Private Internet Access

Is Private Internet Access safe?

Yes. Private Internet Access, usually called PIA, is one of the few VPNs whose no-logs claim has been tested by US law enforcement and not just by auditors. When the FBI subpoenaed it in 2016 and again in a 2018 federal trial, the company had nothing that could tie an IP address to a customer. Its apps are open source, its servers run from RAM, and Apple's privacy label lists only contact details that are not linked to you. We score it 83/100.

That puts it ahead of its sister brands ExpressVPN (79) and CyberGhost, and of NordVPN (79), but behind Proton VPN (88) and Mullvad. The points it loses come from a long list of older desktop-app flaws, a bug bounty that pays little, and a US base that brings a steady stream of subpoenas.

What did the court cases show?

The first test came in March 2016. An FBI criminal complaint against a man accused of making false bomb threats traced his emails, Facebook and Twitter activity to IP addresses belonging to London Trust Media, PIA's owner at the time. A subpoena to the company produced only one fact, according to the complaint: the cluster of addresses was on the east coast of the United States.

The second came in 2018, at a hacking trial in federal court in San Jose. The FBI had linked access to a news company's email accounts to PIA addresses. London Trust Media's general counsel testified that PIA keeps no logs of customers' activity, that the only thing it holds is the sign-up email, and that neither of the defendant's known emails appeared in its records.

Two cases are not proof forever, and they are now eight and ten years old. PIA's quarterly transparency report fills in the present. For April to June 2026 it lists 4 subpoenas, 2 warrants, 7 other government or civil requests and 6 foreign or informal ones, with zero logs produced.

What did Deloitte check?

Deloitte Audit in Bucharest has reviewed PIA three times, in 2022, 2024 and 2025, under the ISAE 3000 assurance standard. The latest report, signed on 19 December 2025, describes the setup as of 31 October 2025. VPN services run in short-lived containers on a RAM disk with full-disk encryption, logging is switched off at container and service level, and dedicated IP addresses are handed out through tokens that are never tied to an account on the server side. Deloitte inspected server configurations and the change-management and incident processes on a sample basis and reported nothing that contradicted the description.

This is a limited-assurance engagement, the same kind KPMG and Deloitte do for other big VPNs. It shows the system was built as described on one date; it does not watch the servers all year. Anyone can download the report after accepting Deloitte's disclaimer, without a PIA account.

How much does the app collect?

Very little, and the labels and the policy mostly agree. Apple's label lists contact info, not linked to your identity, used for app functions and PIA's own marketing, and no tracking. Google Play lists your email and a user ID for account management and optional crash logs, with nothing shared with third parties.

The privacy policy, last revised in November 2025, says PIA needs an email address and a payment to open an account. US buyers also give a state and ZIP code for sales tax, and PIA pays the tax itself for crypto payments so those buyers can stay anonymous. Connection events and debugging data are sent only if you opt in to reports. Marketing emails are also opt-in, and the list is run by outside mailing partners. Personal data is stored mainly in the US and may be shared inside the Kape group.

How secure is PIA?

The design is sound. Since 2018 the desktop and mobile apps have been open source, and PIA's GitHub repositories were still being updated in October 2026. Servers run from RAM, so a reboot or a seizure leaves no stored data. PIA supports WireGuard and OpenVPN and offers a kill switch.

The weaker part is the client track record. The US vulnerability database lists about a dozen PIA app flaws, including nine local privilege-escalation bugs in the Windows, macOS and Linux clients disclosed in 2019, a 2020 bug that let traffic bypass the Linux kill switch, and an unquoted service path in Windows version 3.3 published in January 2026. None of these was a remote attack on PIA's network, and we found no breach of servers or customer data. PIA's bug bounty on YesWeHack pays US$50 to US$1,250, well below what Proton VPN or ExpressVPN offer.

How to use PIA safely

1. Keep the desktop app updated; most of the listed flaws affected old Windows, Mac and Linux builds.
2. Pay with cryptocurrency and use a separate email address if you do not want your name in PIA's payment records.
3. Leave connection reports switched off unless you are troubleshooting.
4. Turn on the kill switch and MACE, which blocks ads, trackers and known malicious domains.
5. Remember that a VPN does not protect you from phishing or from sites you log in to.

How we scored it

Regulatory record (90) is the strongest factor: no fines or orders in about 17 years, and a no-logs claim tested in court and by audit. Privacy (86) reflects a near-empty App Store label and opt-in analytics. Security (80) is held down by repeated client flaws and a small bug bounty despite open-source apps and RAM-only servers. Scams and harmful content (80) loses two points because the App Store rates the app 4+ while the terms bar under-13s.