# URnetwork vs IVPN

IVPN is the classic VPN with the cleanest conduct record and an annual
published audit cadence; URnetwork splits the path so the exit never learns
who you are and the operator cannot read the sealed session.

**Choose IVPN** if you value an annual audit record, cash and Monero payment,
and predictable datacenter speed. **Choose URnetwork** if you want residential
exits, city selection, and a split path. Both open accounts with no email, and
both run a post-quantum key exchange by default. IVPN is the more verified.
URnetwork splits visibility between its operator and a member-run provider.

[IVPN](https://www.ivpn.net) is run by IVPN Limited of Gibraltar, under the
same ownership since 2009 and renamed from Privatus Limited in 2023. It closed
its own affiliate program in 2016 in protest of paid rankings, publishes an
open-source tool built to talk people out of buying a VPN, and prices without
discount theater. Accounts are random ID numbers with no email attached.

URnetwork uses member-run exits. The provider does not receive your source IP
on the relayed path. Native apps seal traffic to the provider by default.
[How URnetwork works](/docs/overview) explains the full design. The
[threat model](/docs/threat-model) holds the complete record of what is stored
and enforced.

## Six differences that affect the choice

| | IVPN | URnetwork |
|---|---|---|
| Trust model | One company; its servers terminate the tunnel, and "no logs" is the policy at that position | Two relay parties; the exit never sees your IP, and the operator cannot read the sealed session |
| Exit address | Datacenter ranges, publicly listed, widely blocked by streaming and retail sites | Residential addresses; ordinary traffic to the sites you visit |
| Coverage and targeting | 41 countries and 58 cities, every host named, none virtual (its own API); pick a server | Member devices in 90+ countries; browse countries, search for a city |
| External verification | Eight Cure53 audits since 2019 with published reports, a transparency report, a signed warrant canary | Open client and server code; no independent audit of the protocol or server code yet |
| Consistency | Dedicated bare-metal fleet; predictable | Member uplinks; speed moves with the provider |
| Payment without a trail | Cash by post, Monero to its own node, bitcoin via its own payment server | One-tap account with no email; on-chain USDC |

Caveats below the table:

- Post-quantum encryption is parity, on by default on both sides. IVPN's
  quantum-resistant WireGuard connections are default in its own apps, on all
  platforms and all WireGuard servers, and IVPN states the scope itself: apps
  only, WireGuard only, and not entirely quantum-proof. URnetwork's
  X25519MLKEM768 client-to-provider session is default in the native apps,
  skipping any provider it cannot seal to rather than downgrading. The browser
  extension has no sealed session; there, the operator's data path logs
  nothing, pinned by a test in the open code.
- Kill switches: URnetwork ships an explicit toggle on every platform,
  default-on in the extension. IVPN's firewall covers Windows, macOS and
  Linux; its own knowledge base documents none on iOS 16 and later, removed
  in 2023 rather than shipped broken, and Android defers to the operating
  system's always-on mode.
- Multi-hop is included in every IVPN plan as of May 2026 and chains two IVPN
  servers; both hops belong to the same company.
- IVPN sells three tiers as of mid-2026, roughly $6, $8 and $10 a month or
  $60 to $100 a year, with no free tier, a $2 one-week plan, and a 30-day
  refund. URnetwork Pro is $5/month or $40/year with a free daily allowance.
  Current numbers are at [ur.io/products](https://ur.io/products).
- File sharing: IVPN restricts no protocols and asks users to keep P2P off
  its US exits; port forwarding was removed in 2023. URnetwork drops
  BitTorrent-class traffic at each provider's exit, lawful downloads
  included. It is not a torrenting product.

## The audit stack

Eight Cure53 engagements since 2019, roughly one a year, each announced
before it ran and published after: a no-logs audit in 2019, the full
infrastructure in 2020, the apps on every platform in 2021 and again in 2022,
the rebuilt gateway infrastructure in 2023, the web stack and API in 2024,
the Mailx and modDNS services in 2025, and the Unlinked Access cryptography
in 2026. The work is white-box, with repository access, and the 2019
conclusion is quotable: "all of the IVPN's privacy statements could be
verified as truthful within the defined scope."

