Can your employer or school see your traffic through a VPN?

It depends on whose device it is, not on the VPN. On a phone you own, with nothing of your employer's or school's installed on it, a VPN hides the names of the sites you visit and the contents of your traffic from the office or campus network; they see one encrypted stream to one server. On a managed device, or any device where a corporate certificate has been installed, the organisation can inspect your traffic regardless of the VPN, because it has access to the phone itself rather than only to the network.

Those are two different questions, and most confusion about this comes from mixing them up.

The network question: your own phone on their Wi-Fi

Every packet your phone sends over the office Wi-Fi crosses equipment the organisation controls, and a corporate network is logged far more thoroughly than a home router. Without a VPN that means the DNS name of every site you visit, the server name in every HTTPS handshake, every destination address, and the timing and volume, all attached to your device's name. The Wi-Fi owner post goes through what appears in those logs.

With a VPN connected, all of that is wrapped inside one encrypted connection to the VPN server. The network sees:

• that your device is on the Wi-Fi, when it joined and when it left;
• one encrypted stream to one address, on one port;
• the volume of data in that stream;
• that it is a VPN, because the pattern is recognisable.

It does not see site names, DNS lookups or contents. That is the same outcome as on any other network you do not control, and the office Wi-Fi and campus Wi-Fi posts cover the practical side.

Two caveats. If you signed in to the Wi-Fi with your staff or student credentials, your identity is attached to the device for the session, VPN or not. And the moments before the tunnel comes up are unprotected; Android's Always-on VPN with "Block connections without VPN" closes that gap.

The device question: anything of theirs on your phone

A VPN encrypts traffic between your phone and the VPN server. It cannot protect against something that reads the traffic before it leaves the phone, or that has been granted authority over the phone. Three things do exactly that.

Device management. A phone enrolled in the organisation's mobile device management, or carrying a work profile the employer installed, gives them a set of controls: which apps can be installed, whether a VPN is permitted, whether work apps must route through the organisation's own VPN, and on fully managed devices, visibility into what is installed and running. On a fully managed device the organisation is the administrator, and no arrangement of apps hides traffic from an administrator.

A corporate certificate. Many organisations install their own root certificate on managed devices so that a security appliance can decrypt HTTPS, inspect it, and re-encrypt it. If that certificate is on your phone, the appliance can read HTTPS contents on any network it sits in front of, and a VPN does not change that, because the interception happens inside the connection the VPN is carrying. On a work profile the certificate usually applies only to work apps; on a fully managed device it can apply to everything.

Monitoring software. Endpoint agents installed by the organisation can log app usage, screenshots or keystrokes on the device itself. Nothing on the network side, VPN included, has any bearing on that.

Put plainly: if the device is managed, or a certificate belonging to the organisation is installed on it, the organisation can inspect your traffic no matter what VPN you run. Treat such a device as theirs, and do personal things on a phone that is yours.

How to check your phone

On Android, three places tell you most of what you need. Exact menu names vary by manufacturer.

1. Work profile. Open Settings and look for a "Work" section or a work profile toggle, or check whether some apps carry a briefcase badge in the launcher. Either means a work profile is installed.
2. Device management. In Settings, search for "device admin" or "device management". A listed organisation or management app means the phone is enrolled.
3. User certificates. Settings > Security > Encryption & credentials > Trusted credentials, then the User tab. A certificate here that you did not install yourself, named after your employer or a security vendor, is the interception certificate described above.

If all three are clear, the device question is answered and only the network question remains.

Networks that refuse VPNs

Some office and campus networks filter the ports that VPN protocols use or block the protocols outright, so the app cannot connect at all. That is a policy choice by the network, not a sign that anything is being read. A well-built app tries several connection methods in order, including a TLS-wrapped transport on port 443 that looks like ordinary web traffic, and keeps the one that works; the what-to-do post explains the sequence. Whether you should is a separate matter: check the acceptable-use policy you agreed to, since some organisations prohibit VPNs on their network and enforce it.

What the VPN provider sees instead

Once the tunnel is up, the party that can see your site names and destinations is the VPN provider, not the network. Culvert VPN does not log the websites you visit, your DNS queries or the contents of your traffic; its servers see only an opaque connection id, and it keeps your client IP address for up to 30 days for abuse handling, as set out in its privacy policy.

On a phone that is yours, Culvert VPN keeps site names and contents off the office or campus network and tries several connection methods, keeping the one that works, on Google Play.