Secure VPN

Is Secure VPN safe?

It will encrypt your connection on public Wi-Fi, but it asks for a lot of trust and gives little back. Secure VPN has more than 100 million downloads on Google Play and 2.4 million ratings there, yet the company behind it publishes no owner, no staff and no address beyond a Delaware suite. The free app is paid for by ads, Apple's label shows data used to track you, and the no-logs promise has never been checked by an outside firm. We score it 51/100.

That puts it just above VPN Potato (49) and below X-VPN (53) and VPN Super (57). The gap to Turbo VPN (42) comes from security: researchers found a shared hard-coded password in Turbo VPN and reported nothing like it for Secure VPN.

Who makes Secure VPN?

Two names appear, depending on where you download it. On Google Play, where almost all of its users are, the publisher is Secure Signal Inc., with an address at 8 The Green in Dover, Delaware, a Delaware phone number and a privacy policy on securesignal.app. On the App Store the iPhone version comes from Signal Software Ltd, links to signallab.org, and uses a different privacy policy that names Signal Lab Software Limited, "registered in HongKong", as the data controller.

The same publisher makes Thunder VPN, which has another 100 million+ Play downloads. Signal Lab's website promotes Thunder VPN, and both apps share the Secure Signal developer account on Play and the Signal Software account on the App Store.

None of these sites names an owner, a director or a staff member. The Hidden Links researchers, who searched company registers for each VPN they studied, found no records that tied Secure Signal to anyone else. That is not proof of anything hidden. It does mean you cannot tell who holds your data.

Is Secure VPN linked to China?

The research does not show a link, and the question keeps coming up for a reason. "Hidden Links", a study presented at the FOCI 2025 workshop by researchers from Arizona State University and Citizen Lab, examined 21 popular Android VPNs with about 972 million combined downloads. It traced most of them to three secret families, one of them the Turbo VPN group that the Tech Transparency Project (TTP) linked to China's Qihoo 360. Secure VPN was one of three apps placed in an "Other" group with no links to the rest.

TTP's April 2025 report listed a "Thunder VPN", ranked 60th among free US App Store VPNs in 2024, as one of the apps developed by the Qihoo-linked companies. In June 2025 TTP said Apple pulled Thunder VPN after the Financial Times asked about it. TTP did not name Secure Signal or Signal Lab, and its list of Qihoo-linked apps on Google Play did not include Thunder VPN, so we could not confirm that it checked this publisher's app. In October 2026 Apple's US store listed neither Signal Lab's Thunder VPN nor Secure VPN, while other countries' stores did.

The name is also shared. Reports in 2018 and 2020 described other apps called "Secure VPN" from Hong Kong developers, including one in a 2020 leak of user logs. We found nothing that ties them to this app.

What does the free app collect and share?

The parts do not fit. Google Play says Secure VPN "contains ads", and its own ads file names Google and Meta, yet the privacy policy names neither and the data safety section lists no data shared for advertising. The App Store version's policy says Signal Lab does "not collect anything for tracking purposes", while Apple's label for the same app says usage data is used to track you. We scored privacy on the broader disclosures.

How secure is the connection?

There is not much to go on. Hidden Links found that the app's core VPN code sits in an obfuscated native library and reported no hard-coded keys and no flaw of its own for it. Neither the Play listing nor the policy says which VPN protocol the app uses, so you cannot judge the encryption yourself.

There is no published penetration test or no-logs audit, no independent security review badge on Google Play and no bug bounty. We found no breach report and no published vulnerability for the app.

How to use Secure VPN more safely

1. Use it for public Wi-Fi or to reach a blocked site, not for anything where you need to trust who runs the servers.
2. Turn off or reset your phone's advertising ID. The policy says the app collects it, and the ad networks use it.
3. Check the publisher before installing: on Google Play it should say Secure Signal Inc. Other apps use the same name.
4. Assume your data stays. Google Play's own label says the developer offers no way to delete it.
5. Do not let children install it. The terms require users to be 18, though Google Play rates it Everyone.

If you want a free VPN from a company that names itself and has been audited, Proton VPN has a free plan without ads and several public no-logs audits.

How we scored it

Privacy (40) and Transparency and control (40) are the weakest factors: tracking on Apple's label, ad partners left out of the policy, two policies from two differently named companies, and no way to delete data. Security (50) gains because researchers found no shared keys, but loses for an undisclosed protocol and no audit. Regulatory record (85) is the highest factor, because no regulator has acted against the app, but none has examined it either.