Is a VPN safe? What the VPN sees, what your ISP still sees, and how Surok handles privacy

"Is a VPN safe?" is a question people usually ask after they've already installed one. It's the right question: when you switch on a VPN, you hand your traffic to someone other than your ISP. Here's an honest look at who sees what with and without a VPN, which services are genuinely dangerous, and how privacy works at Surok.

Quick fix. Surok doesn't record which sites you open, the contents of your traffic or your DNS queries, and stores only the data a subscription can't work without. You can check that your VPN isn't leaking your address on the IP check page. Three days free, then from 220 ₽ a month.

What your ISP sees without a VPN

Your home ISP or mobile carrier sees almost everything that crosses its network. Page contents are protected by HTTPS, but the site address is visible: in the DNS query and in the server name when the secure connection is set up. That's exactly what blocking and throttling rely on. We covered what the ISP keeps in can my ISP see which sites I visit.

With a VPN the picture changes: the ISP sees one encrypted connection to the VPN server and the amount of traffic. Where you go from there, it doesn't know.

What the VPN service sees

Here's the part marketing likes to skip: a VPN doesn't make you invisible, it moves trust from your ISP to the VPN service. Technically the VPN server can see what the ISP used to see: site addresses and traffic volume. Page contents stay protected by HTTPS, but the fact that you visited a site is available to the service.

So the key VPN safety question isn't "does it encrypt" but "what does it record and who could it hand that to".

Which VPNs are genuinely dangerous

• Free apps from app stores. Servers cost money. If you're not paying, the money comes from somewhere else: selling browsing data, showing ads, sometimes using your phone as an exit node for other people's traffic. More in Free VPN: which free VPNs are safe.
• Fake apps. Clones of popular services with a similar icon that ask for extra permissions: contacts, SMS, accessibility. How to tell them apart in how to choose a VPN and not get scammed.
• "Anonymous" bots with no website and no rules. A config file from a stranger on Telegram is literally handing all your traffic to a stranger. No rules, no accountability, no support.
• Leaky services. A VPN that is "on" but lets DNS queries slip past the tunnel gives a false sense of protection. The check takes two minutes: how to tell if your VPN leaks IP or DNS.

How privacy works at Surok

It's all in our privacy policy; here's the plain-language version.

What we don't do. We don't record which sites you visit, the contents of your traffic or your DNS queries. There is no browsing log, so there's nothing to hand over.

What we store. Only what a subscription can't work without:

• account data: email or Telegram ID, password hash, sign-up date;
• device data: the app's technical identifier, OS type and version, device model, IP address and the time of the last subscription refresh — that's how the per-plan device limit works;
• technical counters: total traffic volume for the period and last activity time, to show you stats and protect the servers from abuse.

Where there's no analytics. The Yandex Metrica counter runs only on the website and counts page views. It's not in the apps, the browser extensions or the VPN traffic itself. The browser extension doesn't read page contents or collect history.

Payment without extra traces. You can pay by card, SBP, YooMoney wallet, Telegram Stars or crypto; outside Russia, via Stripe from $2.99 a month. Auto-renewal only draws from your account balance and can be switched off. Details in how to pay for Surok.

Connection security, not just promises

Privacy rests on technology, not words. Surok uses the VLESS protocol with Reality camouflage and the XHTTP transport: the traffic looks like an ordinary HTTPS connection to an ordinary website, so it's hard not only to block but also to single out from the general flow. The plain-language explanation is in VLESS, Reality and XHTTP.

What that means in practice:

• modern encryption all the way from your phone to the exit server;
• DNS queries travel inside the tunnel, not to your ISP;
• the apps have split tunnelling: send only the apps you need through the VPN and leave your banking app direct.

Protection against dropped connections has its own article: kill switch — what it is and how Surok handles it.

What a VPN doesn't do, honestly

A VPN doesn't make you anonymous to the whole world. A site you're logged into knows who you are regardless of IP. Your browser hands sites a device fingerprint. Your messenger knows your phone number. A VPN solves specific problems: hiding traffic from your ISP, getting around blocks and throttling, staying safe on public Wi-Fi, changing your country for a service. The rest needs other tools and habits.

One more thing: using a VPN in Russia isn't illegal for users and there's no fine for it. What is actually regulated is covered in is VPN banned in Russia.

How to check any VPN in five minutes

1. Find the privacy policy. If there isn't one, or it's half a page of generalities, that's your answer.
2. See what the service stores and for how long. Storing an account and traffic counters is normal; storing browsing history is not.
3. Switch the VPN on and open the IP check page: the address should be foreign and DNS shouldn't leak.
4. Check the app's permissions. A VPN doesn't need your contacts, SMS or screen access.
5. Work out how the service makes money. If it's unclear, the money comes from you.

Frequently asked questions

Can the VPN see my passwords? No. Passwords travel inside HTTPS, which the VPN doesn't decrypt. The server may see the site address but not the page contents.

Is it safe to use my bank through a VPN? Technically yes, the connection is protected. But some banks block logins from foreign addresses. The easiest option is to route the bank outside the tunnel with split tunnelling in the Surok app.

Does Surok keep a record of the sites I opened? No. We don't record browsing history, traffic contents or DNS queries. We store the account, device identifiers and total traffic volume.

Why is a paid VPN safer than a free one? A paid one has an obvious business model — the subscription. A free one has to make money from data or ads, and that almost always comes at the user's expense.

Can I check that the VPN isn't leaking? Yes, in two minutes: the IP check page shows your address and exit server, and the leak article explains what to do if something's off.