From the start of IVPN, almost 10 years ago, we engineered our systems to not log any data that could be tied to an individual user account. Until now our customers had no way to verify this but today we’re proud to announce the results of an independent audit conducted by Cure53.

Below is an excerpt from the conclusion (Download the full unredacted report from Cure53’s website)

“To conclude this Cure53 audit and verification of the IVPN privacy-related claims yielded very positive results. The outcomes of this March 2019 audit, paired with fluent communications as well as the general handling of every aspect discussed during the assessment, attest to the considerable dedication to privacy matters at the IVPN project. Based on the findings, it is safe to say that all of the IVPN’s privacy statements could be verified as truthful within the defined scope. The requirements for both general security claims to be considered appropriate were successfully well met for all VPN gateways.”

The scope of the audit was to verify the no-logging claims made in our privacy policy and included all IVPN systems that are involved in serving a customers VPN connection, including the VPN gateway servers and authentication servers. A total of 3 auditors spent 7 days performing the audit during March 2019. 

When we setup IVPN and configured the our systems not to log, it required a lot more than directing logs to the null device. We have a complex configuration of scripts that set up and tear down dynamic configurations for port forwarding, multi-hop etc. These scripts communicate and store state information without persisting any data to disk, one of many design decisions we’ve made as a security-focused company. 

Cure53 was able to identify only one issue which they classified as ‘low’ impact and which they said “does not negatively impact this conclusion”. The issue was that our DNS servers temporarily cache their responses to improve performance however none of this data is related to a customer IP address or user account in any way and is only stored temporarily until the cache timeout. This means that if an adversary had access to a DNS server they could see what domains had been recently resolved but not which customer IP had sent the request. Regardless we decided to disable the caching so this issue has been fully mitigated. 

We expect this report to provide another strong signal that we take our customers privacy and security very seriously and are dedicated to being as transparent as possible. If you have any questions relating to this audit please do not hesitate to contact us.

VPN services, like IVPN, exist to protect the privacy of their customers. The focus of this mission is to stop ISP’s, governments or other potential adversaries snooping on your activities and using the information gathered for their benefit.

We believe this list should also include corporations that collect data on you through uninvited, unconsented and unknowable ways. The list starts with Facebook and Google, but does not end there; many services rely on revenue from targeting ads based on behavioral data harvested from your activities.

VPNs alone can’t make you completely invisible to all these threats; encrypting your traffic and masking your IP is just a part of the solution. There are two specific things a VPN provider could do, however, to fight this problem:

In November 2009, almost 10 years ago IVPN was launched. We knew that in order to become the most trusted provider we had to demonstrate our security expertise and execute flawlessly and consistently over many years. On day one we launched a full mesh multi-hop network using Linux policy based routing with all VPN gateways passing strict CIS benchmark compliance, an industry first. In January 2015 we introduced the IVPN firewall which is integrated deep into the OS using Microsoft’s WFP API and independent from the app itself. Even if the app crashed we could guarantee no data leaks. In September 2016 we took a strong stance against corrupt ‘pay for play’ affiliates. In the past few years we have launched dozens of new features specifically to improve our customer’s security. Today we are more excited than ever to launch what we believe is the future of VPN technology, WireGuard!

Continue »

We’ve recently released new versions of our desktop and Android apps with a new ‘Pause VPN’ feature. Based on feedback from customers, we discovered that some were disconnecting temporarily from the VPN in order to connect to various services that were blocked whilst connected e.g. some payment gateways etc. When disconnected these customers were sometimes forgetting to reconnect after completing their task, leaving them in an insecure state until they remembered to manually reconnect. This could be hours or more, representing a serious privacy threat. Whilst being disconnected for even a few seconds is unacceptable for many of our hardcore privacy customers (who we don’t expect to use this feature) we felt it was important to mitigate the risk of being left insecure for those who want to disconnect and understand the risk of doing so.
Continue »

Today we’re releasing a new ‘trusted Wi-Fi networks’ feature for our desktop and Android apps. Some customers have different security requirements depending on whether they trust the specific Wi-Fi network they are connected to or not. For example, customers who use our VPN exclusively for Wi-Fi security often only want to be connected to the VPN when they are on untrusted networks e.g. public hotspot. Ideally they would like the VPN client to automatically establish a connection on networks they don’t trust and disconnect on those they do. Another use case is customers who use the VPN for privacy but who have VPN routers on trusted networks they connect to – in this case they don’t want to connect whilst connected to this network or they would establish nested VPN tunnels which perform very poorly.
Continue »

In late March, the US Clarifying Lawful Overseas Use of Data Act (CLOUD Act) took effect. And predictably, the US Supreme Court just dismissed United States v. Microsoft Corp. In that case, Microsoft was fighting a subpoena for data stored in an Irish data center. And now its objection is moot, because the CLOUD Act stipulates:

A [service provider] shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.

This is bad news, for sure. But it’s no surprise, in the current environment. With all those terrorists and criminals to worry about. And when it’s the feds vs Microsoft, Congress can just change the law. And this is obviously not just about the US. Russia demanded access to encrypted Telegram messages, Telegram refused, and now Russia has blocked Telegram, plus many other services and websites that rely on Google and Amazon hosting.

Continue »