PureVPN

A long-running, budget-priced VPN with a large server network and repeated independent no-logs audits, shadowed by a 2017 case in which it handed connection-correlation data to the FBI.

www.purevpn.com ↗

⚠ Not scored

⚠ Documented concerns

We don't give PureVPN an overall score. A proven logging breach, or an ownership history in adware or surveillance, is not something a good feature list should be able to average away. The data below is still shown in full so you can judge it yourself.

2017: Provided records that helped identify a user
In the FBI complaint against Ryan Lin, the sworn affidavit states that PureVPN was able to determine its service had been accessed by the same customer from two originating IP addresses, the home Lin was living in at the time and the software company where he was employed at the time. That let investigators correlate its records with third-party logs.
Source ↗
2017: Advertised no logs while retaining originating IPs
PureVPN marketed a no-logs service and its policy stated it kept no record of user activity, while a separate clause disclosed that connection times and bandwidth were recorded. Neither clause disclosed retention of the originating IP addresses that enabled the identification. PureVPN responded that it had not breached its policy and that browsing logs were never stored or shared.
Source ↗

What counts in their favour

Only connection metadata was implicated. The affidavit does not show that browsing content or destination logs were handed over.
PureVPN moved from a zero browsing logs policy to a zero user logs policy in May 2018, dropping exactly the originating IP and timestamp data at issue in this case.
A first independent no-logs audit by Altius IT in 2019 reported no configurations or log files that could identify a person or their activity.
KPMG has run recurring no-logs audits since 2021, under an arrangement allowing unannounced inspection.
The company moved its base from Hong Kong to the British Virgin Islands in 2021.
It now publishes a trust centre citing consecutive no-logs audits, ISO 27001 certification and a warrant canary.

Listing a concern is a statement about the documented record, not a claim about how the service behaves today. Where a provider has since changed owner, jurisdiction or policy, that is noted above and in the report below.

Jurisdiction: British Virgin Islands
Founded: 2007
Owner: GZ Systems Ltd.
Best price: $1.99/mo
Devices: 10
Free tier: No

No category scores are shown for PureVPN because of the documented concerns above. Every individual data point is still published below, so you can weigh the record yourself.

Best for

· Budget-conscious users who want a cheap long-term VPN for streaming and general privacy
· People who value a large server footprint across many countries
· Users comfortable with audited-but-not-court-tested no-log claims

Not ideal for

· High-risk users (journalists, activists, whistleblowers) who need a provably court-tested no-log provider
· Anyone who weighs the 2017 logging incident as a dealbreaker
· Users requiring fully open-source clients or verified RAM-only infrastructure

Strengths

✓Large network (~6,500 servers across ~78 countries) with low long-term pricing (~$1.99/mo on the 5-year plan)
✓Four consecutive independent no-logs audits, including a KPMG 'always-on' arrangement permitting unannounced inspections
✓Solid feature set: WireGuard/OpenVPN/IKEv2, kill switch, obfuscated servers, own encrypted DNS, split tunneling
✓Accepts cryptocurrency and offers a 31-day money-back guarantee

Weaknesses

✗2017 FBI case proved it logged and handed over connection-correlation data while claiming 'no logs', a lasting trust mark
✗BVI HQ but development/staff historically tied to Gaditek in Karachi, Pakistan; some users distrust the operational footprint
✗Several privacy features (port forwarding, dedicated IP) are paid add-ons, not included
✗No free tier and only a paid $0.99 7-day trial; RAM-only servers and multihop not clearly documented; the most recent (2023) audit firm was not named

Protocols & encryption

The tunnelling protocols this service offers and the cryptography behind them.

WireGuard

Modern

A modern, lean protocol (~4,000 lines of code) that is fast and easy to audit. Its cryptography is fixed and state-of-the-art, with no weak options to misconfigure.

Data cipher: ChaCha20-Poly1305
Key exchange: Curve25519 (ECDH)
Integrity: BLAKE2s

OpenVPN

Trusted

The mature, widely-trusted open-source standard. Flexible and heavily audited over two decades, though slower than WireGuard.

Data cipher: AES-256-GCM
Key exchange: RSA-4096 / ECDH
Integrity: SHA-256 / SHA-512 HMAC

IKEv2 / IPsec

Trusted

A fast, stable protocol that reconnects quickly when you change networks, so it is popular on mobile. Built natively into most operating systems.

Data cipher: AES-256-GCM
Key exchange: Diffie-Hellman (ECP)
Integrity: SHA-256 / SHA-384

Also offers legacy protocols. PPTP, L2TP, which are outdated and best avoided.

This provider's setup

Stated data cipher: AES-256-GCM
Stated handshake: RSA/ECDH (OpenVPN, IKEv2, WireGuard); markets 'quantum-resistant' keys
Perfect forward secrecy: Yes
Post-quantum resistant: Yes
RAM-only servers: Unknown
Kill switch: Yes
First-party DNS (leak protection): Yes
IPv6: Unknown

Post-quantum: Quantum-resistant encryption keys generated via Quantinuum's Quantum Origin platform, deployed with OpenVPN in the Windows/Mac/iOS/Android apps. Limited to servers in US, UK, Australia, Canada, Germany, Netherlands. Note: this is quantum-verified key generation, not a post-quantum KEM (no ML-KEM/Kyber yet); PureVPN says NIST-approved PQ algorithms are still pending.

