VPNs with a recent independent audit

Proton VPN is the rare free tier that is not a lead magnet. There is no data cap and no expiry: the company says it will be free forever, and the paid plan exists to add servers and speed rather than to unlock the basic function. That alone makes it the answer for anyone who wants protection on a laptop without a subscription decision attached.

The paid product is unusually well evidenced. Every year for five years an outside firm has gone into the server infrastructure and checked that the no-logs promise matches what the machines actually do, and every report has been published rather than summarised. Switzerland sits outside the intelligence-sharing arrangements. The apps are open source, port forwarding works, and there are proper television apps rather than a phone app stretched sideways.

The thing to weigh is responsiveness. Of everything measured on the same bench, Proton adds the most delay before a page starts loading — bulk downloads finish quickly, but video calls and ordinary browsing feel a step behind in a way you notice within a minute. Signing up also needs an email address, which is a smaller thing but worth knowing if anonymity is the point.

Private Internet Access does the thing almost nobody else does: it publishes the source code for every app it ships, on every platform. You do not have to believe the no-logs claim on the strength of a marketing page, because you can read what the software actually does — and an outside firm has separately inspected the servers and their configuration to check that the infrastructure matches.

It is also generous in the ways that cost money. There is no limit on simultaneous devices. Port forwarding works, which matters if you torrent. There is a proxy included alongside the tunnel, apps for televisions, and a three-year plan that renews at exactly what you paid rather than stepping up.

The thing to weigh is where it lives. This is a Colorado company operating under US law, inside the five-country intelligence agreement, and no amount of open source changes which courts can issue an order. The company's answer is that it has been asked and had nothing to give, which it publishes. The kill switch is also the weak point: under testing it allowed traffic past the tunnel after a restart, which is worse than not having one.

CyberGhost runs a very large server network from a Romanian company, and the part that matters most is invisible: the fleet runs from RAM, so nothing is written to disk and everything held is lost the moment a machine reboots. Deloitte examined those no-logging safeguards as they stood on 31 October 2025 and issued a formal assurance report, a stronger artefact than the attestations most of this market publishes.

What you buy is breadth: servers sold for streaming and a Smart DNS for devices that cannot run an app, a content blocker that refuses ad and tracker domains at the server rather than in the app, first-party apps down to Fire TV, and forty-five days to change your mind rather than the usual thirty.

The catch is the pricing structure and a piece of ownership the site never mentions. The advertised rate buys twenty-six months in one charge; the renewal buys twelve for the same money, so the monthly figure roughly doubles two years after you decided anything. The company is a wholly owned subsidiary of Kape Technologies, which has traded under that name only since 2018 and owns two other services in this market — a fact that appears nowhere on its site. There is no port forwarding and no multi-hop.

NordVPN has done the evidence work more thoroughly than anyone. Six times now an outside firm has gone into the infrastructure under a formal assurance standard, interviewed staff, inspected the servers and checked the configuration against what the privacy policy claims — most recently Deloitte, at the end of 2025. Panama sits outside the intelligence-sharing agreements. The servers hold nothing on disk.

The product around that is broad. It will route you through two servers, reach the Tor network without a separate browser, and disguise the fact that you are using a VPN at all on networks built to block them. There are proper apps for televisions and a browser extension that works without the desktop app running.

The catch is what you actually pay. The rate on the advertising covers twenty-seven months in a single charge, and what it renews at is more than three times that number — a subscription whose real cost arrives two years after you decided, when comparing it against anything else has become inconvenient. The audit report is also not published: you can read it only after logging in to an account you have already paid for.

ExpressVPN is the one that gets out of the way. You install it, press the button, and it connects quickly to something sensible without asking you to pick a protocol or a server. On networks that interfere with VPN traffic it works around them automatically rather than making you find the obfuscation setting. If a VPN is infrastructure you would rather not think about, this is the one that asks least of your attention.

Behind that, the servers hold nothing on disk and rebuild themselves from a known state on every restart, which is a genuinely good architecture and has been reviewed by an outside firm. There are apps for everything, including televisions, and a browser extension that works on its own.

The cost is money and it is substantial. The introductory rate covers a little over two years, after which it renews annually at roughly three times what you were quoted. The evidence is also thinner than the marketing implies: the most recent review checked the controls as they stood on a single day rather than over a period, the apps have not been examined since 2024, and the code for them is closed. Router firmware, long a selling point, has been discontinued.

Surfshark is built for a household rather than a person. One subscription covers unlimited devices, which is the difference between protecting your own laptop and protecting everyone's phones, televisions and tablets without counting. The apps are good, there are proper television builds, and it will route you through two servers or block ads before they load.

The evidence behind it is stronger than its reputation suggests. The whole fleet runs from memory with nothing written to disk, Deloitte produced a reasonable-assurance report on the no-logs claim in 2025 after assessing the servers themselves, and a separate firm penetration-tested the network infrastructure later that year.

