Who operates the service
IVPN Limited operates the service from Gibraltar.
No traffic, connection timestamps/duration, DNS requests, bandwidth or customer-IP logs. Temporary active device/session records enforce device limits. Account ID, creation time, product and device limit; no signup email/name required, optional email after signup. Device tokens persist until logout/account deletion; names optional for device management. Stores payment/account IDs, amount, currency, timestamp and transaction reference; subscription ID when recurring enabled. Braintree/PayPal retain payment data separately and do not receive IVPN account ID.
Read the privacy policy ↗
What the audit covers
Cure53 · 2026-07-16: Four work packages: token/pre-auth services; distribution services; verifiers/clients; cryptographic/privacy model for Unlinked Access used by additional services. Latest audit reviewed Unlinked Access, not the entire VPN infrastructure or a general no-logs policy. Do not label it as a complete VPN no-logs audit.
An audit concerns the systems and period described in its scope. It does not establish that a service can never log data or that every app behaves identically.
How to read an audit