Windscribe

Is Windscribe safe?

Yes. Windscribe, run by Windscribe Limited in Toronto, keeps less about you than most commercial VPNs: you can sign up with just a username and password, Apple's privacy label says the app collects nothing, and its apps are open source. Its no-logs claim has also been tested outside an audit room. When Greek prosecutors charged its co-founder over a hacking attack routed through one of its servers, the case ended in April 2025 without any user being identified. We score it 86/100.

That puts it behind Mullvad (91) and Proton VPN (88), and ahead of Private Internet Access (83). The points it loses come from security, not data collection: a 2021 server seizure in Ukraine exposed a private key that should not have been on disk, and its desktop apps have had a steady run of local privilege-escalation bugs.

What did the Greek court case show?

In June 2023 Yegor Sak received a letter from Canada's Department of Justice, sent under a mutual legal assistance treaty, saying he was charged in Greece with "illegal access to an information system". An IP address belonging to a Windscribe server in Finland had been used to break into a Greek server. Greek authorities, with Interpol's help, had asked the hosting company in Finland who paid for that server, got Sak's name from the corporate billing account and charged him as if he had done it himself.

Windscribe hired Greek lawyers and spent, in Sak's words, five figures on the defence. Hearings set for December 2023 and March 2024 were postponed, partly because a co-defendant in Morocco had not been processed. On 11 April 2025 an Athens court dismissed the case. The only account of the evidence is Windscribe's own, but the outcome fits its policy: had it kept connection logs, handing them over would have been the quick way out.

Windscribe also says Dutch authorities took one of its servers from a data centre rack in February 2026 without asking first, and found a RAM-only Ubuntu install with no logs. We could not find an official record of that seizure.

What went wrong in Ukraine in 2021?

This is the weak point, and Windscribe disclosed it itself. In July 2021 two of its servers in Ukraine went offline. The hosting provider said they had been seized in an investigation into activity from a year earlier, after a court hearing the provider never told Windscribe about.

The servers ran an older setup without disk encryption, and each held an OpenVPN server certificate and its private key. Windscribe said no user data was at risk because it kept no traffic logs. In theory, though, someone with that key and control of a user's network could have impersonated a Windscribe OpenVPN server for people using manual configurations and unencrypted DNS. Windscribe replaced its whole certificate authority by 20 July 2021, stopped writing keys to disk and moved its fleet to servers that run only in memory, a project it called FreshScribe.

How much data does Windscribe keep?

Very little, and the policy is unusually specific. To sign up you choose a username and password; email is optional and only used for password resets and updates. For each account Windscribe keeps a 30-day bandwidth total, the date (not the time) you last connected and which app versions you have activated. Payment transaction IDs are kept for 30 days for fraud checks, and the payments themselves run through outside processors.

While you are connected, the server holds your username, connection time and data used in memory, and drops them on disconnect. A central counter limits how many devices you run at once. Windscribe's website uses self-hosted Piwik analytics with the last part of your IP address cut off, and no outside trackers.

The store labels agree. Apple shows "Data Not Collected". Google Play lists an optional email and a device ID used for developer messages, with nothing shared with third parties.

How secure are the apps?

The desktop, Android and iOS apps are open source on GitHub. Leviathan Security Group audited the desktop app in 2021 and the mobile apps in 2022, and Packetlabs reviewed about 80,000 lines of the FreshScribe server code with penetration tests in June 2024. Windscribe pays for bug reports, between US$100 and US$5,000 so far by its own account.

The US vulnerability database lists seven flaws, all in the desktop clients and all needing local access: privilege-escalation bugs in Windows and Mac versions from 2018 to 2024, and a command-injection bug in the Linux app published in December 2025. None was a remote attack on Windscribe's servers, and we found no breach of customer data.

How to use Windscribe safely

1. Use the apps rather than manual OpenVPN files; the apps connect by IP address and fetch fresh certificates on their own.
2. Keep the desktop app updated, since every listed flaw was in an old desktop build.
3. Add an email only if you want password recovery or the larger free allowance, and use an address you do not use elsewhere.
4. On a shared family computer, remember that any VPN can bypass the router's parental filter.

How we scored it

Privacy (91) and regulatory record (90) are the strongest factors: almost no stored data, a court case that ended without any logs, and no fines in about ten years. Security (82) is lowered by the 2021 key exposure in Ukraine and repeated desktop-app flaws, despite open-source code and RAM-only servers. Scams and harmful content (82) reflects only that a free, email-less VPN is easy for a child to use to get around filters.