Primary sources: court records, audit reports, company filings, operator documents we fetched ourselves.
B
Serious press and academic research.
C
Community reports (Reddit, forums) - paraphrased, linked, labeled as anecdote.
D
Our own measurements. Empty until the test phase completes; provider pages say so explicitly.
Citations
Every factual sentence in our reviews carries an inline citation [n] that jumps to the numbered source below the review. Claims we could not verify are either dropped or explicitly marked unverified - the honest answer beats a plausible guess.
Scoring
Seven dimensions: privacy & logging, ownership & track record, security, censorship resistance, performance, honest value, ease. Weights differ per kind (a free app is judged harder on trust than a paid service). Sub-scores are derived by a fixed rulebook from documented facts - the same rules render below, and the code behind them is src/score.js. A provider is never rewarded for what we could not verify.
Privacy & logging
Base
0 points before rules apply
5
Evidence class: court-tested no-logs (police raid / court case found nothing to seize)
4
Evidence class: independent third-party audit of the no-logs policy or infrastructure
2
Evidence class: written policy only - you are taking the company's word
1
Evidence class: no documented logging policy at all
0
Evidence class: documented log handover (claim contradicted or proven in court) scores 0 - and the whole dimension is capped at 3
1
At least two independent audits exist
1
The most recent audit is within the last 3 years
1
Published warrant canary
1
Jurisdiction outside the 14-Eyes alliance
1
Monero (or cash) accepted - the payment cannot be traced back to you
0.5
Some crypto payment accepted (weaker - exchange KYC may still link you)
0.5
Signup without personal data (numbered account / no email)
Ownership & track record
Base
3 points before rules apply
Cap
Incident deductions stack to a floor of 0.
1
Ownership publicly documented with confirmed confidence
0.5
Facts field-verified against primary sources (not just reported)
0.5
Independent operation: no conglomerate holding several VPN brands
1
Community-owned / nonprofit governance
-0.5
Part of a conglomerate holding several VPN brands
-1
Owner lineage includes adware distribution or the owner also runs VPN review sites
-1.5 per incident
Each high-severity incident on the record
-1 per incident
Each medium-severity incident on the record
-0.5 per extra incident
Each incident beyond the first on the record
-0.5 per red flag
Each red flag on the record (duplicating incidents is avoided by curation)
Security
Base
Baseline 3: serious VPNs all ship AES-256/ChaCha20 - the field is level, scoring starts where differentiation begins. Empty protocol list = baseline 2.
-1
Baseline when the protocol list is empty (unknown, not assumed good)
1.5
WireGuard-based protocol supported
1
OpenVPN supported
0.5
IKEv2 supported as a fallback protocol
1
Kill switch implemented and documented
0.5
Split tunneling supported
0.5
Multi-hop / double VPN
1
Client code open source (auditable, not just auditable once)
1
Audit covering client, protocol or infrastructure within the last 3 years
-1 per vulnerability incident
Each documented client/protocol vulnerability in the incident record
Censorship resistance
Base
0 points before rules apply
Cap
No documented obfuscation = 0. This dimension is explicitly NOT for assuming "probably works in China".
4
One documented obfuscation/stealth method
6
Two or more documented obfuscation/stealth methods
1
A purpose-built stealth protocol (obfuscated/whisper/stealth-class, not just OpenVPN on 443)
0.5
Tor over VPN offered
Performance
Base
0 points before rules apply
Cap
Always null (dropped from the weighted total) until our own test phase produces data. We do not copy vendor or affiliate benchmarks.
Honest value
Base
0 points before rules apply
4
Renewal price unknown - neutral middle, no assumption either way
6
Flat pricing: renewal equals the intro price (factor <= 1.05)
5
Renewal at most 1.25x the intro price
3
Renewal at most 2x the intro price
1.5
Renewal at most 4x the intro price
0.5
Renewal more than 4x the intro price
2
Intro price at most $2.50/mo equivalent
1.5
Intro price at most $5/mo equivalent
1
Intro price at most $8/mo equivalent
0.5
Intro price above $8/mo equivalent
1
Refund window at least 30 days
0.5
Refund window at least 14 days (but under 30)
1
Free tier exists
0.5
Crypto payment accepted
Ease of use
Base
4 points before rules apply
2
Native apps for at least 6 platforms
1.5
Native apps for 4-5 platforms
1
Native apps for 2-3 platforms
0.5
Router installation supported
0.5
Browser extension instead of / besides the full app
0.5
Signup without account hurdles (no email needed)
Performance is null until we test. The total re-normalizes over the known dimensions - no provider is penalized for our missing tests, and none is flattered either.
Affiliate blindness
Scoring paths never read affiliate fields; a source-level test enforces it on every run. See how we make money.
Corrections
Sources rot and facts change. Every page carries its check date; every correction with evidence is applied and logged on the change feed.