The full licensing of dipeptidyl peptidase-4 (DPP-4) inhibitors in the USA and Europe requires demonstration of cardiovascular (CV) safety with an upper boundary of harm of <30%. We report a total of 3334 CV events during 86 716 person-years of follow-up in 36 543 patients, when combining data from three trials with formal and prospectively assessed endpoints. Fixed-effect meta-analysis showed that, compared with placebo, DPP-4 inhibition did not increase the upper boundary of risk for the composite endpoint, nor for any individual component by >30%. Relative risks (RRs) were: 0.99 [confidence interval (CI) 0.93–1.06] for composite CV-specific death, non-fatal myocardial infarction (MI) and non-fatal stroke; 1.01 (CI 0.91–1.12) for CV-specific death; 0.98 (CI 0.89–1.09) for non-fatal MI; and 1.00 (CI 0.86–1.16) for non-fatal stroke. The risk of acute pancreatitis was increased (RR 1.79; CI 1.13–2.81), equating to 5.5 extra cases/10 000 patients/year (weighted mean) and a number needed to harm of 1940/year. These data provide reassurance about the safety of DPP-4 inhibitors with regard to individual atherothrombotic events and a safety signal for pancreatitis.