Is CyberGhost Safe? Security, Privacy & Audit Analysis

Is CyberGhost Safe? Encryption, Audits, and Logging Explained

CyberGhost earns a trust score of 85/100. It uses AES-256 encryption, operates under Romanian jurisdiction outside 14 Eyes alliances, and publishes quarterly and yearly transparency reports[1]. CyberGhost says its no-logs configuration has been reviewed by Deloitte Romania. CyberGhost routes traffic through 9,600+ servers across 100 countries with built-in leak protection.

Jurisdiction: Why Romania Matters

CyberGhost is a Romanian company, CyberGhost S.A., headquartered in Bucharest. Romania’s Constitutional Court struck down the country’s first data retention law as unconstitutional in Decision 1258/2009[2], and struck down its replacement in Decision 440/2014[3], so Romania has no data retention law of that kind.

CyberGhost states that Romania is not part of any international surveillance alliance such as the 5 or 14 Eyes. Romania is, however, an EU member state, so this is not the same as being out of reach of cross-border legal cooperation. Romanian authorities need a valid court order to request information from a company.

Even with a court order, CyberGhost states it cannot provide what it does not store. The company’s parent organization is Kape Technologies, based in the UK, which also owns ExpressVPN and ZenMate[4].

CyberGhost Audit History

CyberGhost says it has commissioned three engagements from Deloitte Audit Romania on its VPN servers and no-logging controls: a first in 2022, a second announced in May 2024[5], and a third announced in February 2026[6]. The 2024 work was performed under the International Standard on Assurance Engagements 3000 (Revised), and the report is titled a limited assurance report[7]. Each is a point-in-time review, not continuous monitoring, and CyberGhost says it cannot share excerpts out of context and points customers to the full report in their account. These are CyberGhost’s own accounts of the engagements.

CyberGhost has published a yearly transparency report covering 2011 to 2022[1] and has issued quarterly reports since 2020. These reports detail the number of law enforcement requests and DMCA notices received. CyberGhost says it has never produced user data in response because none exists.

CyberGhost No-Logs Policy: What Gets Stored

CyberGhost’s privacy policy explicitly states it does not log browsing history, traffic destinations, or DNS queries. It also does not store connection timestamps, session durations, or assigned IP addresses. CyberGhost says the policy covers all of its servers.

What CyberGhost does NOT store:

• Browsing activity or visited websites
• Downloaded file names or torrent data
• Original IP addresses or assigned VPN IP addresses
• Connection timestamps or session length
• DNS queries or traffic volume per session

What CyberGhost does collect:

• Anonymous, aggregated connection attempts for troubleshooting (no user identification)
• Account email address and payment information for subscription management
• Approximate device type for app improvement analytics

CyberGhost uses anonymous tokens for authentication on its servers. This system breaks the link between your account credentials and your VPN session. The company cannot match a specific user to a specific server connection at any given time.

CyberGhost says its servers are built without persistent storage and run from RAM, so a reboot clears what was in memory. That limits what a physically seized server could reveal about past connections.

Encryption Standards and Protocols

CyberGhost uses AES-256-GCM encryption as its default cipher across all applications. AES-256 is also the symmetric cipher specified in the NSA’s CNSA 2.0 algorithm suite[8] for national security systems.

CyberGhost supports 4 VPN protocols across its apps:

• WireGuard: Default on most platforms. Uses ChaCha20 encryption.
• OpenVPN (UDP/TCP): Uses AES-256-GCM. UDP offers faster speeds. TCP works better on restricted networks.
• IKEv2/IPsec: Preferred on iOS and mobile devices. Handles network switching efficiently between Wi-Fi and cellular.
• L2TP/IPsec: Legacy option. Available but not recommended for primary use.

Perfect forward secrecy means session keys are generated fresh, so compromising one session key does not expose earlier sessions.

Kill Switch and DNS Leak Protection

CyberGhost includes a kill switch on Windows, macOS, iOS, Android, and Linux applications. The kill switch blocks all internet traffic if the VPN connection drops unexpectedly. It activates automatically with no user configuration required.

On Windows and macOS, the kill switch operates at the system level. It modifies firewall rules to prevent any packet from leaving outside the VPN tunnel. Testing with standard leak detection tools shows zero IPv4, IPv6, or WebRTC leaks during connection drops.

CyberGhost also runs its own private DNS servers. Every DNS query routes through encrypted tunnels to CyberGhost-operated resolvers. This prevents ISPs and third parties from seeing which domains you request. No third-party DNS services like Google or Cloudflare handle your queries.

