CyberGhost

CyberGhost reports four times a year — government requests, DMCA notices, warrant canary — at a cadence that exceeds most providers who file annually. Romanian jurisdiction is structurally favorable. The Kape Technologies acquisition brings the same corporate background present across ExpressVPN and PIA, and no real-world legal test has verified the current policy under adversarial conditions.

Deloitte annual audits with full report publication. Transparency reporting four times per year — more frequent than most competitors. Romanian jurisdiction excludes EU mandatory data retention directives and sits outside Five Eyes. Kape Technologies acquired CyberGhost in 2017; Kape's predecessor distributed browser extensions that functioned as adware before the company pivoted to privacy products. Apps are closed source — the audit program is the only external code verification layer. No real-world legal test under the current structure has occurred.

WireGuard default, OpenVPN fallback. Kill switch on Windows, macOS, and Android. The most significant gap is obfuscation — none exists on any platform, which matters in environments that block VPN protocols by signature. The iOS kill switch uses system VPN configuration rather than firewall-level enforcement.

WireGuard is the default; OpenVPN available as fallback. System-level kill switch on Windows, macOS, and Android. The iOS kill switch runs through Apple's system VPN framework rather than app-level firewall enforcement, behaving differently under low-memory conditions. No obfuscation mode on any platform — users in networks that block VPN protocols by signature have no Stealth or Shadowsocks option within CyberGhost. DNS and IPv6 leak protection built in and verified in audit scope.

CyberGhost's labeled streaming server categories are the same design logic as its use-case profiles — you select what you're trying to accomplish, not which infrastructure to use. The trade-off built into that approach: when a labeled server gets blocked, the fix belongs to CyberGhost, not to you. Guided experience means you're also dependent on it.

Platform-labeled server categories — BBC iPlayer UK, Netflix US, Disney+ — present streaming destinations as navigation choices rather than requiring server search. Labeled servers are maintained specifically for platform access, not drawn from the general pool. They work more consistently than unlabeled general-fleet servers in practice. When a labeled server's IPs get blocked, recovery requires CyberGhost to rotate and update — you wait on their response rather than troubleshooting independently. Niche platforms and smaller markets outside the labeled categories fall back to general-fleet access without the infrastructure advantage.

A large server fleet with a wide geographic spread is the infrastructure version of the same choice CyberGhost makes everywhere: coverage for as many use cases and locations as possible, rather than depth in any single one. Virtual servers in some locations are the cost of that breadth — they extend the map without the same per-server quality as physical hardware.

Server count runs into the thousands across a wide geographic spread. WireGuard is the default protocol. Virtual servers exist in the fleet: in some locations the IP is local but the physical hardware is elsewhere, which can add latency that contradicts geographic expectation. RAM-only fleet confirmed (Q4 2025 Transparency Report + Deloitte 2025). WireGuard implementation falls outside the Deloitte audit scope. Large fleet size serves geographic coverage distribution — the same breadth-first logic as the labeled streaming categories and the use-case profiles. It doesn't guarantee uniform quality across server types.

The interface is organized around what you're trying to do — streaming, file sharing, NoSpy servers — rather than which server or protocol you want. Smart Rules adds automation on top. This works for users who think in terms of tasks; it adds navigation steps for users who want direct access to protocol or routing controls.

CyberGhost's navigation is organized by use case — streaming, file sharing, NoSpy — rather than server geography or protocol settings. Smart Rules automates connection behavior based on network conditions and app triggers. Split tunneling on Windows and Android; macOS and iOS excluded. The interface rewards users whose primary question is 'which server for this task' rather than 'what protocol am I running.' For users who want to inspect routing decisions directly, the use-case framing adds layers between them and the controls they want.

CyberGhost's device coverage follows the same logic as its interface: a guided path to connection, not maximum flexibility for every scenario. Enough for the typical household on supported devices — but coverage runs out faster than more configurable alternatives when use cases fall outside the expected patterns.

Seven simultaneous connections on all plans. Browser extensions for Chrome and Firefox route browser traffic as proxy — other applications route outside the tunnel unless the full desktop app is also running. Router documentation covers OpenVPN and WireGuard for households that need to extend coverage beyond seven devices. The guided-path coverage model works well when your devices and use cases fit the expected patterns; it creates friction when they don't. Users who need per-app routing via split tunneling on macOS or iOS hit a hard gap — those platforms are excluded.

A 45-day refund window on annual and two-year plans — more evaluation runway than the 30-day standard elsewhere. Monthly plans carry a 14-day window; the extended guarantee only applies if you commit upfront. Renewal pricing is substantially higher than introductory rates.

CyberGhost's money-back window extends to 45 days on annual and longer plans. Monthly subscriptions carry a 14-day window. Introductory pricing on multi-year plans is aggressive; renewal pricing is substantially higher. No self-service cancellation; support contact required. No free tier. The extended refund window gives more time to evaluate whether labeled streaming infrastructure and use-case organization match actual usage patterns before committing to renewal.

CyberGhost reports four times a year, not once. For a product whose users are choosing it precisely because they don't want to make infrastructure decisions themselves, quarterly warrant canary confirmations and request disclosures are the kind of regular trust signal that annual-only filings don't provide.

Quarterly transparency reports cover government data requests, DMCA notices, and warrant canary status — four disclosure windows per year rather than one. RAM-only fleet confirmed. No formal uptime commitment is published. No VPN infrastructure incidents publicly documented. The cadence matches the product's implicit promise: you don't need to understand the infrastructure, but you can check regularly that it's still operating as stated. Annual-only filings ask users to trust for twelve months at a stretch; quarterly reporting shortens that window.