Report: Privacy for rent: what VPNs don’t want you to know - 0data

By Kike Gandia · Research · 83 min read

This report takes an in-depth look at who is behind the leading commercial VPNs – ExpressVPN, NordVPN, Surfshark, CyberGhost, Private Internet Access (PIA), ProtonVPN, Mullvad, IVPN, TunnelBear and Windscribe – covering their corporate structure, legal jurisdiction, ties to the advertising or surveillance industries, security controversies, technical audits, the technologies they use, changes of ownership and their presence in Five/Nine/Fourteen Eyes countries (the intelligence-sharing agreements between English-speaking nations and their European allies)

10

commercial VPNs analyzed one by one

2

groups control five of the leading brands (Kape and Nord Security)

~$936M

paid by Kape for ExpressVPN in 2021

14

countries in the Fourteen Eyes alliance, Spain included

The scale of the issue before we get into the provider-by-provider detail.

To begin, a comparison table of corporate ownership, country of registration and status with respect to the intelligence alliances (Five Eyes – US, UK, Canada, Australia, New Zealand; Nine Eyes – the above plus the Netherlands, Norway, Denmark, France; Fourteen Eyes – the above plus Sweden, Spain, Belgium, Germany, Italy):

General trends - The VPN industry is going through corporate consolidation – several leading brands (ExpressVPN, CyberGhost, PIA, and since 2022 also Surfshark and NordVPN under one holding company) now belong to two large groups: Kape Technologies (a London-listed company with roots in Israel) and Nord Security (a group that emerged in Eastern Europe). Others, such as ProtonVPN, Mullvad, IVPN and Windscribe, remain independent, run by smaller privacy-focused companies.

Group 1 Kape Technologies

Listed in London, with roots in Israel. It has absorbed ExpressVPN, CyberGhost and PIA, three of the best-selling brands on the market.

Group 2 Nord Security

A group that emerged in Eastern Europe. Since 2021 it has brought NordVPN and Surfshark together under one holding company.

Outside the groups The independents

ProtonVPN, Mullvad, IVPN and Windscribe remain outside the two big groups, with their own structures.

Consolidation in the sector: who owns what.

Jurisdiction is a crucial factor - Many VPNs chose to register in countries outside the intelligence alliances (e.g. the BVI, Panama, Switzerland) to minimize government interference, although acquisition by companies in Five Eyes countries can introduce new legal considerations. Below, each provider is examined in terms of corporate structure, ties to advertising or surveillance, security controversies, audits and technology, changes of ownership, and exposure to intelligence jurisdictions.

ExpressVPN

ExpressVPN was founded in 2009 and is registered in the British Virgin Islands (BVI). In September 2021 its founders sold the company to Kape Technologies, a UK-based cybersecurity conglomerate with Israeli investors, for approximately $936 million. Kape (formerly known as Crossrider) has a controversial past in the adware industry: in 2015 it was identified as a major distributor of software that injected ads into browsers (e.g. the SuperFish case). After renaming itself Kape in 2018, the company said it had “completely broken with the ad-tech world” to reinvent itself around privacy. Kape also owns other popular VPNs such as CyberGhost, ZenMate and PIA, bringing millions of users under its umbrella.

ExpressVPN has kept its legal entity in the BVI even after the acquisition, taking advantage of the fact that the territory imposes no mandatory data retention. The BVI sits outside the Five/Nine/14 Eyes intelligence alliances, which in theory reduces government pressure; however, its status as a British territory implies a certain legal tie to the United Kingdom. The company stresses that it maintains a strict no-logs policy and BVI jurisdiction as part of its commitment to privacy. After the purchase, Kape stated that ExpressVPN would continue to operate independently, with its own team and standards, keeping its BVI headquarters and zero-logs policy. ExpressVPN executives said they had carried out extensive due diligence to make sure Kape shared their commitment to privacy and that they were satisfied with the assurances they received. Even so, part of the community greeted the news with skepticism given Crossrider’s past; Kape’s credibility on privacy remains something activists and expert users watch closely.

Controversies

In 2021 ExpressVPN was caught up in a controversy involving a senior executive and surveillance activities. In September of that year it emerged that its Chief Information Officer (CIO), Daniel Gericke, had years earlier worked as an intelligence contractor for the United Arab Emirates, taking part in a hacking unit (“Project Raven”) that spied on human rights activists, journalists and US officials. The US Department of Justice fined Gericke and other former operatives for violating hacking and digital-weapons export laws. Surprisingly, ExpressVPN already knew about that background when it hired him – the company admitted that Gericke had disclosed “the key facts” of his history from the outset, and defended the hire on the grounds that his knowledge of adversaries’ tools helped them strengthen the VPN’s security. The revelation upset some ExpressVPN employees, who said internally that the situation could erode users’ trust in the company. In an internal Q&A session, dozens of concerned employees upvoted questions asking how the company’s reputation would be rebuilt now that it was known he held a key position. Management replied that it valued transparency and debate, reiterated its confidence in Gericke based on his performance and said his past did not compromise the company’s principles. Nevertheless, the story was widely reported in the tech press, adding reputational pressure just as the sale to Kape was being announced.

