RMUTR · VPN
Privacy Notice — University VPN
Last updated 2026-08-17
While your VPN is connected, all of your internet traffic travels through the university network and is recorded for one year. This is not limited to university systems: it covers every website and application you use while connected. We record the destination you connected to, the time, and how much data — we do not record the content of your communications, and we do not decrypt encrypted connections.
The service is configured this way because subscribed research databases such as ThaiLIS authenticate by the university's IP address. If you would rather your personal browsing was not recorded, disconnect the VPN when you are not using university systems.
1. What we collect
When you register a device — your username, your university email address, the device name you choose, your device's public key, the VPN address assigned to it, and the time of registration.
While you use the service — the time you last connected, source and destination IP addresses, port numbers, protocol, start and end times, and volume of data.
When you sign in — the time and outcome of each sign-in attempt and the IP address you signed in from.
What we never see
Your device's private key is generated in your own browser and is never sent to the server. That is why we cannot recover a configuration you have lost — and equally why a compromise of our server could not decrypt your traffic.
Your password is only ever entered on the university's central sign-in page. The VPN system never receives it and does not store it.
2. Legal basis
| The law requires a service provider to retain traffic data and be able to identify users | Computer Crime Act, s.26 |
| Providing the service you asked for, and the university's public mission | PDPA s.24(3), s.24(4) |
| Keeping the network secure | PDPA s.24(5) |
| Reviewing total usage per account to plan network capacity | PDPA s.24(5) |
This processing does not rely on your consent, but on legal obligation and the university's mission. You therefore cannot ask us to stop recording, but you are free not to use the VPN.
3. How long we keep it
| Traffic records (destinations connected to) | 1 year |
| Sign-in records | 1 year |
| Other system logs | 1 year |
| Device registration and revocation history | Retained, so a past IP address can still be attributed |
The legal minimum is 90 days. The university keeps one year so that investigations can reach back further, and to align with ISO/IEC 27001.
4. Who can access it
- A small number of designated technical staff, who must use two-factor authentication and whose access is itself logged.
- You — your own devices are listed on the front page of this service.
- Authorities, only under a court order or a lawful instruction from a competent officer.
We do not send your data outside the university, never abroad, and never for marketing.
5. How we protect it
Traffic is encrypted end to end · backups are encrypted before they leave the machine and the key is held separately · logs are sealed so later tampering is detectable · staff access requires two-factor authentication · servers are in the university data centre.
6. Your rights
You may request access and a copy, request correction, object to processing, request restriction, and complain to the Personal Data Protection Committee.
One limit: you cannot require deletion of traffic data the university is obliged to retain before that period expires. You may remove a device at any time, but records already created remain until their retention period ends.
To exercise a right or ask a question: noc@rmutr.ac.th
See also: Acceptable Use Policy