Review Methodology

Four kinds of evidence, kept apart

Most VPN comparisons blend everything into one number. We keep the evidence types separate, because they are not equally strong and a reader deserves to know which one a claim rests on.

Provider documentation

Price, billing period, refund window, simultaneous device limit, number of server locations, supported protocols, company jurisdiction. Published by the provider, checkable by anyone, and the least ambiguous category. When we state one of these, we are reporting what the provider publishes at the time of writing.

Independent sources

Third-party security audits and their scope, published security research, regulatory findings, court filings, app store listings and version histories. This is the strongest category, because the provider does not control it.

The scope matters as much as the existence. "Audited" can mean a full infrastructure review or a narrow check of one client application. Where we cite an audit we say what it covered and when it was published.

First-hand observation

Where we have looked at something ourselves — signed up, read the terms, checked what an app actually asks for — we say so and say what we looked at.

We do not publish our own speed benchmarks or streaming-unblocking tests. Doing that properly requires controlled conditions, repeated measurement across locations and times, and disclosure of the method. Anything less produces a number that looks scientific and is not. Where speed or streaming behaviour is discussed, it is attributed to the provider's own claims or to an independent source, and labelled as such.

Community reports

Reddit threads, forum posts, app store reviews. These are anecdotes: self-selected, unverifiable, and sometimes planted. They are genuinely useful for noticing that something changed — a platform started blocking a provider, a support queue got worse — and useless as proof.

We use them to decide what to look into. We never convert community sentiment into a score.

What we judge on

A review looks at these dimensions. Not every dimension carries a first-hand test, and the review says which is which.

• Privacy — the logging policy as written, and whether anything independent has examined it

• Security — encryption and protocol implementation, leak protection, kill switch behaviour

• Protocols — which are offered, including any proprietary implementation

• Jurisdiction — where the company sits and what that means for data requests

• Audits — whether any exist, what they covered, when they were published

• Speed — attributed to the provider or to an independent source; not our own benchmark

• Streaming — what the provider claims and what independent or community reports say; this changes constantly and is dated accordingly

• Usability — what setup requires and which platforms are covered

• Support — channels offered and documented response commitments

• Pricing — the real cost across the billing term, not the headline monthly figure

• Refund terms — the window and its conditions

• Device support — platforms, router support, simultaneous connections

• Value — what the price buys relative to comparable services

How the ranking is built

This is the part most comparison sites are vague about, so we will not be.

The order on our ranking page is not a pure editorial verdict. Two things shape it.

Measured reader behaviour. We record which providers readers choose from which positions. Position affects choice as much as the provider does, so we periodically change the arrangement and measure the difference. The ranking reflects what readers actually pick, not only what we think of each service.

Commercial terms. Providers pay us different amounts, on different terms, and those terms change. That affects which arrangements we can afford to run and therefore affects placement. Our affiliate disclosure states this and this page states the mechanism.

What neither of those touches is the content of a review. Placement is commercial. A stated fact is not.

If you want a recommendation with no commercial influence at all, the honest answer is that no affiliate-funded comparison can give you one, ours included. What we can do is tell you how ours works so you can weigh it.

What would change a verdict

A documented breach or logging incident, a failed or withdrawn audit, a jurisdiction change, a material change to the logging policy, or a price change that alters the value comparison. Any of these can move a provider regardless of the commercial relationship. See our corrections and updates policy for how quickly.