IVPN: what it says it logs, who audited it, and one incident

What IVPN is, and who runs it

IVPN is a VPN service run by IVPN Limited, which its privacy policy says is registered in Gibraltar. Wikipedia gives the company’s former name as Privatus Limited and the launch year as 2009, with a “citation needed” tag on the year. The IVPN home page says the service has run continuously under the same ownership since 2009. Privacy Guides, whose VPN page includes IVPN, also says it has operated since 2009, is based in Gibraltar and does not offer a free trial.

A notice on the Wikipedia page, dated September 2026, says the article may rely too heavily on sources closely tied to its subject. Eight of the eleven entries in its reference list are IVPN pages, among them the privacy policy and the plan page. So on this page Wikipedia is used for history, and IVPN’s own pages are treated as IVPN’s statements, not as outside proof.

Wikipedia says that in 2024 IVPN acquired Safing, a company that offered a firewall application and the SPN service, and it points to an IVPN post dated 3 December 2024. IVPN’s pricing page today lists Portmaster, which it calls a firewall and network monitoring tool operated by IVPN, in its top plan, and the home page says Mailx, modDNS and Portmaster are services operated by IVPN. Wikipedia adds that in May 2026 IVPN announced new subscription tiers, some with extra services: a customizable DNS filter, email aliasing and a desktop firewall.

On servers, the home page says IVPN operates gateways in 41 countries on dedicated bare-metal servers, with no shared VPS and no virtual locations, and that all servers managing the service, including email and customer service, are self-hosted and operated by IVPN. The pricing page counts 58 locations in 41 countries. Privacy Guides gives 41 countries, last checked on 28 October 2025, and says dedicated servers are better for the security of a provider’s private keys than shared ones. On code, the home page says the website and the apps for all platforms are open source, Privacy Guides dates the apps’ open-source status to February 2020, and TechRepublic says the code of the mobile apps is on GitHub.

What the policy says it logs, and what it keeps

The privacy policy lists what IVPN says it does not log about VPN activity: traffic, connection timestamps and duration, DNS requests, user bandwidth and customer IP addresses. The only account activity it says it records is the total of simultaneous connections. These are IVPN’s statements about itself, and the home page repeats them in shorter form.

At sign-up, the policy says IVPN stores an ID, the time of creation, the product and the maximum number of devices, and that it asks for no email address or name. It adds that this leaves IVPN with no way to contact a customer about account issues or downtime, unless the customer adds an email address in the client area afterwards.

For payments, the policy lists a payment ID, account ID, amount, currency, timestamp and transaction ID. Card payments go through Braintree, PayPal is also offered, and the policy says IVPN runs its own BTCPay server for Bitcoin. It says Braintree and PayPal collect more details, such as card details, and are required to keep them for many years; that IVPN does not store those details; and that no third-party payment provider has access to the IVPN account ID. For anyone concerned about that, the policy points to cash or cryptocurrency. A voucher code is kept with the account ID for 30 days after redemption, then deleted.

The policy explains how limits are enforced without a record of past connections. To cap simultaneous connections, it says, an authentication server holds a temporary record of connected account IDs, and the record is deleted when the user disconnects, so IVPN could not say how many connections an account had at a given time in the past. For the device limit, the policy describes a session entry made of a token and the account ID, with no timestamps and no device details such as make, model or MAC address, deleted at logout or when the account ends.

After a subscription ends, the policy says the account and all data linked to it are deleted automatically after 90 days, except accounting data: the date of payment, amount, payment method, transaction ID and subscription ID, which it says has no link to a past account ID. A customer can delete the account at once with a button in the client area. The policy also describes website analytics run on Matomo, hosted on IVPN’s own servers, with the last two octets of the visitor’s IP address discarded, and crash logs that the policy says carry no personally identifiable information.

