IPVanish

Is IPVanish safe?

Mostly, yes, though it is not one of the strongest VPNs we have scored. IPVanish, now owned by the US media group Ziff Davis, has had its no-logs claim checked by two outside firms, in 2022 and 2025, and is moving its servers to RAM-only machines. Its weak points are a privacy label that ties your email to you for marketing, closed-source apps, no paid bug bounty and a past it cannot shake: in 2016, under a previous owner, it handed US agents records that identified a user. We score it 77/100.

That puts it just behind ExpressVPN, CyberGhost and Surfshark (all 79), and well behind Private Internet Access (83), whose no-logs claim held up when the FBI asked.

What happened in the 2016 Homeland Security case?

In May 2016 a Homeland Security agent working undercover in an IRC chat traced links to child abuse images to an IP address owned by Highwinds, the company that then ran IPVanish. Highwinds first replied that it did not log usage and had nothing on that address. After a second, more specific summons in June 2016, it supplied the user's name and email, his real Comcast IP address and the times he connected to the VPN, joined the IRC server and disconnected. Agents found the man at his parents' home in Indiana, and he later admitted the conduct.

The court papers, reported by TorrentFreak in May 2018, contradicted IPVanish's long-standing zero-logs promise. StackPath, which had bought Highwinds and IPVanish in February 2017, said the people involved had left and that its own due diligence found no logs or logging systems. IPVanish has since changed hands again and now sits inside Ziff Davis.

The case is more than ten years old and the company has changed owners twice since, so it does not lower a factor score under our rules. It is still the reason the later audits matter.

What do the audits show?

Leviathan Security Group reviewed IPVanish in 2022. Schellman Compliance followed with an audit completed on 21 February 2025, which IPVanish says included access to systems and staff, a review of server configurations and simulated traffic to look for logging. According to IPVanish, the auditors found no records of browsing, DNS queries, connection times or original IP addresses, and abuse detection ran in memory only. Changes to logging settings need two approvals.

The catch is access. Neither report is public: customers can download them from the account portal, and journalists can ask for a copy. Proton VPN and Mullvad publish theirs for anyone, which is why IPVanish's regulatory and control scores stay a little lower despite a clean regulator record.

How much does the app collect?

More than the best VPNs. Apple's label lists your email address and user ID as linked to you and used for IPVanish's own advertising or marketing, plus product interaction, crash and performance data that is not linked to you. Google Play goes further: it says the app shares a device ID with other companies for app functions, advertising or marketing and fraud prevention.

The privacy policy fills in the rest. Buying a plan collects your email, name, billing address, card details, IP address and affiliate tracking data. The app sends usage analytics through Firebase, including device model, country, session length, server and protocol. Every new subscriber receives promotional emails until they unsubscribe. On the other side, account data is anonymised 45 days after the account ends, and diagnostic connection logs stay on your device unless you send them to support.

How secure is IPVanish?

The basics are in place. IPVanish began moving to RAM-only servers in August 2025 and says more than 870 servers in 26 cities now run that way, with the whole fleet due in 2027; older servers use full-disk encryption. Its Android app has passed Google Play's independent security review. The US vulnerability database lists just one client flaw, a 2018 bug that let a local user gain root on macOS.

What it lacks is outside scrutiny of the code. The apps are closed source, and Ziff Davis's disclosure program on HackerOne says plainly that it offers no money for reports. Windscribe and PIA both pay, and their code is public.

How to use IPVanish safely

1. Pick RAM-only locations in the app's server list where you can; they are marked and filterable.
2. Unsubscribe from promotional emails in the first message you get, and use a separate email address if you want less tying you to the account.
3. Pay through the App Store or Google Play if you prefer your card details to stay with Apple or Google.
4. Leave diagnostic logs off unless support asks for them, and strip personal details before you send a file.

How we scored it

Regulatory record (88) is the strongest factor, with no regulator fine or order on record. Privacy (76) and security (76) are held down by marketing use of your email and device ID, closed-source apps and the lack of a bug bounty. Transparency and control (74) is the weakest, because the audit reports are not public and promotional emails are on by default.