Is PureVPN safe? The KPMG no-logs audit, BVI law and what it still collects

For most people, yes: PureVPN is legit enough to trust with everyday traffic. The no-logs promise has passed an independent KPMG audit, GZ Systems Limited is registered in the British Virgin Islands, which sits outside the 5, 9 and 14 Eyes alliances, and the policy leaves the connecting IP unrecorded. Privacy scores 5.7 out of 10 against a consumer median of 2.7. Security is weaker at 4.3, since PureVPN publishes no security audit and states neither open-source apps, RAM-only servers nor two-factor sign-in.

GZ Systems and the BVI: who holds your PureVPN data

The service belongs to GZ Systems Limited, registered in Road Town, Tortola; the group also runs PureDome and the PureKeep password manager, with GZT Associates Ltd in Cyprus. The owner page covers that side in depth. Jurisdiction matters here: the BVI is outside the 5, 9 and 14 Eyes arrangements, which earns the full two alliance points, and PureVPN ranks first of six BVI-registered providers on VPNRadarLab. The privacy policy is explicit that data can be disclosed when compelled by binding law or a court order, so the real safety question is how little it holds.

The KPMG audit behind the no-logs claim, and the points still missing

An auditor checking that the no-logs wording matches how the servers actually behave is the heaviest single item in a privacy score, and PureVPN takes all three points for it. Note the scope: KPMG verified the logging claim, not the app code. The gaps sit around it. There is no warrant canary (recorded as a definite no), and nothing in the site data shows a transparency report or a real-world case that tested the claim. Each of those costs exactly one point. If an independently audited no-logs policy is your baseline, compare it with the audited no-logs VPN list.

What the privacy policy collects and for how long

Nothing in that table reveals which sites you visited, and the absent source IP is what breaks the link between a VPN session and your home address. The kept connection date costs the timestamp point. Retention: account data while you subscribe, email until you ask for deletion, WireGuard fixed-IP data for 24 hours. Fourteen named processors appear in the current privacy policy, from Google Analytics and Intercom to Zendesk and Twilio, and it states data is not sold (last updated 25 February 2026). Trackers like Facebook Pixel and Mixpanel sit on purevpn.com itself, watching the shop, never the tunnel.

Why security stops at 4.3

The missing points come from what the company does not publish: no stated security audit, open-source clients, bug bounty, RAM-only infrastructure or two-factor login. Without a stated 2FA option, one stolen password exposes the whole account. The working parts are real: a kill switch that cuts traffic when the tunnel drops on public Wi-Fi, DNS leak protection that keeps lookups inside the tunnel, WireGuard plus OpenVPN and IKEv2 as fallbacks, post-quantum encryption on quantum-resistant servers, and obfuscated servers that disguise traffic as HTTPS. That obfuscation is the sole bypass feature counted, which is why censorship bypass lands at 1.9, with no VLESS Reality, Trojan or Hysteria2 stated anywhere. Overall that makes 5.3 of 10: 7th in the main ranking and 7th among consumer VPNs, no red flag in the site data.

Sign-up and checkout: how much of your identity is on the table

An email is mandatory, which links the account, not your VPN sessions, to a mailbox; the policy logs no connection IP. A phone number is not required, though the policy mentions Twilio SMS verification, and there is no KYC. Bitcoin and other coins through CoinPayments keep your card out of it, but crypto purchases, along with App Store and Google Play orders, lose the 31-day money-back guarantee. Renewals and trial-based renewals are non-refundable too, and auto-renewal is on by default, with the Standard plan starting at $2.15 a month and renewing at $47.95 a year.

PureVPN safety questions

Can PureVPN see the sites I visit?

The policy says browsing activity and your source IP go unlogged, and the KPMG check backs that claim.

Would PureVPN hand data to police?

Data can be disclosed when compelled by binding law or a court order, and then it is the account data PureVPN actually stores.

Is PureVPN safe for torrenting?

Yes, but only on the dedicated P2P servers; file sharing elsewhere breaches the terms.

Will it work on networks that block VPNs?

Sometimes. Obfuscated servers pass for HTTPS traffic, but PureVPN states none of the newer stealth protocols, hence the 1.9.

What should I watch for on the 7-day trial?

It converts to a paid plan automatically, and that renewal cannot be refunded.

Who can trust PureVPN with their traffic

Choose PureVPN when you want an independently audited no-logs service in a non-alliance jurisdiction at a low starting price, ten devices at once and a 6000-server network across 65+ countries. Look elsewhere if you need open-source clients, 2FA or reliable censorship bypass.