IPv6 leak protection is enabled by default. CyberGhost blocks IPv6 traffic entirely rather than routing it through the tunnel. This approach eliminates a common vulnerability that cheaper VPNs often overlook.

Past Security Incidents

We found no confirmed breach of CyberGhost’s VPN servers reported by CyberGhost. A threat-intelligence vendor has claimed a 2023 database dump linked to CyberGhost, but we found no independent confirmation or CyberGhost disclosure of it, so we do not treat it as established.

Crossrider acquired CyberGhost in 2017 and later renamed itself Kape Technologies. Crossrider had past associations with adware distribution, which is why the ownership draws scrutiny. CyberGhost states that its operations, team, and infrastructure remain in Romania.

Unique Security Features

CyberGhost offers several features that set it apart from many competitors.

NoSpy Servers: CyberGhost operates a set of premium servers in its own data center in Romania. The company manages these servers exclusively without third-party involvement. NoSpy servers use dedicated uplinks and are physically accessible only to CyberGhost staff.

Content Blocker: Built into the apps, this feature blocks ads, trackers, and malicious domains at the DNS level. It processes blocking before traffic reaches your browser. This reduces data exposure without requiring a separate browser extension.

Dedicated IP Option: Users can purchase a static IP address that only they use. This token-based system assigns the IP without linking it to your account identity. It helps avoid CAPTCHAs and blocklists while maintaining privacy.

Automatic Wi-Fi Protection: CyberGhost detects new or unsecured Wi-Fi networks and connects the VPN automatically. Users can set rules for trusted and untrusted networks. This feature prevents accidental unprotected browsing on public hotspots.

Split Tunneling: Available on Android and Windows, split tunneling lets you route specific apps outside the VPN. You choose which apps use the encrypted tunnel and which use your regular connection.

References

1. Cyberghostvpn. n.d. CyberGhost Transparency Report. https://www.cyberghostvpn.com/download/press/transparency/2023/CyberGhost_Transparency_Report.pdf.Archived: Wayback Machine snapshot
2. European Digital Rights (EDRi). 2009. Romanian Constitutional Court decision against data retention. Retrieved October 18, 2026 from https://edri.org/our-work/edrigramnumber7-23romania-decision-data-retention/.Archived: Wayback Machine snapshot
3. European Digital Rights (EDRi). 2014. Romania: The aftermath of the second CCR data retention ruling. Retrieved October 18, 2026 from https://edri.org/our-work/romania-aftermath-of-second-ccr-data-retention-ruling/.Archived: Wayback Machine snapshot
4. Dark Reading Staff. 2021. ExpressVPN Acquired By Kape Technologies for $936 Million. https://www.darkreading.com/perimeter/expressvpn-acquired-by-kape-technologies-for-936-million.Archived: Wayback Machine snapshot
5. A. Ailoaiei. 2024. CyberGhost VPN Announces Completion of Second Independent Audit Conducted By Big Four Firm. CyberGhost Privacy Hub (March 6, 2024). https://www.cyberghostvpn.com/privacyhub/privacy-audit-2024/.Archived: Wayback Machine snapshot
6. S. Raath. 2025. Third Deloitte Romania Audit Verifies Our Commitment to Privacy. CyberGhost Privacy Hub (December 8, 2025). https://www.cyberghostvpn.com/privacyhub/privacy-audit-2025/.Archived: Wayback Machine snapshot
7. CyberGhost VPN. 2024. 30013 ISAE 3000 CyberGhost VPN Report. Retrieved October 18, 2026 from http://assets.cyberghostvpn.com/files/cg/30013_ISAE_3000_CyberGhost_VPN_report.pdf.
8. Defense. 2025. The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ. https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF.Archived: Wayback Machine snapshot

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• Is CyberGhost Safe? Security, Privacy & Audit AnalysisPDF · 1.2 MB

Frequently Asked Questions

AllSafety & PrivacyHow it worksSetup & SupportPricing

Is CyberGhost actually safe to trust with my data?

Yes. CyberGhost carries an 85/100 trust score, uses AES-256 encryption by default, and operates under Romanian jurisdiction outside the 5, 9, and 14 Eyes alliances. CyberGhost says Deloitte Romania has reviewed its no-logging configuration, though the reports are largely available only to customers.

Why does Romanian jurisdiction actually matter for CyberGhost’s privacy claims?