The cost is at renewal, and it is what holds the value score down. The rate on the advertisement covers twenty-seven months in one charge, after which it renews annually at roughly double the effective monthly figure. The Netherlands is also inside the fourteen-country intelligence agreement, which is easy to miss when a service is described as a privacy-friendly European option. The apps are closed source, and IPv6 is not supported at all — the guidance is to switch it off on your network.

TunnelBear treats being understood as the product. The app is two switches and a map; the kill switch is called VigilantBear and the obfuscation GhostBear, and the effect is that somebody who has never thought about protocols never has to. No plan caps devices, including the free one, so nothing has to be planned around.

Behind the cartoon is an unusually long review record. Cure53 has assessed the service repeatedly since 2017 — its 2023 report calls itself the eleventh such review — and these are white-box tests covering the apps, the backend, the server configurations and the public interfaces rather than a questionnaire. The annual audit that competitors now advertise is a practice this company started.

The catch is that the record is thinner at the recent end than the cadence suggests, and the product is narrow. No report was ever published for the 2024 audit; it exists only as a company summary posted fourteen months late, and the ninth is described as finished and has never been written up. An independent lab found the kill switch leaks after a reboot and after a crash. There is no Linux app, nothing for a television, no port forwarding, no multi-hop and no attempt at streaming — the support pages say so directly.

IPVanish sells one subscription with no limit on simultaneous connections, and means it: an independent lab ran eleven at once without hitting a ceiling. The apps are first-party on seven platform families including Apple TV, Android TV and Fire TV, which is broader television coverage than most of the market manages. Threat Protection filters ads and trackers at DNS level on every plan.

What makes the entry worth reading is older than that. In 2016, under previous ownership, the company answered a Homeland Security administrative summons with a subscriber's name, email address, home IP address and the times they connected and disconnected — after first replying that it kept no usage information, then suggesting the agency come back with a more detailed demand. It has changed hands twice since, and Schellman Compliance examined the no-logs claim in February 2025.

The thing to weigh is whether that audit answers the history. The fleet is still, by the company's own account, a mixture of disk-based and RAM-only machines and will not be fully diskless until 2027, so there is more to examine than at services built to retain nothing. A lab found the kill switch leaks after a reboot, a crash and a dropped connection. And the first year costs $46.68 while the second costs $99.99.

A suite vendor's VPN is usually a feature rather than a product, and this one is worth separating from that assumption. It is sold as its own subscription with its own applications, and it runs on roughly 140 locations of physical servers the company operates rather than licences from somebody else — which is not true of every security company's VPN.

The evidence behind its privacy claim is unusually specific. An outside firm ran a technical privacy impact assessment across June and July 2025, revisited additional server instances at the end of July, retested in August, and published in September with every finding recorded as remediated and an overall privacy impact score of None. That is more recent and more precisely scoped than what several better-regarded services can show.

The cost is that the same product fails a basic test. Independent testing found the kill switch allowing a reconnection outside the tunnel after a reboot or a dropped connection, which is exactly the moment a kill switch exists for. The privacy policy also reserves the collection of device and application telemetry alongside the no-traffic-logs promise, there is no Linux client or router support, and no way to sign up or pay without identifying yourself. The price needs reading twice too: what you pay for the first year is half what it costs to keep.

A security company that wanted a real VPN bought one. In November 2024 it acquired AzireVPN, a small Swedish operator, and its own audit post states that the resulting infrastructure now powers both products, which it operates and maintains itself. That is a change of position, not just a purchase: before it, this brand ran on a network it rented. Transparency reports are published annually and a warrant canary monthly.

Then it did the rarer thing. It commissioned an outside firm to examine the infrastructure, the firm found two problems it rated critical — both concerning how servers are provisioned and booted rather than how traffic is handled — and the company published the report anyway, severity ratings intact, with an explanation of why exploiting either would require physical access to its datacentres. The same examination found no evidence of user activity being logged.

The cost is what that report has not yet said. There is no published confirmation that either critical finding has been fixed, so what a reader has is a company being unusually honest about problems that were open when it wrote. The company is American, so an American court is what compels it, there is no Linux client or router support, and signing up requires an identity like everywhere else.

A no-logs promise asks the same thing of a reader every time: trust that a company able to see both who you are and what you did chooses not to write it down. This service is built to remove the question. Traffic is relayed through this company's servers to exit servers run by a separate company, so the business taking your payment cannot decrypt what you are doing, and the business that can decrypt it never learns who you are.

The rest follows from that decision. The client's source is published rather than described, the connection is obfuscated to survive networks that block VPN traffic, and the two-hop path is the product rather than a premium feature. If your objection to VPNs is that they move trust rather than remove it, this answers it directly.

The costs are real. There is a macOS client and an iOS application, and nothing for Windows, Linux or Android. Nobody outside the company has examined the design or the code — published source is an invitation to check, not a report that somebody did. The company is American, so it sits inside the five-country arrangement. And $8 a month with no annual rate works out above the going yearly price.