On authorities, a help answer says that if a court order arrives from a recognized legal authority with jurisdiction over IVPN, the company will comply, but that it cannot be compelled to hand over information it does not have. The same passage says that if the law ever required persistent connection logs, IVPN would notify customers and do everything in its power to move jurisdictions or close the service. The policy names the Gibraltar Regulatory Authority as its GDPR body.

IVPN also publishes a monthly warrant canary, a signed message. The version we read is dated 3 November 2026. It says no warrants have been served on IVPN or its employees, no searches or seizures have been performed on IVPN assets, IVPN has no knowledge of backdoors and has not been asked to implement one, and it has never disclosed user communications to a third party. The page itself warns that the method “is not infallible”: a signature stops a third party from inventing declarations, but does not stop force being used to make IVPN produce a false one.

The audits, one by one

IVPN published a blog post for each of the audits we read. The posts say Cure53 did the work and say the full reports are available, but we did not open them, so everything below is IVPN’s account of what Cure53 found. According to its June 2026 post, IVPN schedules and commissions the audits.

The post of 21 March 2019 tested the no-logging claims in the privacy policy. IVPN says the scope included all systems involved in serving a VPN connection, including the gateway and authentication servers, and that 3 auditors spent 7 days on it in March 2019. It quotes Cure53 as concluding that all of the privacy statements could be verified as truthful within the defined scope. Cure53 identified one issue, classed as low impact: DNS servers temporarily cached their responses. IVPN says that data was not tied to a customer IP address or account and that it disabled the cache. A reader’s comment under the post says the audit did not cover the apps, support or billing, and an IVPN reply says a broader audit was under way.

The post of 12 March 2021 covered the apps. Five Cure53 members spent 18 person-days on it in late February and early March, and the auditors also reviewed the latest mobile apps for iOS and Android. IVPN says the work found 4 vulnerabilities (2 critical, 2 medium), all in a new desktop app not yet released, and that they were resolved at once; of 10 miscellaneous issues, 8 were resolved and 2 were judged very low risk. The post says the auditors had access to code and a test environment, and no access to production VPN servers, and notes that an audit is a snapshot of the code in scope during the period.

The post of 15 March 2023 covered new gateway servers, tested in a testing environment before going to production. Two senior Cure53 members worked for 6 days in February 2023. IVPN reports 3 security vulnerabilities and 5 miscellaneous issues, broken down as 1 medium, 6 low and 1 info, all remediated, and again says no production access was granted.

The post of 11 April 2024 describes the sixth annual audit and covered the customer website, its API and the web servers, over 8 days in March 2024. IVPN reports 2 low-severity vulnerabilities and 2 info-level issues, with all vulnerabilities remediated, and quotes the report as finding a “substantially secure posture”. IVPN again says no access to production servers was granted.

The most recent audit post we read, from 19 June 2026, announces the eighth annual audit, scheduled for two weeks in July. The post says the scope includes the cryptography and privacy model and the following services, listed as generator, token and preauth, verifier and distributor, and it names Unlinked Access as the most relevant addition since the previous audit. IVPN describes Unlinked Access as the system that lets Plus and Pro Suite subscriptions grant access to Mailx, modDNS and Portmaster without passing on IVPN account identifiers. The post says results of a 2025 audit of Mailx and modDNS are published, but we did not open them, and the pages we read do not contain the result of the July 2026 audit.

The count differs between pages. The home page says “Eight audits since 2019”, while the June 2026 post calls the audit planned for July the eighth annual one. Privacy Guides says IVPN has had multiple independent audits since 2019. We read posts for 2019, 2021, 2023, 2024 and the 2026 announcement, so we cannot match eight audits to eight pages. Wikipedia also mentions a Cure53 pentest report dated 2020, which is not among the pages we read.

IVPN’s June 2026 post also explains why it does not repeat one kind of audit. It says its last and only no-logs audit was Cure53’s in March 2019, that audits are a snapshot in time, and that a service with a no-logs stamp could change its systems and start collecting data the next day. It adds that some providers use such audits as a marketing tool and that IVPN will not commission further no-logs audits. By IVPN’s account, then, the 2019 audit of the logging claims stands alone, and the later posts we read describe audits of apps, gateways in a test environment and the website, plus one scheduled for a new service.