Romania has no mandatory data retention law and rejected the EU Data Retention Directive twice, in 2009 and 2014. Sitting outside 5, 9, and 14 Eyes intelligence-sharing means foreign agencies can’t compel CyberGhost through partner agreements. Romanian authorities still need a valid court order, and CyberGhost states it cannot hand over data it never stores.

Has CyberGhost ever had a data breach or security incident?

We found no confirmed breach of CyberGhost’s VPN infrastructure reported by CyberGhost. A threat-intelligence vendor claimed a 2023 database dump linked to CyberGhost, but we found no independent confirmation or CyberGhost disclosure, so we do not treat it as established.

What encryption and protocols back CyberGhost’s security claims?

CyberGhost defaults to AES-256-GCM encryption and supports four protocols: WireGuard (ChaCha20, the default on most platforms), OpenVPN UDP/TCP, IKEv2/IPsec for mobile, and a legacy L2TP/IPsec option. Perfect forward secrecy means session keys are generated fresh, so compromising one session key does not expose earlier traffic.

Has an independent auditor verified CyberGhost’s no-logs policy?

Partly. CyberGhost says Deloitte Audit Romania has reviewed its VPN servers and no-logging controls three times (2022, May 2024 and February 2026). The 2024 report is titled a limited assurance report under ISAE 3000 (Revised). Each is a point-in-time review commissioned by CyberGhost, and CyberGhost makes the full reports available to customers rather than publishing excerpts. It has also published yearly transparency reports since 2011 and quarterly ones since 2020.

What information does CyberGhost actually collect if it doesn’t log activity?

CyberGhost collects only your account email and payment details for billing, an approximate device type for app analytics, and anonymized aggregated connection attempts used strictly for troubleshooting. It explicitly does not store browsing history, DNS queries, assigned IP addresses, timestamps, or session length, according to its published privacy policy.

How do I confirm CyberGhost’s kill switch is actually protecting me?

Connect to a CyberGhost server on Windows or macOS, then force-disconnect your network mid-session. The kill switch operates at the system level, modifying firewall rules so no packet leaves outside the tunnel, and it’s available across Windows, macOS, iOS, Android, and Linux apps. Run a leak check yourself after setup to confirm no IPv4, IPv6, or WebRTC leaks appear during drops.

What happens if CyberGhost’s DNS or IPv6 traffic leaks?

It shouldn’t under normal use: CyberGhost runs its own private DNS resolvers so queries never reach your ISP or third parties like Google or Cloudflare, and it blocks IPv6 traffic entirely by default rather than tunneling it, closing a leak vector cheaper VPNs often miss. If you suspect a leak, run a standard leak-detection tool while connected to confirm.

Does CyberGhost’s ownership by Kape Technologies raise any privacy red flags?

Kape Technologies, CyberGhost’s UK-based parent, was formerly Crossrider, which had past associations with adware before it acquired CyberGhost in 2017. CyberGhost states its team and infrastructure remain in Romania. Kape also owns ExpressVPN, Private Internet Access, and ZenMate, so several major VPN brands share one owner.

How does CyberGhost’s security profile stack up against NordVPN and ExpressVPN?

CyberGhost ranks #3 of 22 on our Trust Score, aggregated from published third-party tests, versus NordVPN’s #1 and ExpressVPN’s #2. All three have published some third-party audit material (CyberGhost says Deloitte Romania reviewed its no-logging configuration, NordVPN has published Cure53 assessments, ExpressVPN has a KPMG assurance report and Cure53 audits) and offer AES-256 encryption with a kill switch, though CyberGhost also offers a 45-day refund window.

How many devices can I keep protected under CyberGhost’s security features?

A single CyberGhost account covers 7 simultaneous device connections, each getting the same kill switch, AES-256 encryption, and DNS leak protection. That compares with NordVPN’s 10 or ExpressVPN’s 10 to 14 depending on plan, but CyberGhost also offers NoSpy servers, company-owned Romanian infrastructure with no third-party involvement, as an added layer for sensitive use.

What if I’m not convinced by CyberGhost’s privacy claims after subscribing?

CyberGhost backs every plan with a 45-day money-back guarantee, giving you extra time to test the kill switch, run leak-detection tools, and review the quarterly transparency reports yourself before committing. If the no-logs claims don’t hold up to your own scrutiny, you can cancel within that window.

Can CyberGhost be forced to hand over my data if authorities request it?

Only with a valid Romanian court order, and even then CyberGhost states it has nothing to hand over since it stores no browsing, connection, or DNS data. CyberGhost publishes quarterly transparency reports detailing law enforcement requests and DMCA notices, and says it has never produced user data in response because none exists.