The most useful sentence in the record is IVPN's own case against the genre.
It has declined to commission another no-logs audit since 2019, and its CEO
wrote down why in 2026: "Audits are a snapshot in time: any VPN service
receiving a 'no-logs' stamp from independent evaluators can update its
systems and start collecting sensitive data the following day." The most
audited independent company in the category treats audits as evidence about
conduct on a date, not proof of a property. That calibration applies to every
audit cited on this page, URnetwork's assessments included.

The legal record is quieter than a raid and still real: a published
transparency report counts 34 law-enforcement requests since 2016, three of
them valid, and zero that produced data, alongside a monthly PGP-signed
warrant canary stating that no warrant, search or seizure has ever been
served.

![How you verify a privacy claim — point-in-time audits vs court and raid evidence vs open continuous verification](/docs-assets/infographic-verification.svg)

*IVPN's audits are the first kind of evidence, and its transparency record
sits nearer the second. URnetwork's is the third kind: open code anyone can
check on any day, with no independent examination of the protocol or the
operator's server code yet.*

URnetwork's side of this ledger is different in kind. No independent audit
covers its protocol or the operator's server code; two 2025 assessments cover
other surfaces and are listed under Limits. What it offers instead is
continuous rather than annual: the clients and the operator's server code are
open source, so the storage design can be checked by anyone on any day.
Verification by publication is not verification by examination, and this page
does not blur the two.

## Feature removals as disclosure

IVPN's record includes a pattern few vendors show: deleting features,
including paid ones, and publishing the reasons.

- Port forwarding, a paid feature, was closed to new reservations in June
  2023 and removed that September. The stated reason: "We have no insights
  into how any one specific customer uses IVPN, and that needs to stay that
  way." A company that cannot see per-customer behavior cannot police abuse
  selectively, so its only lever is removing the capability for everyone.
- The iOS kill switch was removed in August 2023 after Apple's networking
  leaked traffic around it on iOS 16, in IVPN's words "to avoid providing a
  false sense of security." It remains on iOS 15, where it works.
- The custom Android kill switch was removed in 2021 because it could gap
  between handovers; users are pointed at Android's native always-on mode.
- In 2024 IVPN published reproduction steps for an Android OS-level DNS leak
  that affected every VPN app, its own included.

The same disclosure habit covers marketing. The affiliate program has stayed
closed since 2016, the homepage still says "We never pay for reviews," and
the ethics page names the payments IVPN does make: sponsorships of privacy
organizations and support for a short, named list of privacy educators.

URnetwork's egress filter is the port-forwarding reasoning applied at the
exit. The connect engine inspects traffic at each provider's own connection
and drops file-sharing and attack traffic before it leaves that member's
line, recording no destination, domain, or contents. Enforcement without a
record: the alternative, forwarding everything and answering complaints with
logs, requires exactly the logs this design exists to avoid. The cost is the
hard exclusion stated above.

## The map, measured

IVPN's location numbers are the most verifiable in the commercial field. The
homepage claims gateways in 41 countries on dedicated bare metal, "no shared
VPS, no virtual locations." Its public server API returns exactly 41
countries and 58 cities and names the hosting company behind every gateway.
An independent infrastructure observer sees 40 countries and 57 cities. And
IPinfo's December 2025 study measured IVPN at 0% virtual locations, one of three
providers in twenty to score zero, with Mullvad and Windscribe. When this
documentation warns about location counts, IVPN is the standard it holds
others to.

