Editorial Policy
The rules we apply when deciding what goes on this site, in the order we apply them.
Last updated
The source hierarchy
When two sources disagree, we prefer them in this order.
Primary documents. Court filings, regulatory decisions, published audit reports, a provider's own terms of service and privacy policy.
Provider statements. Pricing pages, feature pages, support documentation. Reliable for what a provider offers and promises; not evidence that the promise is kept.
Independent technical sources. Security researchers, protocol documentation, app store listings and their change histories.
Our own observation. Where we have checked something directly, we say what we checked and when.
Community reports. Forum threads, Reddit, reviews. Useful for spotting patterns and for questions worth asking. Never used on its own to state a fact.
Provider claims are not facts
This is the distinction we care about most, and it is where most VPN writing goes wrong.
"NordVPN operates a no-logs policy" is a claim by NordVPN. "NordVPN's no-logs policy was examined by an independent auditor in a report published on a given date" is a different statement with different weight. We write the second where it is true and we do not compress it into the first.
Where a claim has not been independently examined, we say that the claim is the provider's own. That is not an accusation. It is a description of the evidence available.
How we treat community evidence
Reddit and forum threads are the most useful and most abused source in this category. They tell you what actually happens to people — which service stopped working with a streaming platform last month, which support desk goes quiet.
They are also self-selecting, unverifiable, and frequently seeded by marketing. We use them to find questions and to notice patterns. We do not present community sentiment as a measurement, we do not aggregate it into a score, and we do not describe it as research.
What commercial relationships can and cannot influence
They can influence placement: which providers appear, in what order, and how prominently. Our affiliate disclosure says this and our methodology explains the mechanism.
They cannot influence stated facts. A price, a device limit, a jurisdiction, the existence of an audit, a documented incident — these are the same whatever the commercial arrangement. If a provider we earn from has a documented problem, it stays in the review.
We do not accept payment to remove criticism, and we do not let a provider approve copy before publication.
Conflicts of interest
VPNGrades has an affiliate relationship with most of the providers it covers. That is the business model and pretending otherwise would be the conflict. What we do about it is disclose it in three places, keep facts separate from placement, and publish the ranking method so the influence is visible rather than hidden.
Language we avoid
We do not write "we tested" unless a test happened and we can say what it was. We do not use "the best VPN" as though it were a measurable property independent of what someone needs it for. We do not put a year in a headline to imply freshness that the content does not have.