For context, TechRadar interviewed the founder of Cure53, Mario Heiderich, in April 2022. The interview does not mention IVPN, and we use it only as general background. In it, Cure53 lists what it can audit, from mobile and desktop apps to servers, cryptographic designs and payment processes. Asked about challenges, the founder says it is sometimes hard to convince a customer that no-log audits make no sense, because Cure53 cannot work with a threat model in which the provider itself is a possible adversary. Asked what guarantees an audited VPN can give its users, the answer is “Only one, we try our best”. TechRadar notes that it may earn an affiliate commission on its links.

What IVPN says a VPN cannot do, and what one review made of it

The home page has a section headed “Do you really need a VPN?”. It says IVPN does not promise anonymity or military grade encryption, and it lists what it calls “useless (at best ineffective)” uses of a VPN: achieving anonymity; stopping Google or Facebook from collecting private data; stopping profiling by social networks or search engines; better security when working from home; protecting passwords; hiding a phone’s GPS location; avoiding data breaches; and defending against “cyber threats” and identity theft.

It then lists what it says a trustworthy VPN can do well: encrypt data so an ISP or mobile network provider cannot monitor or log activity, encrypt DNS requests, add security on untrusted public networks, mask the IP address from websites and get around censorship or geographical blocks. It adds that this makes sense only if the reader trusts the VPN provider more than the ISP. Privacy Guides makes a related point on its VPN page: VPNs “do not provide anonymity”, and for anonymity it points to the Tor Browser.

On money, the home page says IVPN’s business model is exclusively paid subscriptions, that it never pays for reviews and that it closed its affiliate program, so it will not be found on top-10 lists. That matters when reading reviews. TechRepublic’s page carries a note that it may earn from vendors through affiliate links or sponsorships, which it says might affect product placement but not the content of its reviews. Its IVPN review calls Surfshark an exceptional product, says it offers more features than IVPN at a lower price, and recommends it to any customer looking to buy a VPN. We report both positions and rank neither service. Our page on Mullvad VPN reads another provider the same way.

TechRepublic scored IVPN 3.4 out of 5 on 7 January 2025, using a rubric of five weighted categories: pricing 3.5, features 2.8, usability and administration 3.9, security and privacy 4.5 and customer support 2.3. Its listed pros are anti-tracking and ad blocking, open-source apps on all platforms and no stored logs of customer browsing data. Its listed cons are email support but no phone or live chat, no password manager integrations and no training videos. The review also says IVPN’s features do not include unblocking streaming services such as Netflix or Disney+. The pricing page lists “No streaming compatibility guarantees” among the limitations IVPN acknowledges, while the home page lists getting around geographical blocks among the things a trustworthy VPN can do. We read these as different statements and do not decide between them.

The review is also older than the pricing page. It describes two plans, Standard for 2 devices without multihop and Pro for 7 devices with it, where the pricing page now shows three plans with multi-hop already in Standard. On protocols, the home page offers WireGuard, OpenVPN or IPSec, while Wikipedia lists WireGuard, OpenVPN and IKEv2. TechRepublic says the iOS kill switch works if the built-in on-demand feature is used.

The home page lists further features: WireGuard that is quantum-resistant by default in the IVPN apps, using a post-quantum key exchange; a custom schedule for rotating keys and IP addresses; AntiTracker; non-logging DNS servers; split tunneling; multi-hop routes; a kill switch and firewall option on macOS, Windows, Linux and Android; and V2Ray obfuscation on every platform, plus obfs4 for OpenVPN on desktop. For what the main ones do, see our pages on the kill switch, split tunneling and WireGuard against OpenVPN.

