PIA Transparency Report Q3 2026
As part of our commitment to transparency, we publish the number of legal requests we received, along with our bug bounty and vulnerability disclosure program submissions on a quarterly basis.
In Q3 2026 (1 July – 30 September), PIA received 9 legal requests, and our bug bounty program received 132 unique submissions, of which 5 were valid.
Legal Requests
PIA sorts its legal requests into 4 categories to help identify where pressure is coming from.
- Subpoenas: Legal orders compelling the production of testimony, documents, or other evidence relevant to a legal matter. These are specific to US legal proceedings and often used during investigations or litigation.
- Warrants: Court-authorized directives permitting law enforcement to search or seize property. Warrants require probable cause and are typically issued in relation to a suspected crime.
- Other government, law enforcement, and civil requests: This covers additional official requests, such as federal, state, or international inquiries, that don’t fall under subpoenas or warrants. These include requests from courts, police departments, or other government bodies.
- Foreign and informal requests: These are requests from foreign governments or law enforcement agencies that don’t carry formal legal weight under US law. They’re typically non-binding and informational in nature.
Here are the total legal requests PIA received in each category, along with the logs they yielded:
| Request Type | Q3 2026 | Logs Produced |
| Subpoenas | 2 | 0 |
| Warrants | 0 | 0 |
| Other government, law enforcement, and civil requests | 4 | 0 |
| Foreign and informal requests | 3 | 0 |
| Total | 9 | 0 |
PIA produced zero activity or connection logs in response to the 9 legal requests received in Q3 2026.
The figures for Q3 represent a significant drop compared with the 19 requests we received in both Q1 and Q2 this year.
As with previous quarters, this data only reflects requests received, not allegations upheld or users identified.
PIA’s service and network is designed to avoid handling our users’ personal information whenever possible. Our servers run exclusively on RAM and don’t collect or store your browsing data, in line with our strict No-Logs policy.
While we process every request according to our legal responsibilities, we don’t log data about individual users’ activity to share with the authorities.
Bug Bounty and Vulnerability Disclosure Programs
One of the ways PIA maintains the high levels of security in our product is through our work with independent security researchers on YesWeHack. Our programs invite researchers to submit potential or suspected vulnerabilities for review by our internal security teams.
Although the total number of submissions represents a significant increase over Q1 and Q2 for this year, the large majority of reports present no security risk. Over a third are duplicates, and the total number of verified vulnerabilities remains small.
Here are the numbers:
| Bug Bounty | Vulnerability Disclosure Program | Total | |
| All | 207 | 5 | 212 |
| Unique | 132 | 5 | 137 |
| Valid | 5 | 0 | 5 |
| Invalid | 127 | 5 | 132 |
Disregarding duplicate submissions, we received a total of 137 unique reports in Q3 2026. Of these, only 5 represented valid concerns, and we escalated them to our security teams for analysis and remediation where appropriate.
The 132 invalid reports include informational, out-of-scope, and non-reproducible observations, or insights that don’t highlight a security issue.
We take every submission seriously and review every report with the same commitment to making our product as private and secure as possible.
Keeping You Informed
While the numbers may change from quarter to quarter, our approach and values remain the same. Our transparency reports are a regular record of the requests PIA receives, how we respond, and as a reminder of our commitment to strengthening our product through community input. We can’t control how many requests arrive, but we can be open about them and make sure there’s nothing to hand over when they do.
The next PIA transparency report will cover the period 1 October – 31 December 2026.
