Case file · VPN
IVPN
Account-number sign-up, anonymous payments, audited no-logs.
The systematized overview
The bureau vs the internet.
9.3/10 · Guaranteed no-KYC
A genuine level-0 no-KYC VPN: a generated account ID instead of an email, cash and Monero accepted, and no discretionary "we may request ID" clause anywhere. Its no-logs claim is audited (Cure53, 2019) and its transparency report shows zero of 35 legal requests ever yielded data. A hair behind Mullvad on scale, not on principle.
3 recurring praises · 3 recurring gripes
Most praised: trusted by the privacy community for the account-id model and anonymous payment. Most cited downside: smaller server network and higher price than mainstream vpns.
We track our editorial score and community sentiment separately — neither moves the other. Read together, they're the systematized overview.
The facts
Specs & jurisdiction.
- Jurisdiction
- Gibraltar
- Intel-sharing
- Outside 5/9/14 Eyes (UK-linked)
- Logging
- No logs (audited); no traffic/timestamp/DNS/bandwidth/IP
- Anon. payment
- Cash, Monero (own full node)
- Protocols
- WireGuard, OpenVPN
- Network
- Small network · ~30 countries
- Devices
- 5 (Standard/Plus), 10 (Pro Suite)
- Kill switch
- Yes (Firewall)
- RAM-only
- No
- Open source
- Yes
- Audited
- Yes — Cure53, 6 annual (2019–2024)
- Free tier
- No (paid; short passes)
The full read
Our analysis, in plain words.
IVPN is a genuine level-0 no-KYC VPN built on the same principle as Mullvad: there is no account identity to demand. You are issued a random account ID (i-XXXX-XXXX-XXXX) with no email or name, and email is optional. Payment can be fully anonymous through cash or Monero, for which IVPN runs its own full node so no third-party processor sees the transaction. No discretionary "we may request ID" clause exists anywhere in the policy.
What sets IVPN apart on trust is verification and integrity. Its no-logs claim is not just stated: a dedicated 2019 Cure53 audit verified it on the gateway and auth servers, and IVPN has since run six annual Cure53 audits (2019-2024). Its transparency report is the strongest in the cohort: across its history, zero of 35 legal requests have yielded any customer data, because it holds none, and it maintains a warrant canary. IVPN complies with valid orders but "cannot be compelled to hand over information which it does not have," and pledges to relocate or shut down rather than begin logging.
The integrity stance is unusual enough to note: IVPN closed its own affiliate program "to protest against the practice of paid reviews and misleading recommendations by best VPN websites," and rejects Facebook, Google and all programmatic advertising. It forgoes revenue to avoid the incentive problems the rest of the industry lives with, which aligns closely with this bureau's own no-paid-listings principle.
The honest costs are scale, not principle. IVPN runs a smaller server network (~30 countries) than the mega-commercial VPNs, has no free tier, and is not advertised as RAM-only/diskless, so it lacks the "nothing on disk" guarantee Mullvad now offers. Its Gibraltar base is outside the formal 5/9/14 Eyes alliances but is a UK Overseas Territory, and IVPN itself concedes it could in principle be compelled one day, which is exactly why the audited no-logs architecture, not the jurisdiction, is what protects users.
The score, broken down
How the 9.3 is built.
Privacy
weight 50%What identity, data and metadata the service can demand or collect.
95 × 50% = 4.8 of 10
Trust
weight 30%Whether it can technically deliver what it claims — code, audits, age.
88 × 30% = 2.6 of 10
Reliability
weight 20%Whether the no-KYC claim holds under real-world pressure.
96 × 20% = 1.9 of 10
Weighted total 9.3 / 10 · no reliability rule triggered, so the score stands. See the rubric →
Every point, sourced
What earned the score.
Privacy
The fine print, read for you
Terms reviewed — no trapdoor found.
“When you sign up for IVPN, you will not be asked for any personal information e.g. email address, name etc. ... the company cannot be compelled to hand over information which it does not have.”
What it meansNo discretionary identity-on-demand clause exists anywhere. The only conditional language is pro-user: if ever legally forced to log, IVPN pledges to notify customers and move jurisdictions or close rather than comply. This is what a genuine level-0 posture reads like.
Read the source →None. Sign-up issues a generated account ID (i-XXXX-XXXX-XXXX) with no email or name; email is optional and added only if you want it. Anonymous payment (cash, Monero) exists. No government ID is ever requested at any stage.