Price, payment and the gaps

The pricing page, in US dollars, shows three plans. Standard covers 5 devices and costs $2 for a week, $6 for a month or $60 for a year; it includes multi-hop, obfuscation protocols, a SOCKS5 proxy and AntiTracker. Plus covers 5 devices at $3, $8 and $80 and adds modDNS and Mailx. Pro Suite covers 10 devices at $4, $10 and $100 and adds Portmaster Pro for Linux and Windows. Wikipedia gives the monthly prices as $6, $8 and $10, and says the tiers followed an announcement of 8 May 2026.

The same page lists a 30-day refund window, no email required at signup, and payment by credit card, PayPal, Bitcoin, Bitcoin over Lightning, Monero or cash. TechRepublic, in January 2025, also mentions a 30-day money-back guarantee and no free trial; the privacy policy gives the money-back guarantee as the reason it stores transaction and subscription IDs. Privacy Guides says cash is accepted on annual plans and that prepaid cards with redeem codes can be bought.

TechRepublic’s prices are from the older plans: $6 a month for Standard, or $5 a month billed annually, and $8.33 a month billed annually for Pro. Those numbers describe a different structure from the pricing page, so they should not be compared line by line with it.

The pricing page has a short list headed “Limitations we acknowledge”: 58 locations in 41 countries, no port forwarding, and no streaming compatibility guarantees. Privacy Guides adds detail the list does not give. It says IVPN removed port forwarding in June 2023, which could affect peer-to-peer applications such as torrent clients, and that IVPN allows connections to services over IPv6 but not from a device with an IPv6 address. The pricing page’s list does not mention IPv6.

The August 2026 incident, and what the pages leave open

On 11 August 2026, IVPN published a post about a security incident on its Bitcoin payment server. It says that on 7 August a critical vulnerability was disclosed in BTCPay Server, the open-source software IVPN hosts itself to accept Bitcoin, and that it was being exploited before disclosure. By IVPN’s account, an attacker read the file of credentials for its Lightning node, closed the channels and moved a little over 0.6 bitcoin of IVPN’s operating funds out in two transactions, at 03:32 and 17:20 UTC.

IVPN says no customer data was accessed, no customer funds were lost and no action is required from customers. It says the VPN infrastructure was not involved, that the payment server is a separate system handling Bitcoin invoicing only, and that the customer database is on separate infrastructure the payment application cannot reach. Lightning payments were unavailable from 7 to 10 August; on-chain Bitcoin, Monero, card and PayPal payments worked throughout, and IVPN says customers whose subscription lapsed because of the outage can contact support for an extension.

IVPN says it saw the disclosure on the evening of 7 August, shut down the payment stack and upgraded to the patched release, and found the theft in the checks that followed. It then rebuilt the Lightning node from a new seed, regenerated credentials, closed the publicly reachable Lightning API endpoint and disabled a secondary web interface that BTCPay enables by default. The node now holds a working balance worth a few hundred dollars, with the rest swept to hardware wallet storage within hours. IVPN says it is adding its own alerting on the node and has sent the BTCPay team a technical report with three findings about the default configuration.

The post also ties the incident to logs. IVPN says it could not determine exactly which requests the attacker made, because the affected server has no HTTP request logs and never had, and that it will keep it that way, since logging on the payment path would mean collecting records of who pays and when. It calls the cost real: it cannot fully reconstruct what the attacker did.

This post is the only account of the incident that we read. The pages we read do not include an independent report on it, so everything in this section is IVPN’s own description. The warrant canary of 3 November 2026 does not mention the incident, and we draw no link between the two.

Some questions are left open by the pages we read. They do not give the result of the July 2026 audit, the full Cure53 reports, or what IVPN’s transparency report contains, which we did not open. They do not compare IVPN with Proton VPN, so for that, our page on Proton VPN sets out what that service says it logs. We ran no speed test, leak test or payment. Our VPN pages say nothing is ranked until we have paid for the accounts and used them ourselves, and this page ranks nothing.