TunnelBear Review Australia 2026
Sourced personal VPN — USD teaser, real free tier, McAfee parent, Cure53 PDFs through 2023
TunnelBear is for sale to Australians at printed USD prices, with unlimited devices, WireGuard/OpenVPN apps, an advertised AU country exit, and a genuine 2 GB free plan that no longer includes country selection. The honest 3-year price is US$120, not US$3.33/month cancellable; month-to-month is US$9.99. The operator is a Canadian LLC whose Teams page still names McAfee. Cure53 PDFs through 2023 were read; 2024 and 2025 annual audits are blogs without PDFs. Advertised Australian servers are not data residency. No independent speed, leak or streaming tests were run.
- Best for
- Australian personal-VPN buyers who can pay USD, want a simple free tier or unlimited-device apps, will accept a Canadian/McAfee ownership stack, and will open dated public Cure53 PDFs rather than a lab test.
- Not ideal for
- Anyone budgeting the US$3.33 teaser as a cancellable monthly price, buyers who need confirmed Australian data residency, AUD GST-inclusive checkout or a non-Five-Eyes jurisdiction, free-tier users who need country selection, Linux users who need a supported first-party app, or organisations that need private-resource access.
SoftwareHQ does not currently have an affiliate arrangement with TunnelBear. The review is independent of commercial relationships. Affiliate disclosure
Overview
TunnelBear is a personal VPN. Ownership, logging claims and advertised exit locations are recorded separately. An Australian exit IP is not proof of Australian data residency.
Feature highlights
These highlights come from vendor documentation and editorial analysis of public sources. They are not firsthand test results or a claim that every listed capability was exercised in a trial.
- A genuine 2 GB free plan, with paid-only country selection
Free card: 2 GB/month. December 2025 blog: country selection and SplitBear moved to Paid. Bandwidth Program 10 GB is not the ordinary Free plan.
- Unlimited devices on one account
Pricing FAQ and features: no device cap. Terms still prohibit reselling or giving the account to someone else.
- Advertised Australian country exit, not city-level
Australia is on the homepage country list. Help: city-level servers are US and Canada only. That is not Australian data residency.
- WireGuard, OpenVPN and IKEv2 on the main apps
Documented on Windows, macOS and iOS. Android omits IKEv2. Linux has no dedicated app — NetworkManager OpenVPN configs only.
- VigilantBear on listed desktop/mobile apps
Documented kill switch on Windows, macOS, iOS and Android. Not leak-tested. Not documented for the Linux OpenVPN path.
- Public Cure53 PDFs through 2023, later years announcement-only
TB-11 (2023) and TB-10 (2022) PDFs were downloaded and read. The 2024 and 2025 annual audits are vendor blogs without public PDFs.
Ownership and jurisdiction
Legal entity and jurisdiction are not the exit-server map.
- Legal entity
- TunnelBear LLC
- Jurisdiction
- Canada
- Parent company
- McAfee (acquired 2018; still printed on the Teams page on 12 Sep 2026)
- Five Eyes
- Yes
Terms last revised 5 Dec 2025 and privacy policy 11 May 2026 name TunnelBear LLC. Footer and About: Toronto, Canada. Privacy: information used according to Canada’s laws; personal data not stored outside Canada’s physical borders. Teams page: “We're a passionate Toronto-based team that was acquired by McAfee in 2018.” Cure53 TB-11 PDF was requested by McAfee ULC. Canada and the United States are Five Eyes members. Jurisdiction here is the legal entity and named parent, not the exit-server map. The hyphenated join-blog URL 404s; the working post is /blog/tunnelbear_joins_mcafee/.
- https://www.tunnelbear.com/terms-of-service · checked 2026-09-12
- https://www.tunnelbear.com/privacy-policy · checked 2026-09-12
- https://www.tunnelbear.com/teams · checked 2026-09-12
- https://www.tunnelbear.com/blog/tunnelbear_joins_mcafee/ · checked 2026-09-12
- https://cure53.de/pentest-report_tunnelbear_2023.pdf · checked 2026-09-12
Logging and retained data
A vendor no-logs claim is not proof of zero retained account or payment data.
- Logging policy
- Vendor no-logs claim
- Retained service data
- Documented retained service data
Privacy policy 11 May 2026 §1.6: does not collect, store or log website visitor IPs, IPs upon service connection, DNS queries while connected, or information about applications, services or websites used while connected. Help (updated 7 Jul 2025): does not keep logs of what you browse while connected. Features: does NOT log any activity of customers connected to the service.