Policy review — point by point
-
No personal data requested at sign-up
Account is a generated ID; no email, name, or phone is requested. Email is optional. ↗
-
No discretionary ID-on-demand clause
Nothing in the policy reserves a right to demand identity later, the defining trait of a genuine level-0 service. ↗
-
Cannot hand over what it does not have
IVPN complies with valid court orders but holds no customer activity data to surrender, and pledges to relocate or close rather than log. ↗
-
Rejects surveillance advertising and paid reviews
Closed its affiliate program in protest and rejects programmatic advertising, an integrity signal on data incentives. ↗
Gibraltar, a UK Overseas Territory. It is outside the formal 5/9/14 Eyes alliances, but its UK linkage means compulsion is not impossible; IVPN acknowledges this and relies on holding no data (audited, and evidenced by a 0-of-33 transparency record) rather than on an absolute legal shield.
We keep watching
Incident & policy timeline.
- 2016-2026
Transparency report: 0 of 35 requests yielded data
Across its published transparency reports, none of 35 legal requests (2 deemed valid) produced any customer data, because IVPN holds none. Backed by a warrant canary.
source ↗ - 2024
Sixth annual Cure53 audit
Cure53 audited the customer website, backend, and API over 8 days in March 2024, finding a substantially secure posture with only low-severity issues.
source ↗ - 2019
No-logs claim verified by Cure53
A dedicated Cure53 audit of the gateway and auth servers verified IVPN's privacy statements as truthful; the one low-impact finding (DNS caching) was mitigated. Note the scope was servers, not the signup/billing systems.
source ↗ - 2018
Closed its affiliate program on principle
IVPN shut down its affiliate program "to protest against the practice of paid reviews and misleading recommendations by best VPN websites," and rejects surveillance advertising. A rare integrity stance that forgoes revenue.
source ↗
The verdict
Where it stands.
Strengths
- Account-ID sign-up, no email or name
- Cash and Monero (own full node)
- Six annual Cure53 audits incl. a dedicated no-logs audit
- Transparency report: 0 of 35 requests yielded data
- Closed its affiliate program to protest paid VPN reviews
- Fully open-source apps
Trade-offs
- Smaller server network than mainstream VPNs
- No free tier (paid only; short-term passes)
- Not advertised as RAM-only/diskless
- Gibraltar is a UK Overseas Territory (some jurisdictional linkage)
Across the internet
What reviewers report.
Consistently praised
- Trusted by the privacy community for the account-ID model and anonymous payment
- The six-year Cure53 audit streak and 0/33 transparency record are cited as proof it holds
- Closing the affiliate program earned goodwill as a rare integrity move
Recurring complaints
- Smaller server network and higher price than mainstream VPNs
- No free tier; not RAM-only, unlike some competitors
- Gibraltar jurisdiction occasionally raised as a mild concern
Sentiment is strongly positive on integrity, audits, and anonymity, and mixed only on scale/price. No corroborated data-betrayal or freeze pattern exists; the transparency record is consistent with the no-logs claim.
Keep exploring
Related lists & categories.
Ask the bureau
IVPN, common questions.
Is IVPN no-KYC?
Yes - IVPN issues a random account ID (i-XXXX-XXXX-XXXX) at signup with no email or personal detail required, and its no-logging policy has been independently audited by Cure53. We rate it KYC level 0 (9.3/10 overall).
Can you sign up to IVPN without an email?
Yes. IVPN issues a random account ID (i-XXXX-XXXX-XXXX) at sign-up, so no email or personal detail is required. Email is optional and only added if you want account recovery.
Does IVPN accept anonymous payment?
Yes. It accepts cash and Monero (for which it runs its own full node) alongside cards, so payment need not identify you.
Is IVPN's no-logs claim verified?
Yes. A dedicated 2019 Cure53 audit verified the no-logging claim on IVPN's servers, and its transparency report shows zero of 35 legal requests ever yielded data because it holds none. (The 2019 audit covered servers, not the separate signup/billing systems.)
What happens if authorities ask IVPN for data?
IVPN will comply with a valid court order, but states it "cannot be compelled to hand over information which it does not have." It also pledges to notify customers and relocate or shut down rather than start logging.
Your exact case not covered? The live Ask the bureau answers it and turns it into a public FAQ.