On the other hand, ExpressVPN has highlighted cases in which its no-logs policy was put to the test by governments. A notable example came in 2017 during the investigation into the assassination of the Russian ambassador to Turkey. Turkish authorities seized an ExpressVPN server in an attempt to identify who had used the VPN to delete evidence from the assassin’s accounts. When they inspected the server, they found no logs or data useful to the investigation. ExpressVPN confirmed that, just as its policies stated, the server held no customer activity or connection logs, so it was impossible to link it to specific users. The company said it cooperates with the authorities when it receives legal requests, but because it holds no logs it simply cannot provide identifying information. Turkish police did in fact leave empty-handed, publicly validating ExpressVPN’s privacy promise in a high-pressure situation. This incident – along with other similar ones the company says have occurred – strengthens its credibility among those who demand real no-logging guarantees.

Security audits and technologies used

To give its promises technical backing, ExpressVPN has submitted its service to independent audits. In 2019 PricewaterhouseCoopers (PwC) examined its servers and verified its no-logs policy, confirming that processes were configured not to store sensitive customer data (a report the company has cited publicly). Likewise, ExpressVPN’s browser extension was audited by Cure53 in 2018, and more recently (2022) the company announced it had completed more than 20 external security assessments over its history. ExpressVPN also introduced innovations such as “TrustedServer”, an architecture in which all of its VPN servers run exclusively in RAM and never write data to hard drives. This ensures that any data on a server is lost when it is rebooted or powered off, drastically reducing the risk of information persisting if a server is seized. Since 2019 all ExpressVPN servers have operated in this “diskless infrastructure” mode, which several competitors later adopted. The VPN also routes DNS traffic through its own encrypted private DNS, preventing leaks to third-party resolvers. Feature-wise, it offers split tunneling (letting certain apps bypass the VPN) and robust kill-switch mechanisms (blocking traffic if the VPN drops). Much of its client software is proprietary, but the company has published audit results and specific modules (such as extensions) for scrutiny. Ownership changes and Five Eyes context The 2021 acquisition by Kape was the biggest corporate change in ExpressVPN’s history. It brought the company into a group listed on the London Stock Exchange and subject to the regulations of the United Kingdom (a Five Eyes member). Despite this, ExpressVPN insists that its effective jurisdiction is still the BVI, and that Kape respects its operational autonomy and privacy policies. The BVI is not party to global intelligence agreements and does not require data retention, which in theory provides an important legal umbrella. That said, the double British influence – through the origin of the new parent and the BVI’s status as a UK dependency – is viewed with caution by some. It is worth noting that no case of forced collaboration with intelligence agencies by ExpressVPN has been reported so far; on the contrary, the Turkish case demonstrates its technical resilience to data requests. According to analysts, joining a larger company could provide more resources for security (for example, expanding bug bounty programs or infrastructure), but it also demands an unwavering pro-privacy stance in the face of potential pressure. In short, ExpressVPN combines a track record of technical trust (verified no-logs, RAM-only servers) with some recent reputational challenges (an executive with an espionage past, absorption by a group with a controversial history). Ongoing transparency through independent audits and candid communication with its users will be key to maintaining its credibility in the future.

NordVPN

NordVPN is operated by NordVPN S.A., a company established in Panama in 2012, although it is part of the technology group Nord Security, founded by Lithuanian entrepreneurs. The choice of Panama as the country of registration was driven by privacy considerations: Panama lies outside international surveillance jurisdictions (it is not part of Five/Nine/14 Eyes) and imposes no data retention laws applicable to VPN services. Officially, NordVPN says it “operates under Panamanian jurisdiction”, but it should be pointed out that Nord Security has an international presence, with offices in Lithuania, the United Kingdom, the Netherlands and other European countries. In fact, the company originated in Vilnius (Lithuania) under the umbrella of a local incubator called Tesonet. This corporate connection sparked controversy in 2018: Tesonet is also involved in data mining (selling large volumes of web data under the Oxylabs brand). Court documents from a patent case indicated that Tesonet had a “business relationship” with NordVPN, which led to speculation that NordVPN might be part of data-collection activities. Competitors and researchers (including PIA’s CEO, Andrew Lee) fanned these allegations on public forums at the time. NordVPN responded categorically that while it maintains “close ties” with Tesonet, it operates independently through the Panamanian company Tefincom S.A. and that Tesonet has never had legal ownership of NordVPN. According to NordVPN, Tesonet provided it with some infrastructure and support services under contract, with no access to sensitive data and no influence over the no-logs policy. The company emphatically denied any involvement in the Hola/Luminati case involving the rerouting of user traffic (a case in which Tesonet was sued). To dispel doubts, in 2018 NordVPN announced it had hired one of the Big Four audit firms to verify its no-logs policy, marking the start of a series of regular external audits. In short, NordVPN has had to navigate suspicions stemming from its business roots in an adtech environment, but it has worked hard to demonstrate its operational independence and commitment to privacy through transparency and audits.