Full data sheet

Every attribute we track, coloured by whether it helps or hurts your privacy.

Company & jurisdiction

Based in	British Virgin Islands
Eyes alliance	Outside 5/9/14 Eyes
Enemy of the Internet	No
Owner	GZ Systems Ltd.
Conglomerate	PureSquare
Founded	2007

Logging

Traffic / activity	None kept
DNS requests	None kept
Timestamps	None kept
Bandwidth	None kept
Source IP address	None kept

Privacy policy claims no logging of traffic, DNS/browsing, originating IP, assigned VPN IP, or connection timestamps. These claims have been the subject of four consecutive independent no-log assessments: Altius IT (2019) and subsequent audits by KPMG (first KPMG audit 2021, under a first-of-its-kind 'always-on' clause permitting unannounced inspections), plus a fourth assessment conducted Feb-Apr 2023 (PureVPN's own announcements attribute the 2023 audit to 'a top audit firm' without naming it). The 2023 report did flag that some legacy protocols had briefly retained origin IPs in failed-connection error logs and some timestamps, which PureVPN says were remediated. Importantly, the 2017 Ryan Lin case predates this no-log re-architecture, when PureVPN retained and disclosed connection-correlation data.

Payment & anonymity

Anonymous signup	No
Accepts cash	Unknown
Accepts crypto	Yes
PGP key	Unknown

Protocols & features

OpenVPN	Yes
WireGuard	Yes
Proprietary protocol	n/a
Multi-hop	Unknown
Obfuscation	Yes
Kill switch	Yes
First-party DNS	Yes
RAM-only servers	Unknown
Port forwarding	Yes
P2P / torrenting	Yes
IPv6	Unknown

Encryption

Data cipher	AES-256-GCM
Handshake	RSA/ECDH (OpenVPN, IKEv2, WireGuard); markets 'quantum-resistant' keys

Transparency

Open-source clients	No
Independent audits	3
Transparency report	Yes
Court / seizure-tested	Untested

Failed in 2017: in the FBI cyberstalking case against Ryan Lin, PureVPN provided connection records that let investigators determine the service had been accessed by the same customer from two originating IP addresses (corresponding to his home and work), contradicting its no-logs marketing at the time. The company subsequently rewrote its policy and commissioned independent audits, but no post-2017 server seizure/subpoena has been documented to test the new no-log architecture under real-world legal pressure.

Infrastructure

Simultaneous devices	10
Countries	78
Servers	6500
Linux support	GUI app

Pricing

Month-to-month	$12.95
Best $/mo	$1.99
On plan	5-year (Standard)
Free trial	None
Refund window	31 days
Free tier	No

Ethics

Logging policy	Contradictory
Marketing honesty	Overclaims

Independent audits

Altius IT· 2019 · First independent no-logs audit; found no system configurations or log files that could independently or collectively identify a specific person.report ↗
KPMG· 2021 · First KPMG no-logs audit under PureVPN's 'always-on' arrangement, which permits surprise/unannounced inspections of infrastructure, server configs, and logs at any time.report ↗
Undisclosed ('top audit firm')· 2023 · Fourth consecutive no-log assessment (conducted Feb-Apr 2023); 'Technical Privacy Assessment Report' concluded all protocols across locations were compliant with the no-log policy. PureVPN did not publicly name the firm for this audit.report ↗

Corporate identity GZ Systems Ltd. operates under the PureSquare (Pure²) brand umbrella (brand identity unveiled Nov 2022; PureSquare ONE-platform/parent-brand launch Feb 2023), which also covers PureKeep, PurePrivacy, PureEncrypt, PureDome, and PureWL. Operationally the group is tied to Gaditek in Karachi, Pakistan. HQ relocated from Hong Kong to the British Virgin Islands in November 2021 for a privacy-favorable jurisdiction with no mandatory data-retention laws. BVI is not a member of any Five/Nine/Fourteen Eyes intelligence alliance. Pricing tiers are Standard/Plus/Max; figures above are the Standard tier; the cheapest genuine rate is the 5-year Standard plan (~$1.99/mo), with the 2-year Standard at ~$2.15/mo. P2P is restricted to designated servers (excludes US/UK/CA/AU). The $0.99 7-day trial is a paid trial, not a free tier. NOTE ON AUDITS: there have been four consecutive no-log assessments (Altius IT 2019; KPMG 2021; a fourth Feb-Apr 2023 by an unnamed 'top audit firm'); the DRAFT's claim of an 'Altius IT 2024 renewal' and a 'new' Dec 2025 KPMG audit could not be substantiated, the Dec 2025 KPMG blog re-publicizes earlier KPMG audit content.

Sources

Last verified 2026-06-17. Point-in-time data, so always confirm on the provider's own site.