We do not rank VPNs and we do not give scores. Each provider is recorded in the same fields, every field links to where it came from, and shortlists are built by filtering those fields with criteria stated on the page. Nothing here is tested by us: no speed tests, no unblocking tests. If a fact cannot be traced to a source, the field says “not verified”.
What counts as evidence
| Field | Accepted source | Never accepted |
|---|---|---|
| Owner and parent company | The vendor’s policy or about page, a regulatory or exchange filing, or a named news outlet (labelled secondary) | Anonymous forum posts, “reportedly” without a named source |
| Audits | The auditor’s report or the vendor page listing it, with auditor, date and scope | A badge or “audited” with no auditor named |
| Logging policy | The vendor’s own words, recorded as a claim | Our judgement that a policy is “good” |
| Incidents | A court-reporting or security outlet, or the provider’s own incident post, labelled as such | Rumour, unlinked screenshots |
| Price and refund | The vendor’s pricing or terms page on the date checked | Coupon sites, affiliate landing pages |
| Independent test results (speed, streaming) | A named tester’s published method and results, cited with a link | Numbers we could not trace |
Who gets recorded
A provider goes on the register when it sells a VPN service to consumers and its pages can be read. Services that are discontinued or rebranded stay in with their status shown, and services whose sites could not be read at all are listed as “not verified” instead of guessed at. Tor Browser is not a VPN and is covered on its own page.
How shortlists are built
A shortlist on a guide page says which register fields it used. For a privacy list that might be audit scope, ownership and jurisdiction. For a cost list it is the renewal price and refund window from the price table. We show which providers were left out and why. Where the register has no field for the question (streaming reliability, for example), the page cites a named independent tester or says we cannot answer it.
What we never do
- Show a score or a rank unless the page prints the rubric and the inputs behind it.
- Claim first-hand testing, or invent user quotes, reviewers or credentials.
- Copy a vendor’s audit summary as if it were the auditor’s finding. The audit tracker marks summaries and account-only reports.
- Accuse a company of anything. Ownership and incidents are stated as sourced facts with the provider’s own account marked as such.
Money
One provider, NordVPN, pays us a commission when you buy through our link. The link sits after the facts and is marked as sponsored. It does not change what the register records: NordVPN’s incident and ownership entries are written from its own pages like everyone else’s. Details are on the affiliate disclosure. Other providers’ links earn nothing today.
Known limits
The register has gaps. Several owner fields are empty because no vendor page names an individual owner, a few vendor sites blocked our automated reads, and some prices vary by country. Older guides written before the register still contain unsourced comparisons and are being rebuilt in stages; where a guide and the register differ, trust the register and tell us. Read who owns your VPN for the ownership table and the confidence labels it uses.
Method
This page describes the rules in the register’s method note and our about page, checked on 29 September 2026. Corrections go to the address on the contact page.