IVPN vs Windscribe

The August 2026 incident. In August 2026 an attacker exploited a vulnerability in the self-hosted BTCPay Server, before it was public, and took IVPN's own Lightning operating funds. IVPN published the account four days later, unprompted, and scoped it to that machine: the VPN gateways were not involved, no customer records were reached, no customer money was lost.

Why it costs nothing. The model charges nothing for this, which is the point — an operator that says so promptly is behaving the way the field is meant to reward, and the entry is here so a reader knows it happened rather than to move a number.

What the engagements covered. The app pentest (iOS, Android, Electron, the daemon) is from March 2022 and the gateway/server-OS review from February 2023; neither tested the no-logs claim itself, the 2023 report says so explicitly, so retention rests on the privacy policy declaration alone.

The latest report is not the relevant one. April 2024's engagement, Cure53's sixth with IVPN, tested the customer account website, API and hosting; its own scope page names client apps and VPN servers out of scope, so it extends neither the app nor the gateway evidence, and V03_audit_subject reads unknown for it rather than carrying that credit forward. The seventh engagement, on the new email and DNS services, was only announced for May 2025; no report for it is published.

What the primary site never establishes. RAM-only is recorded as partial because IVPN describes it as a transition with test deployments under way, and has not announced its completion. Server hardware ownership (leased vs owned), traffic modification at the exit, and the beneficial owner's personal jurisdiction are unestablished: no primary IVPN page states any of the three, nor does user-base scale.

Three fields the knowledgebase answers, not the pages read at first fill. IP allocation is shared by design — "crowding" pools users on one address to blunt attribution. P2P is allowed everywhere, but IVPN asks customers to avoid US exits, citing upstream DMCA pressure. Streaming carries no guarantee, though the company says many customers do reach it.

Why retention is priced on the finding. Retention is therefore priced on what an auditor demonstrated was reachable rather than on what the policy declares, and the integrity channel carries the distance between the two. Read that as a two-year-old finding on one node, not as a current measurement: the scope was ca-023.windscribe.com alone, and a newer engagement covering more of the fleet is what would settle it.

The list that was never read. The offered country list was never read, so neither the usability country score nor the mandate intersection can be computed — Windscribe publishes a physical/virtual distinction, which makes C09b answerable here as soon as the list is. User scale is also unestablished, which leaves the exposure band resting on less than it should.

Where the three events now cite from. AIN.UA still carries the Ukrainian servers taken on 24 June 2021, and Windscribe's own blog the Greek case dismissed on 11 April 2025. The Dutch seizure and the seizure field itself now cite Windscribe's own no-logs page rather than the affiliate-paid press that first reported it: a company account of its own seizure is primary, not somebody else's account of one. The Ukrainian event is dated to the seizure itself, not the write-up.