At CyberGhost VPN, a lot happens behind the scenes — but we believe you should be able to look under the hood and see what’s going on at all times. That’s why, every quarter, we publish all the requests and complaints we received over the previous three months, along with the results from our bug bounty program.
Here’s a breakdown of CyberGhost VPN’s transparency figures for July, August, and September 2026.
Legal Requests: Our Q3 Numbers
The requests we receive fall into two main buckets:
- DMCA complaints: Reports of suspected copyright infringement that involve IP addresses assigned to CyberGhost VPN servers.
- Police requests: Inquiries from law enforcement agencies looking for information to support their investigations.
| July | August | September | Q3 total | |
| DMCA complaints | 18,275 | 16,716 | 39,790 | 74,781 |
| Police requests | 0 | 0 | 0 | 0 |
When a request comes in, there’s a very strict line as to what we can provide. We follow a No-Logs policy, which means we don’t store your browsing history, DNS queries, original IP addresses, or connection timestamps. To back this, CyberGhost VPN servers run on RAM-only hardware. They’re wiped clean with each reboot, removing any residual data left behind.
So while we review every request we receive, our infrastructure doesn’t retain the activity records those requests may seek.
DMCA Complaints
| July | August | September |
| 18,275 | 16,716 | 39,790 |
CyberGhost VPN received 74,781 DMCA complaints between July and September 2026. Monthly figures ranged from 16,716 in August to 39,790 in September. Compared with the 64,006 complaints received in Q2 2026, this represents a 16.8% increase.
Keep in mind that these numbers reflect copyright infringement allegations, not actual confirmed violations or the number of users involved. And while they may identify an IP address in our network, our No-Logs policy means we don’t have the activity records needed to connect that address to an individual user.
Police Requests
| July | August | September |
| 0 | 0 | 0 |
Not a single police request came our way in Q3 2026. That’s a drop from five requests in Q2 and four in Q1.
Although there were no requests to review this quarter, our policy remains unchanged: we don’t retain the activity or connection logs that could be used to trace a user’s browsing activity.
Q3 Bug Bounty Results
We carry out our own security checks, but they’re only one part of the picture. To run an even tighter ship, we invite independent researchers to examine CyberGhost VPN’s products and infrastructure through our Bug Bounty program. Fresh perspectives can uncover issues that internal testing might miss.
Here’s what researchers reported in Q3 2026:
We received 143 submissions between July and September 2026. Of these, 111 were unique submissions and 32 were duplicates. In total, we confirmed 8 submissions as valid security issues, while the other 103 were invalid.
As you can see, not every report turns out to be a vulnerability. Sometimes a researcher spots something we’ve already been told about. Other times, what looks like a security flaw turns out to be expected behavior, can’t be reproduced, or doesn’t pose a real security risk.
That doesn’t mean we brush these reports aside. We look into each submission to understand what contributors are flagging and when a genuine issue comes to light, we pass it to the relevant team to investigate and fix where needed.
Our Transparency Doesn’t Stop Here
Promises can be easy to make, but without proof, they’re not worth that much. What’s more useful is showing how those promises hold up in practice. That’s why we continue to publish the requests we receive and the results of our bug bounty program, quarter after quarter.
The numbers may change, but our commitment to being open about them won’t. We’ll be back with our next report covering October through December 2026.
Leave a comment