Colitu VPN
Security

Is Colitu VPN safe? Who runs it, what it stores and how to check

The company behind Colitu, what the VPN servers record and what they do not, the open-source apps and the limits we publish ourselves.

Written by: COLITU LIMITEDPublished: 3 min read

A VPN asks for a lot of trust: all of your traffic goes through it. This page answers the questions people ask before they install Colitu, with links to where each answer can be checked.

Who runs Colitu?

Colitu is run by COLITU LIMITED, a private company registered in England and Wales (company no. 17520342), 128 City Road, London EC1V 2NX. The company can be looked up in the Companies House register. Contact: support@colitu.com, security reports to security@colitu.com.

Does Colitu keep logs?

The VPN servers do not record:

  • the content of your traffic,
  • the sites and IP addresses you visit,
  • your DNS queries,
  • your own IP address (it is used in memory for the connection only).

What is stored: the amount of traffic per account, in windows of about 15 seconds, kept for 90 days for quotas and fair use and then reduced to totals per billing period. It shows when an account was active and how much it used, not where it went. Account data (e-mail address, devices, payments) is listed with its retention period in the security whitepaper and the privacy policy.

Are the Colitu apps open source?

Yes. The Android, iOS, Windows and Linux apps and the browser extension are published at github.com/colitu under GPL-3.0, so anyone can read what they do on the device. The apps contain no third-party analytics. Updates on Android, Windows and Linux are checked against a signed manifest before they are installed. The server software is not open source.

Which protocols and encryption does Colitu use?

Colitu uses established open-source implementations (Xray-core, sing-box, Hysteria) of Hysteria2, VLESS Reality, VLESS XHTTP, Trojan and Shadowsocks 2022. All of them encrypt the tunnel with TLS 1.3 or a modern AEAD cipher. The protocols page explains each one and when the app uses it.

Does Colitu protect against DNS and IP leaks?

On Android and iOS, and on Windows and Linux in TUN mode, DNS goes through the tunnel and IPv6 is blocked so it cannot leak around it. In system proxy mode, apps that ignore the proxy are not covered; the whitepaper lists these cases. You can test your own connection with the DNS leak test.

What are Colitu's known limits?

We publish them instead of hiding them. The Windows installer is not yet Authenticode-signed. The server software is closed source. Some records (payments, audit log) have no automatic deletion yet. The complete list, with what is planned, is in the security whitepaper and on the trust page.

Is Colitu free?

There is a free plan with a monthly traffic allowance and no card, and paid plans for more devices and traffic. See pricing and free VPN without logs for what to look for in any free VPN.

How do I report a security problem?

Write to security@colitu.com or read the responsible disclosure policy. Reports are answered in English, Turkish and Russian.