CyberGhost

Is CyberGhost safe?

Mostly, yes. CyberGhost encrypts your traffic, runs its servers from RAM and has had its no-logs setup reviewed by Deloitte three times. Its quarterly reports show tens of thousands of copyright complaints and a few police requests every quarter, and the company says it has nothing to hand over for any of them. We score it 79/100.

That puts it level with its sister brand ExpressVPN (79) and below Private Internet Access (83), which has the same owner. The gap comes from three things: CyberGhost's apps are closed source, its store labels list identifiers used for marketing, and its Windows client has had a steady run of security flaws.

Who owns CyberGhost, and does it matter?

CyberGhost began in Germany. In 2011 it moved its business to a newly registered Bucharest company, CyberGhost S.R.L., saying Romania offered better protection for online data. In March 2017 it was bought by Crossrider plc, a London-listed company founded in 2011 whose early business was advertising technology. Crossrider renamed itself Kape Technologies in March 2018, and went on to buy Private Internet Access in 2019 and ExpressVPN in 2021.

The history worries some buyers because Crossrider's platform was used to build browser add-ons that security tools flag. Malwarebytes still lists Crossrider-based software as adware, typically installed through software bundlers. No regulator has found anything against CyberGhost itself, and nothing in its audits suggests the VPN does any of this. We treat the ownership as background, but it is a reason to value outside checks more than marketing. That includes reviews: in 2021 Kape bought Webselenese, a publisher of VPN review sites, and the review site vpnMentor says its rankings may take into account that Kape also owns CyberGhost.

What did Deloitte check?

Deloitte Audit in Bucharest has reviewed CyberGhost under the ISAE 3000 assurance standard in 2022, 2024 and 2025. The latest report, signed on 19 December 2025, describes the setup as of 31 October 2025: VPN servers on a RAM disk with full-disk encryption, logging turned off, and dedicated IP addresses handed out through tokens that cannot be tied to an account. Deloitte also looked at change-management and incident processes. It is a limited-assurance engagement on one date, not continuous monitoring, and it is the same kind of check that Deloitte ran for PIA in the same month.

The report is public: you accept Deloitte's disclaimer on CyberGhost's site and download it, with no account needed. Unlike PIA, CyberGhost's no-logs claim has not been tested in a published court case.

What does the app collect?

More than the strictest VPNs. Apple's label lists contact info, identifiers, usage data and diagnostics, all marked as not linked to you. Identifiers and usage data are used for CyberGhost's own advertising or marketing, and usage data also for analytics. Google Play lists your email, a user ID, purchase history, optional app interactions and diagnostics, and device or other IDs used for advertising or marketing, with nothing shared with third parties.

The privacy policy explains where some of that goes. It names Google Analytics, Mouseflow and AppsFlyer as analytics tools, uses VWO for surveys, and says anonymous app events such as connection attempts and successful connections are sent to third-party services that build aggregate statistics. It says this data never includes browsing history, traffic destinations, DNS queries or your IP address. Account data can be shared with other Kape companies inside the EU or in countries with equivalent protection.

How secure is CyberGhost?

The server side is solid: RAM-only machines, a disk encryption layer, and a paid bug bounty on YesWeHack that covers the apps, the API and the VPN servers. Its Q4 2025 report says the programme received 19 submissions that quarter, of which two were valid issues that were fixed. Rewards run from US$50 to US$1,250, which is small.

The Windows app is the weak spot. The US vulnerability database lists a SYSTEM-level privilege escalation in version 6.5 (2018), a DLL injection fixed in version 8.3.10.10015 (2023), credentials left in memory after logout in version 8.4.3 (2024), and an installer signed with the outdated SHA-1 hash (2025). These need an attacker on your computer already, and we found no breach of CyberGhost's servers or customer data. Because the apps are closed source, outsiders cannot check the code the way they can for PIA or Mullvad.

How to use CyberGhost safely

1. Keep the Windows app updated and download it only from CyberGhost's site or an official app store.
2. Turn off optional analytics in the app's settings if you do not want usage events sent.
3. Pay with cryptocurrency and use a separate email if you want less personal data in CyberGhost's records.
4. Leave the kill switch on so traffic stops if the tunnel drops.
5. Parents should know that the policy sets a minimum age of 16, even though the App Store rates the app 4+.

How we scored it

Regulatory record (90) is the strongest factor: no fine or order in 15 years, backed by three Deloitte reviews. Scams and harmful content (80) and security (78) follow, held down by an age-rating gap and repeated Windows client flaws. Privacy (76) and transparency and control (76) are the weakest, because the labels list identifiers for marketing and the analytics partners go beyond what the strictest VPNs use.