic passing through the server does not mean the provider reads all of its content.
HTTPS separately encrypts the exchange between the app or browser and the website. An ordinary VPN does not reveal a password, message text or the full page address inside HTTPS. However, the VPN operator can observe metadata: connection times, volume of data transferred, destination addresses and, often, domain names.
What data a VPN receives
For connections inside the tunnel, the local network sees a connection to the VPN, while the website usually receives the VPN server's IP address.
HTTPS separately encrypts the exchange between the app or browser and the website.
| Who observes | What is visible for traffic in the tunnel | Where the boundary lies |
|---|---|---|
| Wi-Fi operator | VPN connection, timing and volume of transfers | Destination websites are usually hidden by the tunnel |
| VPN provider | Metadata and any available destination information | HTTPS protects the content of the exchange |
| Website visited | The VPN server's IP, on-site activity | Logging into an account still identifies the user |
A VPN also does not prevent tracking via cookies, browser fingerprinting or access to location data. It is no substitute for protection against malicious apps.
What iOS verifies and what the App Store does not promise
Apple supports VPN apps and configurations, including through the system-level NetworkExtension mechanism. When an app asks to add a VPN configuration, it is requesting a network connection setting. This is an expected action, but it does not confirm the provider's good faith.
Enlarge image
Being listed in the App Store does not guarantee that the provider keeps no connection logs and does not sell data. Nor does the permission granted on iOS determine what happens to metadata on the VPN server. On Android the same question of trust in the operator remains, although the setup process and permissions differ.
A VPN configuration is not the same as trusting a root certificate or installing a device management profile: these are separate actions with separate consequences. Manually installing a profile with a certificate does not by itself make it trusted for web traffic. If an app requests certificate trust or device management in addition to the VPN, ask for an explanation of why. In a workplace setting, device management may include profiles and commands that go beyond a VPN connection; their purpose should be checked with the IT department.
How to assess a provider before connecting
Start with the privacy policy: who operates the connection, what data is collected, why and for how long. A "no logs" claim may refer to browsing history while retaining account or payment data. Jurisdiction helps you understand the legal context, but in itself does not rule out data disclosure requests.
| Claim or feature | What to check |
|---|---|
| No logs | Which records are excluded, what is stored and when it is deleted |
| Independent audit | The date, the version audited, server coverage and published findings |
| Kill switch | How it works specifically on iOS when the tunnel drops |
An audit describes a specific period and scope of review. Its findings cannot automatically be applied to future versions. Likewise, a promise to block traffic when the VPN drops should be compared with the documentation of the specific app.
How to assess a provider before connecting
On iPhone it is important to distinguish between the VPN operator and the app you use to connect. To connect via a compatible client, I recommend CitadelVPN: the service provides a subscription link and separate VLESS links in your dashboard. The connection guide lists, among others, Streisand, V2Box and Shadowrocket. Choose a suitable client for iPhone, verify its developer, then add the subscription link from the dashboard, refresh the list and select the connection. Button names vary between apps. This way you can separately verify who you are trusting with your network traffic and which app receives permission for the VPN configuration; setup questions can be directed to the service's support team.
What to check on your own iPhone
For example, an employee connects to hotel Wi-Fi and opens work email. The VPN hides connection destinations from the local network, while HTTPS protects the content of the email. If the employee enters a password on a fake page, having the VPN switched on will not prevent the theft. Checking the page address therefore remains essential.
Additional questions
Does iCloud Private Relay replace a VPN?
No. iCloud Private Relay is part of iCloud+ and protects browsing in Safari through two relays. It is not a universal VPN for the whole device; availability depends on country and network.
Does a new IP address prove there are no leaks?
No. It confirms a change of address only for the connection tested. It does not show what every other app on the device does with the tunnel.
How to begin using a VPN safely
Choose a VPN for iPhone based on clear data processing rules, justified permissions and documented behaviour when the connection drops. Before the first connection, verify the provider and the configuration, and keep iOS up to date. Checking website addresses and using a second factor remain necessary regardless of the VPN.