VPNs outside the intelligence-sharing alliances

Proton VPN is the rare free tier that is not a lead magnet. There is no data cap and no expiry: the company says it will be free forever, and the paid plan exists to add servers and speed rather than to unlock the basic function. That alone makes it the answer for anyone who wants protection on a laptop without a subscription decision attached.

The paid product is unusually well evidenced. Every year for five years an outside firm has gone into the server infrastructure and checked that the no-logs promise matches what the machines actually do, and every report has been published rather than summarised. Switzerland sits outside the intelligence-sharing arrangements. The apps are open source, port forwarding works, and there are proper television apps rather than a phone app stretched sideways.

The thing to weigh is responsiveness. Of everything measured on the same bench, Proton adds the most delay before a page starts loading — bulk downloads finish quickly, but video calls and ordinary browsing feel a step behind in a way you notice within a minute. Signing up also needs an email address, which is a smaller thing but worth knowing if anonymity is the point.

CyberGhost runs a very large server network from a Romanian company, and the part that matters most is invisible: the fleet runs from RAM, so nothing is written to disk and everything held is lost the moment a machine reboots. Deloitte examined those no-logging safeguards as they stood on 31 October 2025 and issued a formal assurance report, a stronger artefact than the attestations most of this market publishes.

What you buy is breadth: servers sold for streaming and a Smart DNS for devices that cannot run an app, a content blocker that refuses ad and tracker domains at the server rather than in the app, first-party apps down to Fire TV, and forty-five days to change your mind rather than the usual thirty.

The catch is the pricing structure and a piece of ownership the site never mentions. The advertised rate buys twenty-six months in one charge; the renewal buys twelve for the same money, so the monthly figure roughly doubles two years after you decided anything. The company is a wholly owned subsidiary of Kape Technologies, which has traded under that name only since 2018 and owns two other services in this market — a fact that appears nowhere on its site. There is no port forwarding and no multi-hop.

NordVPN has done the evidence work more thoroughly than anyone. Six times now an outside firm has gone into the infrastructure under a formal assurance standard, interviewed staff, inspected the servers and checked the configuration against what the privacy policy claims — most recently Deloitte, at the end of 2025. Panama sits outside the intelligence-sharing agreements. The servers hold nothing on disk.

The product around that is broad. It will route you through two servers, reach the Tor network without a separate browser, and disguise the fact that you are using a VPN at all on networks built to block them. There are proper apps for televisions and a browser extension that works without the desktop app running.

The catch is what you actually pay. The rate on the advertising covers twenty-seven months in a single charge, and what it renews at is more than three times that number — a subscription whose real cost arrives two years after you decided, when comparing it against anything else has become inconvenient. The audit report is also not published: you can read it only after logging in to an account you have already paid for.

ExpressVPN is the one that gets out of the way. You install it, press the button, and it connects quickly to something sensible without asking you to pick a protocol or a server. On networks that interfere with VPN traffic it works around them automatically rather than making you find the obfuscation setting. If a VPN is infrastructure you would rather not think about, this is the one that asks least of your attention.

Behind that, the servers hold nothing on disk and rebuild themselves from a known state on every restart, which is a genuinely good architecture and has been reviewed by an outside firm. There are apps for everything, including televisions, and a browser extension that works on its own.

The cost is money and it is substantial. The introductory rate covers a little over two years, after which it renews annually at roughly three times what you were quoted. The evidence is also thinner than the marketing implies: the most recent review checked the controls as they stood on a single day rather than over a period, the apps have not been examined since 2024, and the code for them is closed. Router firmware, long a selling point, has been discontinued.

hide.me is run by a Malaysian company, and the free plan is the part worth knowing first: no account, no email address, no card, no data cap and no expiry. You download it and you are protected. That is a different proposition from a free tier with a countdown attached, and the company treats it as a product rather than a funnel.

The paid plan is unusually complete for the price. Ten devices, first-party apps across nine platform families including Apple TV and Fire TV, split tunnelling in both directions, and a multi-hop mode where you pick both the entry and the exit server rather than choosing from fixed pairs. IPv6 is carried inside the tunnel on every location rather than blocked, which is the harder of the two ways to solve that problem.

The downside is what the audit covers and how much sits behind the paid tier. Securitum examined the no-logging claim properly — interviews, configuration, a server image — but dated its report 7 June 2024, past the two-year line this directory draws. Whether the servers run without disks cannot be settled from published sources. And the ad blocker, the proxy, the streaming servers and port forwarding are all for paying subscribers only.

PureVPN sells a very cheap long term from a British Virgin Islands company, with the group itself run from Karachi. What the subscription covers is broad: ten devices, first-party apps across nine platform families down to Apple TV and Fire TV, servers picked out for individual streaming services, and an ad and tracker blocker on every tier.

The reason to read the entry is a 2017 federal case. An FBI affidavit records that the company supplied records tying one customer account to two originating IP addresses — a home connection and an employer's — precisely the category a no-logs policy is understood to exclude. Its answer at the time was that it had not broken its policy because it kept no browsing history, which was a defence about a question nobody had asked.