In terms of its current corporate structure, NordVPN is one of the flagship products of Nord Security (formerly NordSec), a company that has diversified into other services (password manager, file encryption, etc.). In 2022 Nord Security brought in outside investment for the first time, raising $100 million in a Series A round that valued the company at $1.6 billion. Part of those funds went toward expanding through the merger with Surfshark – another VPN provider from the same region – under a single holding company, announced in February 2022. Since the merger, NordVPN and Surfshark share owners but operate as separate brands, with infrastructure and policies that are gradually converging (for example, both are adopting similar server technologies). For users, NordVPN is still run mainly by staff in Europe (Lithuania) but with its legal entity in Panama. This dual jurisdiction means that, although the company invokes Panamanian protection, its offices in Fourteen Eyes countries (the United Kingdom, the Netherlands, Lithuania – the latter cooperating with the EU/NATO although not formally part of Nine Eyes) could be subject to some local laws. Nevertheless, to date NordVPN says it has not received any legal orders compromising its users’ privacy, and if it did, it could fall back on the protection of its Panamanian headquarters.

Technical audits, no-logs and security improvements

NordVPN has placed great emphasis on technically backing its “zero logs” promise. In November 2018 it announced that PricewaterhouseCoopers AG had audited its servers and verified that it does indeed not log user activity. It was one of the first VPNs to put its no-logs policy under scrutiny at this level. Later, in 2020–21, NordVPN commissioned the cybersecurity firm VerSprite to carry out security audits of its client applications, including penetration testing; according to the report, no critical vulnerabilities were found and the few minor flaws identified were patched immediately. In 2019 the company also launched a public bug bounty program so researchers could report flaws.

A turning point in its security practices came after an incident in 2018 (disclosed in October 2019) in which NordVPN suffered unauthorized access to a server in Finland. An attacker exploited a remote management tool left behind by the leased data center, managing to compromise the server. NordVPN confirmed the incident publicly: the intruder was able to obtain an internal digital certificate (a TLS private key) that could potentially have allowed them to stand up a fake server and attempt to intercept traffic. The company stressed that the server held no user activity logs or credentials, and that capturing real traffic would have required a very sophisticated man-in-the-middle attack limited to a short window. There was no indication that the attacker actually spied on user data, but the news understandably worried customers and experts, as it exposed attack vectors in the server supply chain. NordVPN’s response was forceful: it immediately accelerated its migration to its own “colocated”, diskless (RAM-only) servers. In 2019 it announced the rollout of servers running 100% in RAM and full control over infrastructure in sensitive locations. It also terminated contracts with unreliable data centers and began rotating keys frequently. Since October 2019, NordVPN has reaffirmed its security posture with additional audits and transparent statements. By 2020 it had launched its first “colocated” servers in Finland – that is, hardware owned by NordVPN rather than leased, with restricted access – strengthening physical and administrative security.

When it comes to technologies and features, NordVPN stands out for protocol innovation: it developed NordLynx, its custom implementation of WireGuard, which introduces a double NAT system to avoid storing user identifiers in sessions. This makes it possible to harness WireGuard’s speed while preserving privacy (plain WireGuard assigned fixed IPs to users on the server, which NordLynx resolves dynamically without logs). NordVPN also offers advanced features such as Double VPN (chaining two VPN servers in different countries for multi-hop), Onion over VPN (a direct connection to Tor after the VPN tunnel) and a malware/ad blocker called Threat Protection, which since 2022 also includes an optional antivirus. This module blocks web trackers, malicious URLs and infected files at the client level. NordVPN routes all DNS queries through encrypted tunnels to its own servers, preventing leaks. The company has published part of its code: for example, its Linux client has been open source (GPLv3) since 2018, and it has released tools such as a speed tester on GitHub. Most of its backend infrastructure remains closed for security reasons, but its focus on transparency is reflected in the number of external audits and incident reports it has published.

Controversies

NordVPN has shown a pro-privacy profile on public policy. In 2019, when Russia passed laws requiring VPNs to censor banned websites, NordVPN refused to comply and shut down its servers in Russia in April of that year. It preferred to stop operating physically in Russia rather than submit to the state registry, which would have compromised its service. Similarly, in 2022 India issued rules requiring VPNs to log users’ personal data for 5 years; NordVPN immediately announced it was pulling its servers out of India so as not to violate its no-logs policy. These examples show that NordVPN is willing to leave markets rather than change its privacy practices, a stance digital rights activists view favorably.

