IVPN is a Gibraltar-registered VPN service (legal name IVPN Limited, founded 2009 by security professionals who met at Royal Holloway, University of London) run by a distributed team of 10 people. Its privacy policy states no personal information is required to sign up and that it logs no VPN activity data -- no traffic, connection timestamps, DNS requests, bandwidth, or IP addresses -- and that it cannot be compelled to hand over information it does not have, since Gibraltar-jurisdiction court orders can only reach what actually exists. IVPN commits to and publishes an annual third-party security audit with Cure53 (its 2024 web-infrastructure audit found only two low-severity issues, both remediated), and it self-hosts its own Bitcoin/Lightning payment infrastructure specifically to avoid handing a third-party processor visibility into customer payment metadata. Wart: in August 2026 IVPN disclosed that an attacker exploited a BTCPay Server vulnerability on its self-hosted Bitcoin payment server and stole its own operating funds; IVPN states no customer data was accessed and no customer funds were lost, and Lightning payments were restored within three days.
TIMELINE
1 ENTRY
[2026-08-30] · NEW RECEIPTS
8 new sources on file for IVPN.
IVPN's file gained 8 new sourced claims since its last review.
IVPN's Privacy Policy states that signing up requires no personal information such as an email address or name, and that IVPN will not log personally identifiable information such as IP addresses; an email address can optionally be added later purely for support contact.
IVPN's Team page states the company is run by a distributed team of information security experts and privacy activists whose founding team met while studying information security at Royal Holloway, University of London, and that IVPN has operated continuously since 2009.
IVPN's Privacy Policy discloses the company is registered in Gibraltar and names the Gibraltar Regulatory Authority as the GDPR regulatory body overseeing it.
IVPN's Privacy Policy states that while the Gibraltar-incorporated company will comply with a valid court order from a recognized legal authority, it cannot be compelled to hand over information it does not have in the first place, given its no-logs architecture.
IVPN's blog publishes the results of its 2024 Cure53 web-infrastructure audit, quoting the auditor's finding that the customer website and underlying servers presented a substantially secure posture, with only two low-severity vulnerabilities and two general weaknesses identified, all subsequently remediated, and the full report published with only sensitive details redacted.
IVPN's blog states it has scheduled its eighth consecutive annual third-party security audit with Cure53, describing this as consistent with its ongoing commitment to regular independent security audits.
IVPN's blog discloses that on 7 August 2026 an attacker exploited a disclosed BTCPay Server vulnerability to compromise its self-hosted Bitcoin payment server and steal its own operating funds; IVPN states no customer data was accessed and no customer funds were lost, and that the affected system was isolated from VPN and account infrastructure.
IVPN's Privacy Policy itemizes exactly what it does not log about a user's VPN activity: no traffic logging, no connection timestamp or duration, no DNS request logging, no bandwidth logging, and no IP-address logging.