IVPN
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Gibraltar-incorporated VPN (IVPN Limited / ex-Privatus, founded 2009), Cure53-audited no-logs, open-source apps, independent ownership.
IVPN is a European service hosted in Gibraltar, with at most minor, transient US exposure under the CLOUD Act. It is listed under VPN.
Assessment notes
IVPN Limited (formerly Privatus Limited) is a Gibraltar-incorporated VPN provider founded in 2009 by Nicholas Pestell (independent, no parent company, no PE/VC funding, no other VPN brands owned) with a Cure53-audited no-logs policy (three independent audits + a comprehensive pentest), open-source apps, public transparency reports, and Gibraltar jurisdiction explicitly outside the 5/9/14 Eyes intelligence-sharing alliance. No CLOUD Act exposure; independent ownership with no US ties. The one gap in the signal set: IVPN does not publish a publicly accessible DPA. Only a privacy policy is available, with no processor agreement for EU buyers to self-serve.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: No
-
EU / adequacy operator: No
-
No US CLOUD Act exposure: Yes
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About IVPN
IVPN is a Gibraltar-incorporated privacy-focused VPN operated by IVPN Limited (formerly Privatus Limited), founded in 2009 by Nicholas Pestell. The company is independent: no parent company, no private-equity or venture-capital ownership, no other VPN brands operated, a structural rarity in a category dominated by conglomerated VPN consolidators (Kape Technologies, NordVPN parent group, etc.). Gibraltar is a British Overseas Territory that maintains GDPR alignment with the EU framework but explicitly sits outside the 5/9/14 Eyes intelligence-sharing alliance, which is the headline jurisdictional advantage IVPN markets to its target audience.
Compliance and privacy posture are gold-standard. The no-logs policy has been independently audited by Cure53 (the German cybersecurity firm) three separate times, alongside a comprehensive pentest of apps and infrastructure. IVPN publishes transparency reports on law-enforcement requests, runs all apps as open-source, and is one of only two VPN providers (alongside Proton VPN) on most "best for privacy" 2026 shortlists with both open-source apps AND annual third-party audits. The privacy policy is straightforward: no activity logs, no connection logs, no DNS query logs, no IP-address logs, no timestamp logs. Tor-over-IVPN and multi-hop modes are supported.
Pricing is direct and trial-friendly: Standard plan around US$6/month (€5–6 equivalent); a 7-day trial is available; cards plus Bitcoin and Monero accepted. No free tier. Best fit: privacy-maximalist EU and worldwide users who want a Cure53-audited no-logs guarantee under a Gibraltar-Outside-Eyes jurisdiction, journalists, researchers, and anyone valuing independent ownership over feature-bloated marketing. The smaller server fleet vs Proton VPN means slightly lower geo-coverage and streaming-unblock breadth, which is the trade-off for the structurally cleaner posture.
Sub-processor map · none disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of IVPN
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Italy · €7/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Sweden · €3.75/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Romania · €2.19/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
AirVPN
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
€7/mo |
AzireVPN
Sweden
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
€3.75/mo |
CyberGhost
Romania
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€2.19/mo |