- account email for marketing, receipts and product news
- optional Twitter ID for a promotion
- email-confirmed flag
- paid-user flag and paid-user expiry date
- OS version and TunnelBear app version
- active-this-month flag (1 or 0)
- total data used this month, reset to 0 at month end (no historical usage record)
- operational events: account created, Twitter bonus, payment, upgrade, ad referrals (not VPN-session times)
- geolocation at continent/country/city for performance, censorship analysis and signup abuse prevention
- crash reports and device brand/model
- payment: cardholder last name, date of card use, last four card digits; processors Stripe and PayPal hold billing address, expiry and IP at time of payment
- Google Analytics on the website with IP anonymization enabled; Cloudflare, Stripe, Bing Ads and (Teams) Hotjar/LinkedIn cookies as listed in §1.5
A no-logs claim is not proof of zero retained account or payment data. Transparency report 2023 (covers 2021–2023): 70 government authority requests; vendor says no browsing-session information was provided and some account existence confirmations occurred. That report has not been updated since 8 Nov 2023. Privacy: in a restructuring or acquisition, personal data may be migrated. Account data deleted 30 days after cancel or on privacy-centre request unless legally required to keep it.
Account/control-plane personal data is described as stored in Canada, not Australia. An Australian exit IP is not data residency. This is not a numeric privacy score.
- https://www.tunnelbear.com/privacy-policy · checked 2026-09-12
- https://help.tunnelbear.com/hc/en-us/articles/360006708652-Does-TunnelBear-keep-logs · checked 2026-09-12
- https://www.tunnelbear.com/blog/tunnelbear-transparency-report-for-2023/ · checked 2026-09-12
Locations and hosting
Advertised exit countries, physical-versus-virtual evidence, control-plane hosting and account data residency are separate. An Australian exit IP is not Australian data residency.
- Advertised exits
- AU
- Australian exit
- Advertised — not proof of Australian data residency
- Exit location evidence
- Advertised
- Physical vs virtual
- Physical
- Control-plane hosting
- Overseas
- Account data residency
- Unknown
- Legacy data_hosting field
- Unknown
Homepage 12 Sep 2026 names 47 countries including Australia. Features says 46+ countries and more than 8000 servers physically located in the country you select. Help (updated 4 Sep 2026): more than 8000 servers in over 45 countries; city-level servers only in the United States (named cities) and Canada (Toronto, Vancouver), and those city servers require a Yearly or Monthly paid subscription. Australia is country-level on that list, not a named city. Those physical-location sentences are vendor documentation, not a traceroute. An Australian exit IP is not Australian data residency. data_hosting stays unknown rather than a green AU badge.
- https://www.tunnelbear.com/ · checked 2026-09-12
- https://www.tunnelbear.com/features · checked 2026-09-12
- https://help.tunnelbear.com/hc/en-us/articles/360007004351-Where-can-I-tunnel-to-and-from · checked 2026-09-12
Per-platform features
Protocol, kill switch and split tunnel are recorded per platform. Missing documentation stays unknown or not tested.
| Platform | Protocols | Kill switch | Split tunnel |
|---|---|---|---|
| Windows | WireGuard, OpenVPN, IKEv2 | Yes | Yes |
| macOS | WireGuard, OpenVPN, IKEv2 | Yes | Yes |
| iOS | WireGuard, OpenVPN, IKEv2 | Yes | Yes |
| Android | WireGuard, OpenVPN | Yes | Yes |
| Linux | OpenVPN | No | No |
Windows: Protocol help (updated 11 Sep 2026): Auto, WireGuard, OpenVPN and IKEv2. VigilantBear documented. SplitBear: websites and applications. GhostBear documented on Windows. Download curl copy: Windows 10 and later. Not leak-tested.
macOS: Same four protocol options as Windows. VigilantBear documented. SplitBear: websites only — application split tunneling currently unavailable. GhostBear help: available on macOS (v4), not currently available for macOS (v5). AU Chrome download page on 12 Sep 2026 was macOS 11.0+ 64-bit. Not leak-tested.
iOS: Same protocol set. VigilantBear documented. SplitBear: websites only — application split tunneling currently unavailable. GhostBear is not currently available for iOS. App Store refunds follow Apple. Not leak-tested.
Android: Protocol table: WireGuard and OpenVPN; IKEv2 is N/A on Android. VigilantBear documented. SplitBear: applications only — website split tunneling currently unavailable. GhostBear documented on Android. Play Store refunds follow Google. Not leak-tested.