The tradeoff is that the reassurance has aged and the price has a second half. The last independent assessment ran in February 2023; the company describes an always-on arrangement letting an auditor arrive unannounced, but a standing permission is not an assessment that happened, and its own pages no longer name the firm that did the last one. The long plan charges once for twenty-seven months and then renews yearly, and port forwarding and a dedicated address are extra.

This is the ad blocker company's second product, and it is built to be undemanding. There is one transport, written in-house, so there is no protocol menu to understand and nothing to configure before you are protected. Ten devices, applications on six platforms and a router, a working kill switch, no leaks in testing, and cryptocurrency accepted at the till.

That simplicity extends to finding out whether you want it. The free tier gives you a few gigabytes a month on two devices, which is enough to test the thing properly rather than to sample it for a week, and the paid plan carries a month-long refund window on any term of a year or more.

The cost is throughput. Independent testing measured it at a small fraction of the unprotected line, slow enough that on a modern connection the tunnel, rather than your broadband, decides how fast everything goes. If your connection is already slower than that, you will not notice. The single in-house protocol cuts the other way too: nobody outside the company has ever examined the thing carrying your traffic, and no assessment of the service has been published.

The most useful thing about this service is how little it asks you to commit. The free plan carries a monthly data allowance rather than a countdown to a card prompt, so you can find out whether it suits you without paying, and the paid plan puts no ceiling on simultaneous devices — an unusual pairing, and the reason its subscription costs so little per month on a long term. Its own privacy policy goes as far as recommending cryptocurrency to keep payment data to a minimum.

The mechanism behind the marketing is worth reading closely. The service is sold on Swiss privacy law, and the controller named in its privacy policy is a company organised under the laws of Iceland. The Swiss entity, and an American one, appear in that same document as payment processors acting on the Icelandic company's instructions.

The cost is what you cannot check. Nobody outside the company has examined the no-logs claim, so the specific commitments in the policy stand on the company's word. Speed falls off substantially at distance, losing most of a fast connection on the furthest servers tested. And a product sold on privacy uses mobile advertising identifiers to attribute its own marketing, which is common and still worth knowing.

Most of the large antivirus companies are American or British. This one is Romanian, and it says so deliberately: its own page argues that its jurisdiction sits outside the five, nine and fourteen-country intelligence arrangements. For a reader choosing on where the courts are, that is a real distinction from the other suite VPNs here, and it is the main reason to consider it.

What it is not is a network of its own. The service runs on the Hydra protocol, which the company licenses rather than wrote, and the servers behind it belong to a separate company that sells the same infrastructure under its own brand. Two products, one network. Neither vendor's site makes that easy to discover, which is precisely why it is stated here.

The trade-off is that nothing outside the company has ever tested the no-logs promise, so a strong jurisdiction is being asked to carry weight that an audit would normally carry. The price doubles at renewal, from $34.99 for the first year to $69.99, and the ad blocker is the only extra of substance. It is a reasonable second line of defence for somebody already inside this company's ecosystem, and a thin argument for anybody who is not.

A first-year price that is not really the price is the norm in this market. This one is not that. A year for one device is $49.99, three devices $64.99, five devices $69.99, and the subscription renews automatically at the same figure — stated on the same page, next to the buy button, rather than in a footnote. For a reader who has been caught by a renewal once, that alone is worth something.

The jurisdiction is the other argument. The company is Finnish, says so plainly, and Finland sits outside the five, nine and fourteen-country intelligence arrangements while still being inside the European data-protection regime. The applications carry the things a general reader needs and not much more: a kill switch on desktop and Android, an ad blocker on desktop and iOS.

The catch is the pricing model that makes the honesty possible. Charging per device means the entry price buys one device, at roughly what competitors charge for five or ten, and a household quickly finds itself on the more expensive tier. Nothing outside the company has examined the no-logs claim either, so the same gap as the other suite vendors applies. You are paying a premium for predictability and a jurisdiction, not for capability.

The design decision here is to sell access and charge for it. This is a service bought by people who need a connection to work from a network that actively blocks such connections, and its reputation rests on continuing to work where that is difficult. Independent testing bears out the performance half of the claim: measured across four regions, the tunnel cost almost nothing in throughput, and in one region the protected connection tested faster than the unprotected one.

The mechanism is a proprietary stack, a large engineering effort aimed at obfuscation, and a price that funds it. The subscription costs several times the market's usual monthly rate, with no discount for committing to a longer term, and extra simultaneous devices and higher-capacity servers are charged on top of that again.

The catch is what the privacy policy says. The company retains the last twenty connection records for each account, including the time and duration of each session, the country, and the device type, tied to the registered email address. It describes this as a support tool, which it may well be, and it is still a record of when you connected and for how long. No outside firm has examined any of it, and the interface has been described by testers as dated and awkward.