![Advertised locations vs measured reality — share of advertised locations measured virtual or unmeasurable per provider (IPinfo, December 2025)](/docs-assets/infographic-virtual-locations.svg)

*IVPN, Mullvad and Windscribe are the measured-0% tier, the standard this
documentation holds others to. URnetwork appears as a mechanism rather than
a percentage, because a provider is the presence.*

The contrast that survives all that disclosure is the kind of address.
IVPN's 88 servers sit in fifteen named hosting companies' racks, in ranges
published in routing data before anyone connects, which is why streaming and
retail sites can block them wholesale. URnetwork's exits are members' own
connections: a location exists only while a member's device is online in it,
the network geolocates the connection it observes rather than accepting a
declared city, and 2,000+ real cities is stated as checkable against the
live feed at api.bringyour.com/stats/last-90, published without a login.
Hold that to IVPN's own standard: IVPN's zero was measured from outside, and
nobody has measured URnetwork. A mechanism you can check is not yet a
measurement someone made.

## Where IVPN wins

- External verification: eight published Cure53 audits since 2019, a
  transparency report, and a signed warrant canary. URnetwork's two 2025
  assessments cover other surfaces, and its protocol and server code have
  none.
- Payment with no ledger: cash by post and Monero. URnetwork's USDC lives on
  a public chain.
- Consistency. Bare-metal servers behave the same every session.
- Jurisdiction: Gibraltar rather than the US, if legal process is your
  concern.
- Conduct: a decade of choices that cost revenue, from the closed affiliate
  program to deleted paid features, each explained in public.
- P2P: no protocol restrictions, against URnetwork's BitTorrent drop.

## Where URnetwork wins

- The split. The exit never learns who you are, and the operator cannot read
  the sealed session. No single party holds identity and destinations
  together.
- The exit address. Residential IPs work where IVPN's datacenter ranges are
  recognized and blocked.
- Reach and aim. Member devices in 90+ countries and 2,000+ real cities by
  the live feed, searchable to a city, against 41 countries and 58 cities.
- Plural exits. A window of several providers at once, each site pinned to
  one, instead of one well-known server address.
- One-tap anonymity plus recovery: an Instant Account with no email,
  restored on a new device by its recovery phrase. IVPN's account IDs are
  equally anonymous; the phrase adds reinstall recovery.
- Whole-stack source. Client and server code are public, against open apps
  and an open website with the server side unpublished.
- Price and a free tier: $5/month or $40/year plus a free daily allowance;
  IVPN starts at about $6 with none.
- The supply side. Members can share their connection as participants in the
  [UR protocol](https://ur.xyz). IVPN has no equivalent role.

## Limits and evidence

URnetwork's main limits:

- No independent audit covers the protocol, the connect engine, or the
  operator's server code. Two 2025 third-party assessments cover other
  surfaces: a penetration test of the web application and API (April–May
  2025), and the Leviathan MASA AL2 assessment of the Android app, which
  passed. Leviathan writes that its assessment "should not be read as a
  holistic security evaluation or comprehensive penetration test." Neither
  examined logging, retention, or the data path.
- The split assumes the operator and the providers in your window are
  independent. Nothing in the system attests that independence, the operator
  could itself run providers, and no outside party has measured the fleet.
  See the [threat model](/docs/threat-model), §6.1.
- URnetwork publishes no transparency report and no warrant canary. IVPN
  publishes both.
- The WireGuard-compatible fallback endpoint assigns one stable tunnel
  address, so several providers could recognize the same client across
  sessions. The native tunnel is the recommended path.
- Coverage counts are self-published on both sides. IVPN's were confirmed
  from outside twice; URnetwork's have not been measured.

IVPN's limit is structural. Its servers terminate the tunnel, so one position
can see your connecting IP and your destinations together, and the policy
decides what is recorded from that view. Multi-hop splits the view across two
machines the same company runs. Everything else in IVPN's design reduces what
that position is given: no email, cash and Monero, and a no-logs policy
audited once and then argued against as a genre by its own CEO.

Trying URnetwork costs nothing: the Instant Account takes one tap and no
email, so you can test it against your own sites before paying for either
product. More questions are answered in the [FAQ](/docs/faq).