Linux: No dedicated Linux application (blog 28 Dec 2024, last tested Ubuntu 20.04). Official path is NetworkManager OpenVPN config files; limited support. Browser extension is the fully supported Linux option and encrypts browser traffic only. VigilantBear and SplitBear articles do not list Linux. Not leak-tested.
Device limits and free tier
- Devices
- Unlimited
- Concurrent connections
- Unlimited
- Free tier
- Available
- Free-tier data cap
- 2 GB/month
2 GB of secure browsing per month on the Free card. Blog 3 Dec 2025: SplitBear, country selection and upcoming customisation became Paid-only; Free users keep VigilantBear and GhostBear. Bandwidth Program users in select censored countries keep all features and 10 GB/month — that programme is not the ordinary Free plan. City-level servers require Yearly or Monthly paid. Download notice: country picker is an Unlimited-plan feature. 30-day annual money-back is a paid-purchase refund window, not the free tier.
Audit register
Cure53
White-box penetration test and source-code audit TB-11, Q4 2023 (CW42–CW45 October and early November 2023), 43 working days, seven senior auditors. Requested by McAfee ULC in May 2023. Work packages: client apps; VPN infrastructure; PolarBear backend; frontend and public sites; AWS infrastructure; Overseer; Geneva; browser add-ons. A ninth work package was removed from scope.
- Report date
- 2024-02-07
- Availability
- Full report published
- Inspection
- Independently inspected
PDF downloaded from cure53.de on 12 Sep 2026 and read (20 pages). 13 findings: 5 vulnerabilities (including 2 High: HTTP-proxy access to a VPN client listing service; unauthenticated Polar token generation) and 8 miscellaneous. Vendor 7th-annual blog (14 Feb 2024) says 12 of 13 were fixed or mitigated and links this PDF. TB-11-005 was unmitigated issues from previous audits. Point-in-time, not operating-effectiveness evidence after Nov 2023, and not a numeric security score. A no-logs claim is not proved by this app/infra pentest.
Cure53
White-box pentest, configuration review and source-code audit TB-10, October–November 2022 (CW41–CW45), 42 days, eight researchers. Requested by McAfee ULC in May 2022. Scope included client apps, VPN infrastructure, PolarBear backend, frontend, AWS, Overseer, Geneva, FilterPods and Boringtun.
- Report date
- 2023-05-18
- Availability
- Full report published
- Inspection
- Independently inspected
PDF downloaded and read on 12 Sep 2026 (39 pages). 32 issues including Critical subdomain takeover on blog.tunnelbear.com and Critical Ansible vault secret disclosure, plus High cloud-account findings. Vendor 6th-annual blog (19 May 2023) said 27 of 32 were resolved with five remaining. TB-11 later recorded some prior issues still open. Point-in-time 2022, not a current no-logs proof.
Cure53
Vendor 8th-annual blog 24 Nov 2025: 2024 white-box assessment, 44 working days in October and November, eight senior auditors. Named scope: applications; backend systems and server configurations; public-facing APIs and network entry points; data handling and encryption layers. Vendor summary: 10 vulnerabilities of medium or higher, 3 low, plus 10 minor improvements; vendor says acknowledged, addressed or mitigated.
- Report date
- Unknown
- Availability
- Announcement only
- Inspection
- Not independently inspected
The blog does not link a PDF. Guessed https://cure53.de/pentest-report_tunnelbear_2024.pdf returned 404 on 12 Sep 2026. A vendor blog is not an inspected independent report.
Cure53
Same 24 Nov 2025 blog: vendor says the 2025 (9th consecutive) audit was already completed and the team was reviewing and addressing findings. No results PDF and no dedicated results post were found on 12 Sep 2026.
- Report date
- Unknown
- Availability
- Announcement only
- Inspection
- Not independently inspected
Announcement only. Guessed https://cure53.de/pentest-report_tunnelbear_2025.pdf returned 404. A completed-but-unpublished audit is not an inspected report.
When this was checked
Status as of (page snapshot) against a 90-day review target. Checked dates are not updated when the site is rebuilt.
Editorial article date: . That is not proof that pricing, hosting, or compliance was re-checked.
- PricingVerified
Verified — checked 12 September 2026.
AU Chrome session. Marketing USD from $3.33/mo. Live API monthly US$9.99; yearly recurring US$69.99; 3-year US$120. GST unknown. Checkout not started.
- HostingUnknown
Unknown — checked date 12 September 2026 is not field-level evidence on its own.
Advertised AU country exit. Personal data described as stored in Canada. Unknown is not AU.
Subscription pricing
Prices below are in USD, not AUD. GST unknown. An effective monthly equivalent is not a cancellable monthly price. Verified — checked 12 September 2026. Source: tunnelbear.com/pricing.