Even so, NordVPN has faced criticism for aggressive marketing practices and partnerships. It has been questioned for sponsoring influencers and review sites on a massive scale, which some see as a conflict of interest in the objective evaluation of VPNs. However, this is more an image issue than a technical one. Purely on the privacy front, the main controversy was the Tesonet connection mentioned above and the 2018 security incident. Having moved past those episodes, NordVPN now enjoys a fairly solid reputation with the general public, although advanced users continue to keep an eye on its performance. In April 2022 the brand received a vote of confidence when it raised money from high-profile investors (including Iceland’s Novator fund) at a multibillion-dollar valuation, a sign of confidence in its growth and perhaps a prelude to a possible IPO. For investors, NordVPN is one of the leading players in a booming market, with an estimated ~14 million users worldwide.

As for its exposure to intelligence jurisdictions, NordVPN maintains that, being based in Panama, it is not subject to Five Eyes requests. Panama has no comparable intelligence-sharing agreements and offers constitutional protection for correspondence and private communications. In addition, NordVPN does not keep useful data (as it demonstrated in the hacking incident: there were no logs or credentials to expose). That said, the presence of staff and infrastructure in Europe means that Nord Security could receive local orders (for example, a UK order could force its London office to cooperate). The company would probably mitigate this by keeping the handling of sensitive data outside those jurisdictions, something its distributed structure makes easier. So far there is no known case of NordVPN handing information over to the authorities. A former US government lawyer even stated in a case (unrelated to NordVPN) that “some VPNs like NordVPN don’t retain logs, so they cannot respond to subpoenas”, underlining that even law enforcement is aware of this technical limitation. Out of caution, ultra-careful users might prefer services in even more neutral countries, but NordVPN has positioned itself as an option that combines high performance with good privacy practices, with a track record that – apart from the 2018 mishap – shows no serious breaches or improper cooperation.

Surfshark

Surfshark burst onto the VPN industry in 2018, originally established in the British Virgin Islands as Surfshark Ltd. Shortly afterward it gained recognition for its rapid feature development and competitive pricing. In October 2021 Surfshark decided to move its headquarters to the European Union, relocating the company to the Netherlands as Surfshark B.V. The company explained that the Netherlands offers a legal environment with no data retention obligation for VPN services and aligned with the GDPR (which protects users’ privacy). The move to Europe technically placed it in a Nine Eyes country, which raised questions in the community, since the BVI was considered a privacy haven. Surfshark defended the change, saying it does not mean keeping logs – it simply wanted to operate in a more transparent environment that was more accessible for partnerships (and possibly to prepare for future investment). In fact, the decision coincided with bigger corporate moves: in January 2022 Surfshark announced its merger with Nord Security, NordVPN’s parent company. The merger (structured as an agreement between the shareholders of both companies) brought two of the fastest-growing VPNs under one holding company. Surfshark and NordVPN stated that they would continue to operate independently in terms of brands, product development and policies, but would share know-how and some technical resources. Since then, some practices have been aligned (for example, both adopted RAM-only servers and features such as data breach alerts).

Before the merger, Surfshark already had offices in countries such as Lithuania, Poland and Germany, reflecting the fact that its founders came from the same tech region as Nord (the Baltic states). Surfshark is believed to have been driven from the start by Lithuanian talent (some analysts speculate about informal ties to Tesonet, given shared staff, although the company always presented itself as separate until it joined Nord Security). Since its integration in 2022, Surfshark belongs to the same group as NordVPN and therefore to the same majority owners (Nord Security’s founders and new investors). For users and investors, this means NordVPN and Surfshark share financial backing and technology development, although they maintain different marketing strategies and positioning (NordVPN is the more established brand, while Surfshark targets a younger audience with aggressive pricing and bundled extras).

In terms of jurisdiction, Surfshark’s operating entity is subject to Dutch law. The Netherlands is a Nine Eyes member, but it also has a tradition of respecting digital privacy. There are no reports of Surfshark being forced to cooperate with intelligence agencies; the company says it has not received any order that compromises its principles, and if it did, it would be expected to challenge it or, as a last resort, shut down operations in that region rather than comply (a stance its sister company NordVPN demonstrated in India and Russia). For now, Surfshark operates in ~100 countries and manages its network from the EU, with no known legal incidents.

Independent audits and security measures

Surfshark sought external validation of its security early on. In 2018, just months after launch, it had its browser extensions (Chrome/Firefox) audited by Cure53, a respected German cybersecurity firm. The results were positive, with only 2 low-severity findings, which lent credibility to the young VPN. Later, in 2021, Surfshark again invited Cure53 to audit its entire VPN infrastructure and servers; this 2021 audit also concluded with no critical vulnerabilities, showing maturity in its security practices. An important step came in late 2022, when Surfshark announced that Deloitte (a Big Four firm) had reviewed its no-logs policy and server configuration. In January 2023 it was confirmed that Deloitte found no evidence of user logs in Surfshark’s systems, validating that its architecture is designed as promised (report available to customers). This put it on a par with other major VPNs that had also obtained “no-logs” attestations from auditors (ExpressVPN, NordVPN, PIA, CyberGhost, etc.). Surfshark also publishes an annual transparency report with statistics on the government requests it receives (e.g. legal requests for data) and how many it was able to fulfill; it typically reports zero data provided given its no-logging.

