How we research

Source hierarchy

We use sources in this order and stop at the first that settles the question:

The vendor's own pages: pricing, terms, privacy policy, trust and audit pages.
Filings and regulators: stock-exchange announcements, annual reports, company registers.
Auditors' own pages and reports, with the scope and the date of fieldwork.
Client source code on GitHub, for open-source claims.
Named news outlets for incidents, court papers and ownership changes, cited by outlet and date.

A fact that rests only on a reference site such as Wikipedia is labelled as secondary. If nothing can be found, the field says not verified instead of a guess.

What our evidence labels mean

Vendor states: the provider's own page says it.
Filing: a regulator or exchange document says it.
Secondary only: a news or reference page says it and we could not confirm it with the vendor. This is our version of "verified in part".
Not verified: we looked and found nothing we can cite.

How prices and specs are checked and dated

Each price carries the plan, the billed term, the currency and the date we read it. Prices are shown as a monthly figure for the billed term, so a two-year deal is not passed off as a monthly plan. Where a vendor shows euros to one visitor and dollars to another we record both lists and say which is which. Prices and refund terms are re-read every 90 days; ownership, audits and incidents every 90 days or when news breaks. The date on a page is the date a person re-read the source, not the build date.

What we do not do

We do not test VPNs hands-on. There are no speed figures, no leak tests of our own and no scores. Where an independent tester has published measurements we may cite them by name, with a link. Logging and RAM-only entries are the vendor's claims, paraphrased; an audit tests a claim within a scope on a date, and the register shows that scope and date rather than a badge.

How pages are checked

Every fact is checked against its cited source, and each page gets a separate review pass before it is published. The corrections log lists what those reviews and readers have caught.

Open data

The register is open data under CC BY 4.0: github.com/hardcor3nl/vpn-audit-register.

See About, the editorial policy and contact.