Is IPVanish safe? An audited no-logs VPN with a Five Eyes address

Privacy and jurisdiction 5.0/10 and security 4.6/10 (segment medians 2.7 and 2.1). No red flag in our data. Independent no-logs audit: ✓ Yes.

In 10 seconds

  • Independent no-logs audit: ✓ Yes
  • RAM-only servers
  • Kill switch
  • Jurisdiction in 5 Eyes

Privacy

Jurisdiction
USA, 5 Eyes
Legal entity
IPVanish (Ziff Davis company)
No-logs policy
Yes no browsing activity logged
Data retention
account data anonymized 45 days after termination; payment data with processors ≥7 years
Shared with third parties
processors (Stripe, PayPal, Adyen, analytics); within Ziff Davis group; law enforcement when legally required
Trackers on the website
Google Analytics, pixels, marketing cookies

What the privacy policy says is collected

Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.

  • Email✕ Yes
  • IP at sign-up✕ Yes
  • Connection IP✓ No
  • Session times✓ No
  • Bandwidth✕ Yes
  • Device info✕ Yes
  • App analytics✕ Yes
  • Crash reports✕ Yes

Security

Kill switch
Yes
DNS leak protection
Not stated
Open-source apps
No
Two-factor sign-in
Not stated

For hiding traffic from your ISP and hotspots, IPVanish is reasonably safe: an outside auditor has checked its claim that browsing activity goes unrecorded, and neither your connection IP nor your connection times are kept. Trust splits around identity and code. IPVanish operates as a Ziff Davis company under parent Ziff Davis, Inc., at an address on Park Avenue South in New York; sign-up requires a verified email, payments point back to you, and the apps are closed-source with no published security audit. VPNRadarLab rates it 4.1/10 overall, 30th among consumer VPNs: privacy 5.0, security 4.6, against medians of 2.7 and 2.1.

Safe against whom? Everyday threats versus legal pressure

Threat What IPVanish provides Verdict
ISP and Wi-Fi snooping WireGuard, OpenVPN (TCP/UDP), IKEv2/IPSec, kill switch Covered
A court order for your history Audited no-logs, no connection IP, no timestamps Almost nothing to hand over
A seized or inspected server RAM-only infrastructure Limited exposure
Tying a session to your identity Verified email, card or PayPal billing Identity on file
Censorship and DPI A single obfuscation mode Weak

The first three rows cover what most buyers need. If a censor or a state is your adversary, the last two matter more: the tunnels hide traffic, yet the provider knows who pays.

What the privacy policy collects, and how long it keeps it

Data item Stored? Note
Email Yes verification required, no KYC
Sign-up IP Yes billing and fraud checks
Connection IP No excluded even from app data
Session timestamps No only aggregated session lengths
Device model, OS Yes aggregated
App analytics Yes Firebase, anonymous

Nothing on that list describes what you browse. An account's data is anonymized within 45 days of closure; processors such as Stripe, PayPal and Adyen retain payment records for at least seven years. Data can reach other Ziff Davis group companies and, when law demands, law enforcement. The terms sit in the official privacy policy, last updated on 18 February 2025; the marketing site itself runs Google Analytics and ad pixels.

The audit, the New York address and Five Eyes membership

The no-logs promise rests on an independent audit, the largest single item in the privacy mark. Two public proofs are absent from the site data: no warrant canary or transparency report is published. On jurisdiction, IPVanish is registered in the USA, so US law applies to it directly, and the USA belongs to the Five Eyes intelligence-sharing circle. A subpoena reaches only what the company actually stores, and the audited policy keeps that list short.

Why privacy scores 5.0 and security 4.6, not higher

The audit, kill switch, RAM-only servers, Double Hop and a Vulnerability Disclosure Program with a bug bounty lift both marks above the medians. Privacy loses points on two fronts: the Five Eyes alliance takes the whole 2 alliance points, and sign-up costs another 2, split between the mandatory verified email (1.5) and the missing account-number login option (0.5). The unpublished canary and transparency report take a point each. Security has a different gap: outsiders cannot inspect the client code, and no audit of the apps or infrastructure appears in the site data. Documentation for DNS leak protection, two-factor sign-in and post-quantum encryption is unpublished too, worth several more points.

Android, public Wi-Fi and censored networks

On a phone hopping between airports and hotels, switch the kill switch on first: if the tunnel drops on café Wi-Fi, it cuts traffic before anything leaks. WireGuard is the sensible default; switch to OpenVPN over TCP where UDP gets blocked. Threat Protection filters ads, trackers and malware, and split tunnelling lets a banking app bypass the tunnel. Android is one of the supported platforms, and the safety picture there matches the rest: the audited policy protects you, while the closed-source apps and the absence of a published app audit apply on every platform. Against censorship the service struggles: one obfuscation mode is the only tool, without VLESS Reality, Trojan, Shadowsocks, Hysteria2, AmneziaWG or obfs4, hence the 1.9 bypass score.

Can the FBI get my browsing history from IPVanish?

A US agency can serve a legal demand, and the company complies where required, but the audited policy leaves nothing about your browsing or connection IP to surrender. Your email and payment details, though, are on file.

Is there a free or anonymous way to use IPVanish?

No free plan exists. Yearly and 2-year subscriptions carry a 30-day money-back guarantee usable as a trial; monthly plans do not. Anonymous payment is off the table: card, PayPal, Apple Pay, Google Pay, Amazon Pay and app-store billing all identify you, and crypto or cash are not accepted.

Is IPVanish safe for Android?

Android is among the supported platforms, and the safety terms are identical to the other platforms: the audited no-logs policy covers you, while the closed-source apps and the absence of a published app audit apply here too. The 4.4 Google Play rating reflects usability, not logging.

Who IPVanish is safe enough for

Pick IPVanish to keep your ISP, hotspot operator or campus network from watching: the audited no-logs policy stores no connection IP and no session timestamps, and the protocol set handles everyday protection well. Look elsewhere if the provider itself must not know you or if you face heavy censorship: the identity trail at sign-up and the lone obfuscation mode work against both. For side-by-side comparison with services whose logging is verified, see the independently audited VPN comparison; the corporate history is on the ownership page.