VPN providers
IVPN privacy rating
VPN service from Gibraltar with random account IDs, no email at sign-up, cash and Monero payment, and open-source apps.
Summary
IVPN scores 75 out of 100 (grade B) on the VPN providers criteria. It meets 7 of 12 criteria: no ads or data sales, independent audit, transparency report, tells users about requests, anonymous payment, open-source apps and modern protocols. It partly meets open source, no trackers or telemetry, TLS configuration, security headers and audited no-logs policy. It is based in Gibraltar: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law. Automated tests: SSL Labs grade A- and Mozilla HTTP Observatory grade B+.
Score 75 out of 100. How scoring works
Criteria
-
Partial
Open source Weight 3 of 3
Is all the source code needed to run the product public?
Apps are open source under GPL-3.0. The server side is not.
-
Partial
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
Website analytics use self-hosted Matomo, and mobile crash reports go to IVPN servers and can be turned off. No third-party trackers.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid plans. No ads.
-
Yes
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Full public Cure53 report on the customer website and servers. Audits are repeated yearly.
-
Yes
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Yearly counts of requests received, valid requests and requests where data was provided.
-
Yes
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
The legal process guidelines promise to notify users unless notice is prohibited.
-
Partial
Audited no-logs policy Weight 3 of 3
Has an independent audit confirmed that activity and connection logs are not kept?
The Cure53 no-logs audit is older than three years. Later audits focus on security.
-
Yes
Anonymous payment Weight 2 of 3
Can an account be created and paid for without an email address, name or card?
No email is needed. Cash, Monero and Bitcoin are accepted.
-
Yes
Open-source apps Weight 2 of 3
Are the apps for every platform open source?
Android, iOS and desktop apps are open source under GPL-3.0.
-
Yes
Modern protocols Weight 1 of 3
Is WireGuard (or another modern audited protocol) supported?
WireGuard is supported, with post-quantum key exchange in the apps.
Automated tests
-
Partial
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A-
-
Partial
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B+ (80/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.