On server technology, Surfshark quickly adopted industry best practices: in 2020 it migrated its entire network to “100% RAM” servers, eliminating local hard drives. Any reboot wipes all content, mitigating seizure risks. In 2022 it also implemented a proprietary system called Nexus, which interconnects all its servers in a software-defined network. This enables advanced features such as IP Rotator (your exit IP can change dynamically during a session without disconnecting) and dynamic MultiHop, where users can exit through random pairs of countries for greater anonymity. These capabilities set Surfshark apart on innovation. The VPN also includes “CleanWeb”, a DNS-level ad, tracker and malware blocker for all traffic passing through the VPN tunnel. CleanWeb uses its own DNS resolvers that filter malicious domains, improving users’ privacy and security while browsing. Surfshark supports the modern OpenVPN and IKEv2 protocols and introduced WireGuard in 2020 to deliver high speeds with strong encryption.

It is worth noting that many of these improvements came before its merger with Nord, showing its commitment within a short time. Following the alliance, Surfshark and NordVPN are likely to share future audit efforts and unify standards (in fact, in 2023 both obtained the VPN Trust Initiative badge after passing best-practice assessments). Also in 2022, like NordVPN, Surfshark pulled its servers out of India rather than accept the new data retention rules imposed by that country’s government. This confirmed that Nord Security’s pro-privacy philosophy extends to Surfshark. Controversies

Being newer, Surfshark has not faced major public controversies in terms of security breaches or privacy scandals. There is no record of hacking incidents or data leaks on its servers. One factor some people watch is its rapid marketing-driven growth – the VPN won market share through aggressive long-term discount campaigns, affiliates and a strong YouTube presence, which brought it many users but also criticism over whether such prices can sustain secure development. So far, it has delivered on investing in security (as the audits show). Its integration with NordVPN raised some initial concerns among users about a possible reduction in competition or a monopoly, but for now the two brands remain distinct in plans and focus, and even compete in certain rankings. Among activists and advanced users, Surfshark is generally considered trustworthy, although a notch behind veterans such as ExpressVPN or ProtonVPN in terms of track record. However, its adoption of transparent policies (such as publishing the source code of its infrastructure analysis tool, or its public commitment to digital rights projects) is closing that reputational gap.

Legally, being in the Netherlands, Surfshark could receive orders from Dutch or European authorities. However, as of 2023 the Netherlands has no specific laws requiring VPNs to store data. The EU is pushing instead for voluntary guidelines; to date there is no indication that Surfshark has been compromised by any request. In fact, as a founding member of the VPN Trust Initiative, Surfshark has committed to upholding high standards of privacy, honest advertising and transparent disclosure across the industry. Its CEO has voiced opposition to mass surveillance initiatives in interviews. In conclusion, Surfshark has gone in a short time from newcomer to part of a VPN giant (NordSec) – and it has done so without scandals, with several security certifications and an enthusiastic adoption of modern protection technologies. It will be important to watch how it maintains operational independence and whether its streak of zero notable security incidents continues, while it navigates the implications of being in a Nine Eyes country. For now, the verifiable facts paint Surfshark as a technically solid service aligned with privacy principles, backed by one of the biggest players in the sector.

CyberGhost

CyberGhost is a veteran provider founded in 2011 in Romania, originally created by Romanian-German entrepreneurs. It operates through CyberGhost S.A., headquartered in Bucharest, and gained early fame for offering an easy-to-use service and proclaiming a strict no-logs policy backed by Romanian law (which, following European court rulings, does not require retention of VPN users’ data). In 2017 CyberGhost was acquired by what was then called Crossrider (later renamed Kape Technologies) for around $9.2 million, marking Kape’s entry into the VPN market. London-based Kape Technologies is today the parent company of CyberGhost, as well as of PIA, ExpressVPN and other privacy brands.

Kape’s corporate history colors how CyberGhost is perceived: as detailed above, Kape (formerly Crossrider) was associated with adware distribution in the last decade. Although Kape says it has reinvented itself since 2018 as a privacy company, some users were wary of a trusted VPN like CyberGhost passing into the hands of a former “malware distributor”. Kape tried to ease those doubts by keeping CyberGhost as a separate unit – its development and operations stayed in Romania, with its own team, although obviously reporting to Kape’s management. Since the acquisition, CyberGhost has greatly expanded its user base (it is one of the most popular services in Europe) and its global server network, benefiting from Kape’s investment.

Romania, where it is still based, is outside Five/Nine/14 Eyes. In addition, in 2014 its Constitutional Court struck down the local implementation of the EU Data Retention Directive, reaffirming that ISPs/VPNs are not required to keep traffic metadata. CyberGhost relies on this to state that it keeps no identifiable activity or connection logs of its customers. In fact, after intense privacy scrutiny in the EU, Romania stands out as a favorable environment for a VPN service (in contrast to countries such as the United Kingdom or Australia, with more intrusive laws).