AU headed Chrome 12 Sep 2026 on /pricing did not print this billed total on the marketing card (card says from $3.33/mo). Live getPricingDetails MONTHLY_PAYMENT chargePrice/regularPrice US$9.99. JS product catalogue: title 1 Month, renews true, cycleMonths 1. This is the cancellable month-to-month Unlimited option. GST not printed. Get started / /account/checkout was not opened. McAfee-channel monthly SKUs at US$7.99 were not used.
- Introductory billed total
- 9.99 USD
- Term
- 1 month
- Bonus months
- None
- Effective monthly equivalent
- 9.99 USD effective monthly equivalent — not a cancellable monthly price
- Renewal
- 9.99 USD / 1 month
- Month-to-month option
- 9.99 USD
Checked 2026-09-12
Live API YEARLY_PAYMENT_RECURRING US$69.99 / 12 months (renews true). Hand check 6999/12=583. That equivalent is not the cancellable monthly price (US$9.99). The same API also listed YEARLY_PAYMENT US$49.99, which is not in the JS products catalogue — dual yearly amounts in the API, not stored as this SKU. JS fallback still had 59.88 for this key; live API 69.99 is used. New Year sale 47.99 isLive false. GST unknown. Checkout not started. Terms 7.1: 30-day money-back on the first year of annual website purchases only.
- Introductory billed total
- 69.99 USD
- Term
- 12 months
- Bonus months
- None
- Effective monthly equivalent
- 5.83 USD effective monthly equivalent — not a cancellable monthly price
- Renewal
- 69.99 USD / 12 months
- Month-to-month option
- 9.99 USD
Checked 2026-09-12
Marketing card 12 Sep 2026: Unlimited from $3.33/mo. Default JS currentProduct THREE_YEAR_PAYMENT. Live API chargePrice/regularPrice US$120.00 for 36 months. Hand check 12000/36=333. The US$3.33 figure is not a cancellable monthly price. JS: renews false, endpointOverride /doOneTimePayment — prepaid, not an auto-renewing intro. Stored renewal cents are that same prepaid billed total, not a confirmed then-price after 36 months. TWO_YEAR_PAYMENT US$99.99 exists in the API and was not printed on the marketing cards. GST unknown. Get started was not clicked.
- Introductory billed total
- 120.00 USD
- Term
- 36 months
- Bonus months
- None
- Effective monthly equivalent
- 3.33 USD effective monthly equivalent — not a cancellable monthly price
- Renewal
- 120.00 USD / 36 months
- Month-to-month option
- 9.99 USD
Checked 2026-09-12
Compare TunnelBear subscription cash outlay
Observed price changes
Recorded when a listed price changed. This is not a complete vendor timeline.
- First AU-session capture from tunnelbear.com/pricing in headed Chrome (en-AU). Marketing: Free 2 GB; Unlimited from US$3.33/mo; Teams US$5.75/user per month; All pricing shown in USD. Live getPricingDetails: MONTHLY_PAYMENT 9.99; YEARLY_PAYMENT_RECURRING 69.99; THREE_YEAR_PAYMENT 120.00; TWO_YEAR_PAYMENT 99.99; YEARLY_PAYMENT 49.99 (not in products catalogue). New Year sale isLive false. GST not printed. Checkout not started.
Pros & Cons
Pros
- Public site loaded from Australia on 12 Sep 2026 and listed Australia as a named country
- Cancellable monthly is in the live pricing API at US$9.99 — separate from the US$3.33 yearly/3-year teaser
- Genuine free plan (2 GB/month) still advertised
- Unlimited devices on Free and paid, with an anti-resale rule in the terms
- WireGuard, OpenVPN and IKEv2 documented on Windows, macOS and iOS; WireGuard/OpenVPN on Android
- VigilantBear documented on those listed desktop/mobile apps
- SplitBear documented on Windows, macOS, iOS and Android (with per-platform website vs app limits)
- Cure53 TB-11 (2023) and TB-10 (2022) PDFs were downloaded and read
- Privacy policy is dated 11 May 2026 and lists what is and is not collected
Cons
- US$3.33/mo is an effective monthly equivalent of the US$120 / 36-month prepaid SKU, not a cancellable monthly price
- Live marketing grid is USD; Australian GST was not printed; gst_basis unknown; checkout was not started
- API yearly amounts disagree: YEARLY_PAYMENT_RECURRING US$69.99 vs YEARLY_PAYMENT US$49.99 not in the catalogue
- Free plan no longer includes country selection or SplitBear (Dec 2025 blog)
- Legal entity is Canadian; Teams still names McAfee (US); both Five Eyes; advertised AU exits are not data residency
- 30-day money-back is first-year annual website purchases only; monthly, Teams, iOS and Google Play are excluded
- No dedicated Linux app; OpenVPN NetworkManager only; GhostBear not on iOS or macOS v5; Android has no IKEv2
- Most recent public Cure53 PDF is 2023; 2024 and 2025 annual audits are announcement-only (guessed PDFs 404)
- Transparency report last covers 2021–2023. Country-count copy disagrees (47 / 46+ / over 45). No independent speed, leak-test or streaming-unblocking results
How this review was made
Reviews separate vendor documentation, editorial analysis and firsthand records. They are not interchangeable.
