VPNInfobaseThree providers meet at least three of our five criteria on their own pages, with some cells unchecked: Mullvad, IVPN and Proton VPN. NordVPN meets fewer and is the mainstream option among the four. We do not rank them, because the criteria pull in different directions. Privacy Guides, which says it takes no affiliate money, recommends the same three.
The five criteria
- A stated owner that is not a VPN group. Founders or a foundation, in the vendor’s own words.
- No-logs assurance or public technical audits. Reports you can open, and a note on which kind they are.
- RAM-only servers, as stated by the vendor.
- Open-source clients, as stated by the vendor.
- Payment without a card, from the pricing page.
What each provider’s pages say
| Attribute | Owner | Audits | RAM-only | Open-source clients | Cash or crypto |
|---|---|---|---|---|---|
| Mullvad | Its two founders, 100% | Many technical audits, 2018 to June 2026; no no-logs assurance report in the register | All VPN servers (migration completed Sept 2023) | “Majority” of software; per client not verified | Cash, Bitcoin, Monero and more |
| IVPN | Its founder, 100% | Cure53 audits since 2019, eighth scheduled July 2026 | Transition under way (May 2025 post); not confirmed complete | Stated for its services | Bitcoin, Lightning, Monero, cash |
| Proton VPN | Non-profit foundation is primary shareholder | Securitum no-logs audits 2022 to 2026, reports published; app audits separate | Not recorded | All apps out of beta | Not checked |
| NordVPN | Nord Security named as parent; no individual named | PwC and Deloitte no-logs assurance; no public technical report recorded | All servers, per vendor | Only its Linux app, per vendor | Not checked |
Sources are each vendor’s own pages as read on 29 September (NordVPN and the IVPN team page on 28 September; Nord’s pages returned HTTP 403 to our reader). The register has each link.
Who we left out, and why
Each exclusion below is the failed criterion and the source of the fact, nothing more. None is a finding about what a provider logs.
- IPVanish: fails criteria 3 and 4 on its own pages. Its no-log policy says its servers are moving to RAM-only and are due to be fully so by 2027, and the register records no open-source clients. Its Schellman no-logs report is in its account portal, so it is not open to non-customers. The same policy also says it keeps a username, starting IP address, session start time, duration and traffic volume to prevent abuse, while listing connection time stamps among what it does not retain; that is not one of the five criteria, so we note it and do not use it. Source: IPVanish no-log policy, read 29 Sep; review.
- Surfshark: fails criteria 1 and 4. Its pages name no owner and it announced a merger with Nord Security in 2022 (Surfshark’s post); the register records no open-source clients. It meets criteria 2 and 3 (public technical reports, RAM-only per its trust center); its Deloitte no-logs reports sit inside customer accounts. Source: trust center; review.
- CyberGhost and ExpressVPN: fail criterion 1 as written, because each one’s own privacy policy names Kape Technologies as its ultimate holding company. Kape also owns other VPN brands, so the owner is a VPN group.
- PIA: fails criterion 1 as written: Kape’s own announcement of 16 December 2019 confirms completion of its acquisition of the company holding PIA, and PIA’s policy names Kape (Kape RNS). It states open-source clients and RAM-only servers, so it meets criteria 3 and 4.
- NordVPN stays in the table but meets fewer criteria: its parent is a security-software group and only its Linux app is open source per the vendor. Criterion 5 was not checked for it.
- Others on the register were not read to the same depth for this page; leaving them out is not a judgement.
Read this before choosing
A VPN moves trust from your ISP to the provider. Audits test what the provider showed an auditor at a point in time. The incidents timeline lists what happened when authorities did ask, with each provider’s account marked as theirs. For a longer look at each owner, see who owns your VPN; to compare the top three side by side, Proton VPN vs Mullvad vs IVPN. Full method: how we pick VPNs. NordVPN is the one provider we earn a commission from, disclosed here. Researched from vendor pages; not a measured comparison.
If you are in the UK, see what the Online Safety Act says about VPNs.