Today CyberGhost is wholly owned by Kape, a company listed on the London Stock Exchange. This means that, through its parent company, it is indirectly under UK (Five Eyes) jurisdiction. However, Kape has chosen to keep each brand in its original jurisdiction for now: CyberGhost is still operated by the Romanian entity, PIA by the US entity, ExpressVPN by the BVI entity, and so on. This dispersed structure could be seen as a way of leveraging the legal strengths of each location (e.g. the BVI or Romania, with no retention). Nevertheless, if Kape’s parent company were to receive an order in the United Kingdom concerning any of its subsidiaries, the legal situation could become complex – for example, a British order might not compel Romania to comply, but Kape could decide to cooperate internally. It is a hypothetical scenario that worries some privacy purists.

Privacy policy and audits

CyberGhost has tried to set itself apart through transparency. It publishes annual transparency reports detailing how many legal requests (police, DMCA, etc.) it receives and how it handled them. Invariably, it reports that it could not fulfill those requests because it keeps no logs linking IPs or activity to individual users. This claim was recently strengthened by an independent audit of its no-logs infrastructure by Deloitte. In September 2022 CyberGhost invited Deloitte to inspect its VPN servers and management systems to verify that they do not store personal data. The audit concluded in January 2023, confirming that “nothing has come to our attention that causes us to believe that CyberGhost’s system and infrastructure configuration does not correspond to its no-logs statements”, as reported by Deloitte. In other words, the auditors found no evidence of any identifying logs stored on the servers. They also validated that operational processes (access, change management, etc.) respect the promised privacy. This was the second no-logs audit CyberGhost has successfully passed (the first was in 2021, also by Deloitte Romania). It is worth mentioning that Kape has extended this process to its other brands: PIA and ExpressVPN have likewise passed no-logs audits by Big Four firms in 2022–2023, bolstering the conglomerate’s credibility with skeptics.

On technical security, CyberGhost said in 2019 that it would migrate to RAM-only servers. By 2021–2022 it confirmed that all its servers run inside ephemeral containers with no persistent storage. As TechRadar explained, all CyberGhost services run in volatile containers, which means “there are no hard drives attached; on shutdown or reboot, any data vanishes”. In addition, the infrastructure is designed to record only minimal real-time operational information, such as the number of connections per server (for load balancing) and raw bandwidth usage, with no data that could identify a user. This is in line with industry standards and was verified by the auditors. CyberGhost also offers specialized servers called NoSpy in Romania, which are “100% owned and managed in-house” (located in its own private data center) for users seeking maximum trust. Although this is more of a marketing initiative launched after the Kape acquisition, it shows that the company directly controls critical hardware in a safe jurisdiction.

In 2016 CyberGhost was one of the first VPNs to publish the source code of its then-new ad-filtering system (similar to an ad blocker), demonstrating its commitment to openness. Its main applications, however, are not open source. At the protocol level, it supports OpenVPN, IKEv2 and WireGuard (added in 2021). It also offers optional dedicated IPs through an anonymous token system (users buy a token and redeem it in the app to be assigned a fixed IP, so that not even CyberGhost can link which user received which IP, since the token is redeemed without identifying authentication). This innovation (similar to the one PIA and others implement) makes it possible to have dedicated IPs without sacrificing anonymity. The app also includes a malicious content blocker, data compression for mobile browsing, and split tunneling on supported platforms.

Controversies

CyberGhost itself has had no known security breaches or customer data leaks. One of the few public incidents was in 2019, when it was alleged that user data from multiple VPNs had been exposed in a leak; rumors initially pointed at CyberGhost, but it turned out to involve a different provider (a low-reputation “clone”). CyberGhost denied any leak and there was no evidence to the contrary, leaving its record relatively clean in that respect. Another minor controversy came in 2016, when the company decided to shut down its servers in Russia after that country demanded surveillance, much as NordVPN and others would later do. CyberGhost did not seek much publicity over it, but it was part of the trend of Western VPNs pulling out of Russia for privacy reasons.

The main concern about CyberGhost stemmed from how its new owner, Kape, was perceived. In 2019, when Kape announced its purchase of PIA (another highly respected VPN), the privacy community was up in arms, recalling that Crossrider (Kape) had distributed malware years earlier. This debate revived questions about CyberGhost too: can we trust a VPN owned by a firm with a murky past? CyberGhost executives argued that Kape has taken steps to earn trust – for example, it kept the CyberGhost team in Romania operating autonomously and funded projects such as the Deloitte audits, which an independent CyberGhost might not have been able to afford. Kape also hired figures from the privacy industry (such as ExpressVPN co-founder Harold Li, now on its board) to strengthen its image. In official communications, CyberGhost says Kape has respected its privacy practices and raised them to public standards. Since, after several years, no concrete scandal of data misuse has emerged at any Kape brand, some of the initial skepticism has faded. Even so, it is understandable that users who are extremely focused on security prefer independent VPNs.

