Why we did this
Almost every VPN tells you it is secure and keeps no logs. Almost none of them show you anything that lets you check. We think that is backwards. In August 2026 our engineering team ran an internal security review of the AkcaVPN backend, the system that handles wallet authentication, VPN configuration, sessions, and payments, and we are publishing a summary of the results. Two of our security engineers worked through it alongside AI assistance from Claude (Fable 5).
We want to be honest about what this is. It was a review by our own team, not a paid third party audit, and it is a snapshot in time rather than a permanent guarantee. What it does is hold our own work to a real standard and put the outcome in public.
What we tested
We read the backend source in full and tested the live API carefully, without disrupting production or touching real user data. The review covered how we authenticate you, whether one account can reach another account's data, how tunnel keys and configs are delivered, and, most importantly for a privacy product, what the database actually stores for a session.
What held up
The parts that protect your privacy behaved correctly. Attempts to forge an authentication token were rejected. One account could not read or end another account's session. Cross origin access was locked to our own apps. Database queries were safe from injection in the paths we reviewed. And errors did not leak internal details.
For new sessions, your real IP address is replaced with a placeholder and not stored, the tunnel private key is stored as null, and the sites you visit and your DNS queries are never handled by the API at all. We verified this at the database and code level, not just in a policy document.
What we found, and fixed
No review worth reading comes back empty. We disclosed seven application level findings, most of them defense in depth rather than open doors, and none of them exposed your traffic or the contents of your tunnel. Five were fixed in the code during the review, including adding rate limiting to login, tightening how VPN configs are cached, and adding a transport security header. The remaining items are hardening work on our list, and one payment related check sits behind a flow that is currently paused.
Beyond the application, the review also produced operational tasks we are working through as normal security hygiene. Where a detail could help an attacker before we finish an action, we handle it privately rather than publish it.
Read the full summary
We keep a permanent, plain language write up on our Security Review page, including the list of findings and their status, the no-logs verification, and how to report a security issue to us. It sits alongside our No-Logs Policy and Warrant Canary as part of how we try to earn trust instead of just asking for it.
Found a security issue in AkcaVPN? Email contact@akca.network. We do not take legal action against good faith security research.