Airalo

Is Airalo safe?

Yes, Airalo is among the safer travel apps we have looked at. We found no data breach and no fine. Airalo publishes a trust centre with current ISO 27001, SOC 2 and PCI DSS certifications, and you can delete your account inside the app. The points to weigh are smaller: an advertising identifier used to track you, passport checks for some countries' plans, and the fact that your mobile data is carried by networks you do not pick. We score it 70/100.

What Airalo knows about you

Buying an eSIM needs little: an email address, a name and a payment card. Apple's privacy label reflects that. Name, email, payment info, a user ID, how you use the app and crash data are linked to you. Device ID and advertising data are listed as used to track you across other companies' apps and websites, so Airalo's own ads can follow you.

The privacy policy, last updated in March 2026, goes further than the label in one important case. Where a country requires identity checks for SIM cards, Airalo may process biometrics, date of birth, identity cards or other ID numbers. It may also receive data from "information brokers" to run those checks. Its California notice lists biometric information, geolocation, government ID, account logins and payment information as sensitive data it collects. The policy also says location can be derived from your mobile device, in addition to your IP address.

Data is shared with Airalo group companies, network and payment providers, hosting firms and distribution partners if you bought through one. Airalo says data is stored in data centres around the world, and that it uses EU standard contractual clauses for transfers out of Europe. Its trust centre lists Amazon Web Services in Ireland as the main host.

Passport checks for some eSIMs

For most destinations you just buy and install. For some, the app replaces "Buy" with "Verify your identity". You then upload a document such as a passport, sometimes with an address, and wait for approval. The check is done by a third-party provider, which Airalo says varies with the eSIM's country.

That is a legal requirement in those countries, not an Airalo choice. Still, it means a passport scan, and possibly biometric data, goes to a company you did not pick, and Airalo keeps records of the check after you delete your account where the law requires it.

Security and the network behind the eSIM

Airalo's trust centre lists ISO 27001:2022, SOC 2 Type II and PCI DSS 4.0.1 compliance, with 2026 penetration test reports available on request. Card data handling falls under the PCI audit. When you log in from a new device or browser, Airalo emails a verification code and adds the device to a list of trusted devices that you can review and prune. That is not full two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, and we found no public bug bounty on HackerOne or Bugcrowd.

The bigger privacy question applies to every travel eSIM. Airalo resells capacity from partner operators, and your data often leaves the internet far from where you are standing. In a 2025 study, Northeastern University researchers tested 25 travel eSIMs and found that in almost all cases the phone's public IP address did not match its location. The Airalo eSIM they bought used an address belonging to Webbing USA in Texas. For normal browsing over HTTPS that changes little. It matters more for banking apps that flag foreign logins, or for anyone who does not want a third country's network in the path.

How to use Airalo more safely

1. Install the eSIM before you travel, on Wi-Fi, and keep the QR code or install link private.
2. Turn off "Allow Apps to Request to Track" in iPhone settings to limit ad tracking.
3. Use a strong, unique password and protect the email account linked to Airalo, since login codes go there.
4. Check Profile, then Trusted Devices, after travelling and remove any device you no longer use.
5. Before a plan that needs ID, decide whether you are comfortable sending a passport scan to an outside verifier.
6. Use a VPN such as NordVPN if you need your traffic to exit in a particular country.

How we scored it

Regulatory record (86) is the strongest factor, with no fine or order found. Scams and harmful content (80) is high because there is no messaging or user content to abuse. Privacy (58) is the weakest: an ad identifier is used to track you, and the policy covers ID documents and biometrics for plans that need identity checks. Security (72) rests on audited certifications and no known breach, held back by the lack of a public bug bounty and of full two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login. Skyscanner scores 63.