In practice, Romania remains a legal bulwark for CyberGhost: it is not part of Fourteen Eyes, it has not implemented censorship proposals as other countries have, and its intelligence agency (SRI) would not have easy access to CyberGhost data without a court order, which would hardly succeed given that there are no logs. Even if Kape in the UK received a request, it could not extract logs that do not exist. One development to watch is Kape’s intention to integrate or unify services. In 2021 Kape also acquired several VPN review websites, which drew criticism over conflicts of interest. Although this does not affect CyberGhost technically, it does affect the ecosystem in which it competes. For investors, having CyberGhost, ExpressVPN and PIA under one roof creates synergies (6+ million combined users in 2021, according to Kape), but for users it means less real diversity of choice.

To sum up, CyberGhost remains a trustworthy VPN with a long track record, now backed by a large group. It has demonstrated its no-logs commitment to external auditors, implemented secure (RAM-only) infrastructure and navigated corporate changes without security incidents. Its biggest challenge is convincing the most critical segment of the privacy community that belonging to Kape does not compromise its integrity. So far, the facts support its promises: no leaks, no data handovers, no known backdoors. As long as it maintains this record and keeps publishing warrant canaries or transparency reports, CyberGhost will remain one of the most respected mass-market VPN options in the European market.

Private Internet Access (PIA)

Private Internet Access (PIA) was founded in 2010 in the US (California) under the parent company London Trust Media, Inc. – a curious name given that it was essentially American (the “London” comes from an earlier project of the founders). PIA quickly won the loyalty of tech-savvy users through its strong privacy stance: it was one of the first VPNs to open-source its clients (the code for its desktop and Android apps has been published on GitHub since 2018) and to accept anonymous payment via cryptocurrencies and gift cards. PIA operated independently for almost 9 years, growing to millions of subscribers, until in November 2019 it announced its merger with Kape Technologies. Kape acquired PIA for $95.5 million, adding another prestigious brand to its portfolio. Since then PIA has been 100% owned by Kape (UK). After the purchase, Kape also integrated other PIA assets, such as its Intego antivirus software and the news site Privacy News Online.

Even before the acquisition, PIA had some interesting corporate connections. Its founder, Andrew Lee, is a free software and cryptography enthusiast; he was co-owner of the Freenode chat network (which led to drama in 2021 when he transferred its management, but that is unrelated to the VPN). In 2018 PIA surprised everyone by appointing Mark Karpelès, former CEO of Mt. Gox (the famous Bitcoin exchange that collapsed in 2014 after a massive theft), as CTO. Karpelès had been convicted in Japan over negligence at Mt. Gox, so his hiring caused controversy, although PIA said his technical expertise would be valuable. Karpelès did not last long in the role and there were no known incidents involving him at PIA, but it is an example of PIA’s eccentric corporate profile. Another fact: PIA was created partly to protect users of IRC (Internet Relay Chat), as Andrew Lee was concerned that users’ IPs were exposed on those channels. In fact, PIA was born with the mission of making online privacy mainstream.

Under Kape since 2019, PIA benefits from belonging to a larger group (sharing resources with CyberGhost, ExpressVPN, etc.). Its legal entity is still the US company LTM, Inc., headquartered in Colorado, which means it is subject to US jurisdiction (a Five Eyes member). Being a US-based VPN has always been a double-edged sword: on the one hand, PIA has been very vocal in arguing that being in the US does not prevent it from being no-logs, saying that “if we don’t store anything, we can’t hand anything over, even under a court order”. And it has proven this in practice (see the next section). On the other hand, the US has powerful intelligence agencies and a history of mass surveillance (the PRISM program, etc.), so some international users are wary of any service based there. Aware of this perception, PIA published an article titled “5 really wrong myths about US-based VPNs”, arguing that geographic location matters less than technical measures. In 2020, after the Kape acquisition, PIA added new servers in additional locations (leveraging CyberGhost’s network) and overhauled its network into what it calls the NextGen Network, with better hardware and many servers running in RAM.

A no-logs policy proven in court

PIA stands out as one of the few VPNs whose “no-logs” claims have been proven in open court more than once. An early example came in 2016: the FBI requested data from PIA during an investigation into bomb threats (the case *U.S. vs. Cox, District of Massachusetts). PIA responded that it could not link its service’s IPs to users because it simply does not keep those logs. In 2018 another high-profile case reaffirmed this: in a hacking trial in California (U.S. vs. Colby), evidence was presented that certain IPs used in intrusions belonged to PIA nodes. Called to testify, John Arsenault – PIA’s general counsel – stated under oath that PIA “does not retain logs of its customers’ activities”. He explained to the jury that, since it keeps no connection or traffic logs, PIA could not provide useful information in response to a subpoena. He also added that PIA accepts multiple payment methods (including cryptocurrency) and does not require a real name – only an email address – to sign up, and that the only thing its systems hold is the customer’s email address. The same case showed that the FBI was able to obtain evidence through the defendant’s local ISP, but not through PIA. The judge and jury noted that PIA, by design, could not link the malicious activity to a suspect, reinforcing its no-logs claim. In its coverage of the trial, TorrentFreak pointed out that this was already the second time PIA had passed this test in court “with flying colors” (the first was in a 2015 case in the Southern District of New York, which also confirmed that it had no identifying data to hand over).

