Is CyberGhost Safe? Security, Privacy and Audit Questions

Jurisdiction is the first question, not the speed

A VPN's legal home determines what it can be compelled to do. That is a structural fact about the company, and unlike speed it does not vary by your connection.

CyberGhost is a Romanian company. Romania is inside the EU, which brings GDPR obligations, and it is not a member of the intelligence-sharing arrangements commonly listed as Five, Nine or Fourteen Eyes. Romanian courts have also historically declined to enforce blanket data-retention rules that were struck down at EU level.

What that gives you is a legal environment with no standing obligation to retain connection logs. What it does not give you is immunity from a lawful order in a specific case. No jurisdiction does, and any provider implying otherwise is overselling.

It is worth separating two things that marketing routinely merges. Jurisdiction decides what a company can be asked for. Architecture decides what it can produce. A provider in a friendly country that keeps records is a worse bet than a provider in an unfriendly one that keeps none, which is why the audit question below matters more than the flag on the website. Our no-logs policy guide covers what such a claim can and cannot be worth.

What the audit actually says, checked at source

Every provider says it keeps no logs. The claim is only worth what the evidence behind it is worth, and there are three grades:

• Marketing only. A page saying no logs are kept. Unverifiable and common.
• An independent audit. A third party examines the systems and publishes findings. Meaningfully better, with real limits.
• A tested case. The provider was compelled to produce records and had none. The strongest evidence that exists, and rare, because it requires an actual legal event.

CyberGhost publishes its own account of the second grade, and we read it rather than a summary of it. Its privacy-hub page describes the auditor as “Deloitte Audit Romania, one of the Big Four global firms”, states the engagement was carried out under the “International Standard on Assurance Engagements (ISAE) 3000 (Revised)”, and says “This year, we completed our third independent audit”. On scope it says “Deloitte examined how CyberGhost's infrastructure and operational systems are designed to uphold our no-logs policy”, and that “The scope included a detailed review of our VPN server network, configuration, and change-management processes, and incident-response controls. It also examined our dedicated IP token-based system.” The page carries a last-updated stamp of 24 February 2026. We read it on 6 September 2026.

Two honest caveats, both of which apply to every audited provider and neither of which is a criticism of this one. The page does not state the exact month the engagement was performed, so the freshness you are relying on is the publication date rather than the fieldwork date. And an assurance engagement of this kind is a snapshot, taken with the provider's cooperation, describing how systems are designed to behave. It is much better than an unaudited claim. It is not a permanent guarantee, and it does not constrain what happens after the auditors leave.

Ownership is the question nobody asks

Consumer VPN brands change hands far more often than their branding suggests, and the company you are trusting today may not be the company that wrote the privacy policy you read.

This matters more than most single features. An acquisition can change the legal entity that holds your account data, the jurisdiction that entity sits in, the commercial pressure on the product, and the retention terms — all without the app on your phone looking any different.

We are deliberately not naming a corporate parent here, because ownership structures change and a name printed in an article ages badly and misleads confidently. The right move is the one that stays correct: before you subscribe, look up who currently owns the brand, and check whether the most recent audit was performed under that ownership or a previous one. An audit that predates a change of hands describes a company that no longer exists in the same form.

The specialised-server model

CyberGhost organises its network differently from most competitors: rather than one undifferentiated server list, it labels servers for particular jobs — streaming platforms, torrenting, gaming.

The honest reading of this is that it is an interface decision, not a technical capability. Any server can carry any traffic. What the labelling does is save you the trial and error of finding one that currently works with a given service, which is genuine value because that trial and error is the single most annoying part of using a VPN day to day.

The caveat follows from the same fact: platforms detect and block VPN address ranges continuously, so a label is a statement about a moving target. A server that worked last month may not today. Treat access to any particular service as a feature that degrades and recovers, never as a guarantee, whichever provider you choose — and never as a reason to breach a service's own terms, which is a separate question this site does not advise on.

For the torrenting question specifically, our torrenting VPN guide covers what actually matters there, and choosing a VPN server location explains what a labelled server does and does not change.

What to verify yourself, in order

• The current audit — who performed it, when, under what standard, and what scope it covered. Not merely that one exists.
• Who owns the company today, and whether that audit predates the current owner.
• Protocol support, and whether the modern option is available on every platform you use — see VPN protocols explained.
• Whether the kill switch is on by default and whether it is system-level or per-application. Ours: kill switch guide.
• Leak handling, including IPv6. Test it yourself after subscribing rather than trusting the claim — DNS and WebRTC leaks covers why a connected VPN can still expose you, and is my VPN working shows how to read the results.
• The refund window and how it is claimed, before you pay rather than after — see how to lose a VPN money-back guarantee.
• The renewal price. Long first terms at a low headline rate are the norm; the renewal is what you actually pay.

The counter-argument, stated fairly

There is a reasonable case against this whole framing, and it deserves a hearing rather than a strawman.

It runs like this: audits are commissioned and paid for by the audited company, scoped in cooperation with it, and published selectively. A determined provider that wanted to retain data could pass one. So the audit is theatre, and the only thing that counts is a court case the provider survived with nothing to hand over.

The first half of that is true and the conclusion does not follow. An assurance engagement under a recognised standard puts a named professional firm's liability behind a description of the systems, on a date, with a scope you can read. That is a materially different thing from a marketing sentence, even though it is weaker than a court case. The correct reading is a ladder, not a switch: unaudited is worst, audited is better, court-tested is best, and almost nobody in the market has the third. Judge providers against each other on which rung they occupy, and treat anyone claiming the top rung without a legal event to point at as overselling.

Who it suits

It suits someone who wants a large network with the guesswork removed, who values an EU jurisdiction with a published audit history, and who is buying primarily for general privacy on untrusted networks rather than for a high-threat situation.

It suits less well someone whose threat model involves a determined adversary with legal reach. There the questions become audit depth, ownership transparency and a tested legal record, and a provider with a published court-tested history is the stronger choice. It also suits less well anyone who wants one provider to solve everything: a VPN is not an antivirus and not a password manager, as VPN versus antivirus sets out.

CyberGhost publishes its audit position and jurisdiction on its own site; read those pages rather than any summary, including this one. If you are still comparing the field, the best VPNs of 2026 is where we set them side by side.

About the figures on this page

No speed, price or server count appears here. Throughput depends on your own connection and cannot be inferred from someone else's test; prices change and are regional; server counts are marketing figures that move weekly. The only quoted material is taken verbatim from the provider's own published audit page, with the date we read it. Read the current numbers on the provider's own page.

Frequently Asked Questions