Is CyberGhost VPN safe? Romanian law, Kape Technologies and the audit gap

For everyday privacy, CyberGhost is safe enough on paper. The operator is CyberGhost S.R.L., a Romanian company answering to EU data protection rules, and its privacy policy keeps no connection IP and no session timestamps. VPNRadarLab scores it 4.18 of 10 overall, ranks it 24th among consumer VPNs, and records no red flag. The one clear gap: no independent no-logs audit has been published. The certificates on file cover the company's security management, not what its servers store.

Who owns CyberGhost and which law applies

The service runs under CyberGhost S.R.L., registered in Bucharest, and belongs to Kape Technologies PLC, the group that also holds ExpressVPN, Private Internet Access and ZenMate. Romania sits outside the 5, 9 and 14 Eyes, so treaty-based intelligence sharing is not a default channel for the data.

A court order is a different route: the policy states plainly that data is disclosed when the law or a judge requires it. The only real shield is how little the policy says is stored. There is a transparency report linked in the site footer, but no warrant canary.

What the policy admits to collecting

No connection IP plus no session times leaves little to tie a tunnel session to your account. The counterweight: the email and the anonymised sign-up IP do tie the subscription to whatever identity you provide.

Two caveats. First, retention: account data is kept "as long as needed" for service or legal reasons, with no fixed period; the privacy policy was last updated on 18 March 2024. Second, recipients: payment processors, support and analytics tools, and the Kape group itself. The trackers on the CyberGhost website see visits to the site, not the traffic inside the VPN tunnel.

Sign-up needs an email but no phone and no ID check; Bitcoin via BitPay is named in the policy yet not shown at checkout, so paying anonymously is harder than the policy suggests.

ISO certificates without a no-logs audit

The independent verification on record is ISO 27001 and ISO 9001 certification by QSCert, held since 2012 and renewed yearly. That kind of audit looks at how the company manages security internally, not at what servers record, which is what a no-logs claim rests on. CyberGhost publishes no independent audit of the no-logs claim, and the site data records no court case or incident that confirmed it. This missing audit is the heaviest single item in the scoring, worth 3 privacy points.

Protocols and leak protection

On hotel or café Wi-Fi the kill switch is what stops the leak when the tunnel drops: traffic gets cut before your real IP escapes. DNS leak protection keeps lookups inside the tunnel rather than at your ISP's resolver. What a seized server would still hold stays an open question as long as RAM-only operation is not published.

Where the two 5.0 marks lose their points

Privacy scores 5.0 of 10 (7.5 of 15 points) against a consumer median of 2.7; security is 5.0 of 10 (7 of 14 points) against a median of 2.1. The jurisdiction outside the alliances, the thin logging policy and the transparency report earn most of the marks. The losses are specific: the missing audit on the privacy side, plus the email-mandatory sign-up without account-number login. Bypassing censorship scores 0 of 10, because CyberGhost publishes no stealth or obfuscation mode.

Red flags and weak spots in the record

No red flag or public breach appears in the site data. The concerns are quieter: data shared across the Kape group, trackers on the website, and the open-ended retention wording. For readers who need an independently checked claim, VPNRadarLab ranks VPNs with an independent no-logs audit. On networks with strict DPI filtering, CyberGhost is a weak pick; the full Romania comparison lives on VPNRadarLab's page for VPN providers registered in Romania, where it ranks first of five.

CyberGhost safety questions

Is CyberGhost legit?

Yes: a registered Romanian company under GDPR, with a named data protection officer in the policy. Legit and independently audited are different things, though.

Is CyberGhost safe on an iPhone?

The iOS app is covered by the same privacy policy, and the site data does not break down protections by platform.

Is there a free CyberGhost plan?

No. Instead there is a money-back window: 45 days on plans of six months and longer, 14 days on the monthly plan, store purchases excluded. Store ratings do not affect the safety picture.

Can CyberGhost get through a network that blocks VPNs?

Unlikely. With no obfuscation published, deep packet inspection will spot the standard protocols.

Verdict for different users

Take CyberGhost for public Wi-Fi protection, torrenting and routine browsing: the jurisdiction, the thin logging policy and the kill switch cover that use case. Skip it when you require an audited no-logs claim, double VPN routing, or a connection that survives DPI blocks.