- Vendor documentation — Public pages from TunnelBear and other sites. Recorded HTTP(S) URLs are listed under Sources. A source URL is a document we recorded, not a claim that every sentence on this page was checked against that URL.
- Editorial analysis — SoftwareHQ's written verdict and scores for Australian buyers. The header score is an editorial assessment, not a user-review average, not a lab result, and not a number derived from how many evidence records exist.
- Firsthand records — This review has no firsthand observation records, trial walkthroughs, or screenshots from a logged-in SoftwareHQ account. Missing tests stay not tested.
This page does not rank products by speed or security from documentation or from evidence count.
Checked by SoftwareHQ Editorial Team. There is no named author profile for this page; attribution stays with the SoftwareHQ editorial team. How we test and the editorial policy for scoring, independence and affiliate rules.
Sources
Public pages recorded when this review was compiled. They are not a checklist that every claim was verified, and they are not evidence of hands-on product testing.
- Tunnelbear official site
- Tunnelbear pricing
- Prod Api Core Getpricingdetails
- Tunnelbear privacy policy
- Tunnelbear Terms Of Service
- Tunnelbear about
- Tunnelbear features
- Tunnelbear Download
- Tunnelbear Windows
- Tunnelbear Mac
- Tunnelbear Ios
- Tunnelbear Android
- Tunnelbear Browser
- Tunnelbear Teams
- Tunnelbear support
- Tunnelbear Hc
- Tunnelbear 360007004351 Where Can I Tunnel To And From
- Tunnelbear 360032170811 How Do I Get A Refund
- Tunnelbear 360006708972 What Devices Will Tunnelbear Work On
- Tunnelbear 5907031724443 Vpn Protocol Choosing How You Connect To Tunnelbear
- Tunnelbear 360006974672 Vigilantbear Strengthen Privacy When Connecting
- Tunnelbear 360007244451 Splitbear Complete Control Over Your Network Traffic
- Tunnelbear 360006708652 Does Tunnelbear Keep Logs
- Tunnelbear 360031244711 What Ports Does Tunnelbear Need To Connect
- Tunnelbear 360007243291 Ghostbear Fight Censorship On Restrictive Networks
- Tunnelbear 34767952636571 Tunnelbear S Bandwidth Program Supporting Internet Freedom Around The World
- Tunnelbear Tunnelbear Completes 8th Annual Independent Security Audit
- Tunnelbear Tunnelbear Completes 7th Annual Independent Security Audit
- Tunnelbear Tunnelbear Completes 6th Annual Independent Security Audit
- Tunnelbear Important Changes To Tunnelbear Free User Accounts
- Tunnelbear Tunnelbear Transparency Report For 2023
- Tunnelbear Tunnelbear Joins Mcafee
- Tunnelbear Setting Up Tunnelbear On Linux
- Cure53 Pentest Report Tunnelbear 2023.pdf
- Cure53 Pentest Report Tunnelbear 2022.pdf
TunnelBear Alternatives
If TunnelBear doesn’t quite fit your needs, consider these alternatives for Australian businesses:
- NordVPN — Personal VPN with prepaid intros, advertised AU exits, login-walled audit.
- Surfshark — Unlimited-device VPN with prepaid AUD intros and a public Deloitte report.
- ExpressVPN — USD prepaid VPN, advertised AU exits, inspectable KPMG report.
- Proton VPN — Swiss-jurisdiction VPN with a restricted free plan and public Securitum PDFs.
- Mullvad VPN — Swedish numbered-account VPN at a flat €5/month, public audit PDFs. From $5/mo.
Buyer guide
Source-based VPN guides for TunnelBear: what a VPN encrypts, billed-term cash, free versus paid caps, how intro differs from renewal, how to read audits, how kill switch, split tunnel and protocols vary by OS, and when a consumer exit is the wrong product for company resources. Not a ranking.