← Guides

India's VPNA virtual private network encrypts traffic between your device and a provider-run server, hiding activity from local networks while shifting trust to the VPN operator.Glossary → Crisis: What the CERT-In Logging Mandate Means and Which VPNs Still Work

In April 2022, India's Computer Emergency Response Team, CERT-In, forced major VPN providers to choose: log users or leave. The serious privacy providers left. The rest either complied or hid the tradeoff behind softer language.

Here is what CERT-In requires, what providers actually did, and what still makes sense for Indian users in 2026.

What CERT-In Actually Requires

The CERT-In directive, issued April 28, 2022 and effective June 28, 2022, applies to VPN providers, cloud providers, VPS providers, and data centers that run physical infrastructure inside India. It requires them to:

• Collect and verify the real name of each subscriber
• Collect and validate email address and phone number
• Log IP addresses assigned to users, including source and destination IPs
• Record usage patterns and session timestamps
• Retain all of the above for five years
• Provide this data to CERT-In or law enforcement within six hours of a request

That six-hour window matters. This is not a court process. It is an administrative demand. CERT-In does not need a judge to sign off before it asks for data. The Information Technology Act gives it broad power over companies that run tech infrastructure in India.

Which Providers Complied vs Refused

Mullvad was blunt: "We will not collect the data required by CERT-In." It removed all Indian servers in May 2022, before the rule took effect. IVPN followed. Other providers also pulled servers, though some were less clear in public.

What "Virtual India Server" Actually Means

When a VPN says it still offers an "India server" after pulling hardware out of India, it usually means a server in Singapore, the Netherlands, or another country that hands out Indian IP addresses and routes traffic so it appears Indian.

Because the hardware is not in India, CERT-In has no jurisdiction over that server. Indian law reaches infrastructure inside Indian borders. A server in the Netherlands with an Indian exit IP falls under Dutch law, not Indian law.

This is a normal technical setup, not a magic shield. It works for streaming and region-specific services. The cost is speed. Latency will usually be 80-150ms higher than a domestic connection, which matters for real-time use.

The Broader Surveillance Context

CERT-In is only one piece of India's surveillance stack. It drew attention because it hit foreign privacy tools directly, but it sits inside a much bigger system:

• Centralised Monitoring System (CMS): Operational since roughly 2013-2016, CMS intercepts phone calls and internet activity without needing telecom operators involved in each request. Agencies can tap traffic directly.
• NATGRID: The National Intelligence Grid links 21 intelligence and law enforcement agencies and handles more than 45,000 data requests each month. It pulls together railway bookings, airline records, immigration data, banking data, and telecom records into one searchable system.
• IT Act Section 69: Allows interception of online communication without a court order. The approving authority is an executive official, not a judge.
• IT Act Section 69A: Lets the government block websites without judicial oversight and without public notice. It is the legal path behind the 848 shutdowns documented between 2012 and 2024.

A VPN shields your traffic from your ISP and from CERT-In-style logging at the provider layer. It does not stop CMS interception if your connection is already identified, and it does not stop NATGRID queries against other records tied to you, such as banking or travel data.

India's Shutdown Record - Why VPNs Are Survival Infrastructure

India has imposed more internet shutdowns than any other country on record. The Internet Shutdown Tracker counted 848 shutdowns between 2012 and 2024. Some hit one district during protests. Others cut whole states off for days or weeks.

During a partial shutdown, where officials block specific sites or services with DNS tampering or IP blocks, a VPN routed through another country can bypass the block. VPN use spiked more than 700% in India during a major shutdown in June 2025, according to network monitoring firms.

During a full blackout, where ISPs cut connectivity at the backbone level, no VPN can help because there is no link to tunnel through. In that case, offline mesh tools like Meshtastic still allow device-to-device communication. That is a different setup and it has to be ready before the shutdown starts.

The Crypto Surveillance Connection

The same state that wrote CERT-In built an aggressive surveillance regime for crypto users too:

• 30% flat tax + 1% TDS: India's 2022 crypto tax rules imposed a 30% flat tax on gains, no loss offsetting, and a 1% tax deducted at source on each transaction. Domestic exchange volume then collapsed 91.5% between October 2024 and October 2025 as traders moved offshore.
• IT department probes: India's Income Tax department opened investigations into more than 400 high-value Binance users identified through data-sharing channels and used offshore exchange activity to build domestic tax cases.
• January 2026 biometric KYC: Indian exchanges now require a live selfie with deepfake checks, a PAN card, secondary ID, and geo-tagging with latitude, longitude, timestamp, and IP address. Few jurisdictions demand more.

For Indian crypto users who want less surveillance, the practical path is peer-to-peer access through Haveno, self-custody, and privacy coins like Monero when financial privacy matters. See our guide: How to Buy Monero Without KYC.

Why Mullvad's Server Removal Matters

The most important signal from the CERT-In episode was not technical. It was behavioral. Mullvad and IVPN both removed Indian infrastructure instead of logging users. That tells you how those companies act when a government applies direct pressure.

A provider that complied in order to keep Indian market share made a different choice: revenue over user privacy. Even if the policy details differ, the decision shows what wins when the state demands logs.

A no-logs policy only means something if it survives pressure. Mullvad left. IVPN left. That is the test that matters.

Practical Recommendations for Indian Users

Cunicula is editorially independent and receives no government or financial industry funding. CERT-In mandate details sourced from official gazette notifications. Shutdown statistics from the Internet Shutdown Tracker. Mullvad server removal sourced from Mullvad's official blog.