IVPN

IVPN is the anonymous-account-ID privacy-first VPN — a Gibraltar-registered operator that issues random multi-digit account IDs instead of emails, accepts cash by post, Monero, and Bitcoin, has been audited multiple times by independent firms, and consistently scores at the top of independent VPN evaluations (Privacy Guides, EFF, Wirecutter security-tier rankings). Listed at Grade A because IVPN occupies the Mullvad-peer slot in the privacy-first VPN tier: same anonymous-account-ID architecture, same cash-accepted posture, same audit cadence, slightly higher price point in exchange for some operational differentiators worth understanding.

Background. IVPN is operated by Privatus Limited, a Gibraltar-registered company, with the service launched in 2009. The team is publicly identified: Nick Pestell is CEO, and the technical team has a track record of detailed engineering blog posts about IVPN's protocol choices, infrastructure decisions, and audit findings. Gibraltar is the chosen jurisdiction for its data-protection-friendly framework — no mandatory data-retention regime that would force the VPN to keep logs against its no-logs policy. Audit history: multiple independent audits including by Cure53 (the Berlin-based security firm that also audits Tor Browser, Mullvad, and SimpleX). Audit reports are published at ivpn.net with executive summaries and full findings. Open source: IVPN's desktop and mobile client code is open source on GitHub; the server-side infrastructure is not (industry standard — server-side VPN code isn't typically open-sourced). Cross-platform clients: macOS, Windows, Linux, iOS, Android.

What you trust. Anonymous account IDs — when you sign up, you get a random multi-digit ID instead of providing an email; no name, no email, no phone, no PII required. Multiple payment methods — credit card (which leaks your identity to the payment processor, defeating the anonymity story), cash by post (truly anonymous — mail a cash payment to IVPN's office with the account ID), Monero (truly anonymous), Bitcoin (pseudonymous, traceable on-chain), other crypto. No-logs policy + audit-verified — Cure53 audits have inspected the server infrastructure for log retention; published findings consistently show no user-identifying logs. Open-source client — your endpoint code is auditable; the server-side is not but the audit reports cover that scope. Strong protocols: OpenVPN + WireGuard with modern cipher choices; no PPTP or other deprecated options. DNS isolation: IVPN runs its own DNS resolvers; queries don't leak to ISP-DNS or to third-party DNS. Gibraltar jurisdiction — no mandatory data-retention regime; no Five Eyes / Fourteen Eyes membership at the country level (Gibraltar is a British Overseas Territory but doesn't have the same intelligence-sharing obligations as UK proper). What you don't trust: the network-layer protection ends at the VPN exit IP; sites visited *can* see the VPN exit IP and treat all IVPN users as a cohort. Server-side code is not open-source — this is industry-standard for VPN providers; the audit reports cover the scope that open-sourcing would.

Operational specs. Platforms: macOS, Windows, Linux, iOS, Android. Protocols: WireGuard (recommended default), OpenVPN (legacy + obfuscation use cases). Server locations: ~100 servers across ~40 countries — smaller fleet than Mullvad's ~600 servers but selective coverage. Pricing: $6/mo on a 3-year plan, $8/mo on 1-year, $10/mo on monthly; slightly higher than Mullvad's $5-flat pricing. Payment methods: credit card, PayPal, cash by post (mail cash + account ID to IVPN's office), Monero, Bitcoin, other crypto. Account model: anonymous account ID (no email at signup); subscription is tied to the ID, not to any identity. Multi-device: up to 7 simultaneous connections per account. Port forwarding: not offered by default (some users prefer providers that offer port forwarding for self-hosted services; IVPN deprecated this in 2024 after a security review). AntiTracker: optional DNS-level ad/tracker blocking via the IVPN client. Multi-hop: optional cascading through two VPN exit servers (latency cost but stronger anonymity). Kill switch: standard on all clients (cuts internet if VPN drops). DNS leak protection: enforced via firewall rules in the client. No-JS web client signup: the IVPN website itself works without JavaScript, including the signup flow.

Philosophy. IVPN's editorial differentiator is the selectivity-and-audit-rigour posture relative to peer providers. Mullvad (the canonical privacy-first VPN) has more servers, lower price, longer operational track record; IVPN has a slightly smaller fleet, slightly higher price, but matching anonymous-account architecture and audit cadence. The IVPN team's editorial decisions (deprecating port forwarding after a security review, publishing detailed engineering blogs about why specific decisions were made) signal a security-conscious operator that's willing to drop features when the threat model changes. For users who want a Mullvad peer with a slightly different operational philosophy — same anonymous-account architecture, same cash-accepted posture, same audit rigour, but a different team and a different jurisdiction — IVPN is the natural pair.

Grade rationale. Grade A reflects: 16+ years of operational continuity (since 2009); anonymous account-ID architecture (no email required); cash + Monero + Bitcoin payment options (multiple anonymity-preserving payment paths); audited multiple times by Cure53 with published reports; no-logs policy with audit verification; Gibraltar jurisdiction with privacy-friendly data-retention framework; publicly-identified team and CEO (Nick Pestell) with track record of detailed engineering communication; open-source client code on GitHub; cross-platform clients (5 platforms); WireGuard + OpenVPN protocol support; no-JS-supported signup flow; cross-listed in Privacy Guides, web3privacy, and KYCnot peer directories — the rare three-directory concurrence. Last verified 2026-05-11.

Useful when. You want a Mullvad-peer privacy-first VPN with a slightly different jurisdiction and team. You want anonymous account ID signup — no email, no phone, no PII. You want to pay with cash by post (the strongest privacy-preserving payment path — no payment-processor in the loop). You want a VPN with audit-published evidence of its no-logs policy. You're hedging your VPN choice and don't want a single Mullvad dependency for your VPN tier (run IVPN on some devices, Mullvad on others, or split-tunnel between them). You're in a threat model that makes Gibraltar's jurisdiction preferable to Sweden (Mullvad) — the differential is small but exists for some users. You're using a Tor + VPN-over-Tor or VPN + Tor stack and want a VPN with audit-verified no-logs to chain with Tor.

Caveats. Higher price than Mullvad — $6/mo (3-yr plan) vs Mullvad's $5/mo flat. The differential is small but real; for budget-conscious users, Mullvad is the same anonymity posture at a lower price. Smaller server fleet — ~100 servers vs Mullvad's ~600; if you need a specific country's exit IP, check IVPN's server list before subscribing. Port forwarding was deprecated — if you self-host services and want incoming connections through a VPN, IVPN doesn't support this. Mullvad also deprecated port forwarding for similar reasons; if you need it, look at providers like ProtonVPN or AirVPN. Credit card payment defeats the anonymity story — if you pay by card, your identity is now linked to your account ID via the payment processor's records. Cash or Monero are the truly-anonymous paths; card is fine for non-anonymity threat models. Gibraltar is a British Overseas Territory — while not subject to UK proper's data-retention laws, the jurisdiction has political ties to the UK. For threat models where state-actor cooperation matters, evaluate jurisdiction selection carefully. VPN-vs-Tor tradeoffs apply — a VPN protects your IP from sites you visit and your traffic from your ISP, but the VPN provider can see both ends. For threat models requiring no-single-entity-sees-both-ends, use Tor (or Tor-over-VPN, or VPN-over-Tor depending on the specific threat). Mobile clients have platform constraints — iOS in particular has Apple-imposed restrictions on VPN clients that limit some features compared to desktop. The audit reports are point-in-time — Cure53 has audited multiple times but each audit is a snapshot of the infrastructure at audit time; sustained operational continuity is on the operator. Trust the audit history + ongoing communication rather than treating any single audit as a permanent guarantee.