PIA proudly cites this track record on its official website: “PIA is one of the few VPNs whose zero-logs policy has been proven in real life – we have been subpoenaed several times and have never been able to provide logs, because we don’t have them.” For many privacy activists, this is more convincing than any audit. Even so, PIA also took the independent audit route. In 2022, under Kape’s aegis, it invited Deloitte to audit its network and systems. In July 2022 Deloitte Audit Romania issued a report stating that, as of June 30, 2022, PIA’s server configuration was aligned with its internal privacy policies and “is not designed to identify users or their activities”. In essence, this certifies that no logs are stored and that there are no hidden identification mechanisms. Although PCMag had criticized PIA in 2021 for not yet having undergone an external audit, that audit has now happened and PIA has published a summary of it, raising its credibility with more mainstream users.

Technical security and features

PIA has always kept a lower profile on marketing but a robust one on the technical side. It pioneered a reliable kill switch in its apps to prevent IP leaks when the VPN drops. It also introduced its PIA MACE feature early on, a DNS-level ad and malware domain blocker built into the VPN (since ~2017). Similar to Surfshark’s CleanWeb or Nord’s Threat Protection, it transparently blocks requests to known trackers as you browse, with no need for additional extensions. PIA adopted WireGuard very quickly once it stabilized (in 2020) and worked with WireGuard’s author, Jason Donenfeld, to integrate it in a way that did not compromise anonymity. In fact, PIA sponsored part of WireGuard’s development.

In 2020 it migrated to the NextGen VPN Network mentioned above, replacing old servers with new ones featuring full-disk encryption, greater capacity (10 Gbps ports) and many operating as RAM-disk servers (with no persistent storage). Kape has reported that by the end of 2021 it had completed PIA’s transition to volatile servers similar to ExpressVPN’s. PIA also extended its global network to more than 84 countries, including locations not previously covered.

All of PIA’s software has been open source since 2018: “desktop client & Android under GPLv3, iOS under MIT”, something few large-scale VPNs have done. This allows third parties to audit the code for backdoors (and indeed the community has contributed fixes to PIA via GitHub). PIA maintains public repos that show its ongoing commitment to this code transparency. PIA also regularly publishes its “Warrant Canary”, a notice on its site stating that to date it has not received Patriot Act orders, NSLs or orders with gag provisions. If one ever arrived, it has committed to removing the canary, which would indirectly alert users. So far it has never had to take it down (it is updated monthly stating “no secret orders received”).

One point worth highlighting: PIA has responded with action to anti-privacy policies in various countries. In 2016, when Russia demanded that VPNs cooperate with censorship, PIA was among the first to shut down all its servers in Russia and leave the country, stating publicly that “we do not accept censorship or surveillance, so we are pulling out” (and it refunded Russian users). It did the same in 2020 with its servers in Hong Kong after China’s security law; PIA predicted that the new law could force companies to hand over data, so it prudently ceased operations there. This pro-privacy activism has reinforced its image as an ethical service.

Mergers, controversies and Five Eyes

The integration into Kape (2019) caused controversy on forums, with users worried that PIA “had sold out to a company with a questionable history”. PIA tried to reassure them with a Reddit post titled “Our merger with Kape Technologies – addressing your concerns”. In essence, it said that its team and principles remained intact, and that Kape would provide resources to improve infrastructure without interfering with the no-logs policy. It acknowledged Crossrider’s past but asked to be judged on its present actions. Over time, it appears that PIA’s service has not changed for the worse: on the contrary, it improved technically (NextGen network, more servers) and validated its no-logs policy with an audit. There have been no reports of users abandoning PIA over post-acquisition problems; most of the criticism continued to come from competitors or purists who prefer, as a precaution, not to be under Kape.

Operating in the United States (Five Eyes) will always be a sensitive issue for PIA. Ironically, however, PIA has demonstrated its loyalty to users on US soil by not handing over data even in serious investigations. In fact, the 2018 case in San José led to the dismissal of one of the serious charges against the defendant, partly because no evidence of the accesses via the VPN could be obtained, thanks to the absence of logs. This is a clear example of how Five Eyes jurisdiction loses weight if the architecture does not allow surveillance. A prosecutor could demand that PIA “hand over whatever you have”, and PIA can only provide a handful of useless bytes (the customer’s email address and subscription date).

It is worth noting that the US has no laws requiring VPN data retention at the federal level. It does, however, have secret orders (NSLs) that can force real-time surveillance. This is where PIA’s canary comes in: so far, there is no sign that an NSL has been received. If US authorities ever served it with an order to log a particular user’s future activity, PIA is technically not equipped to do so (it would have to modify its system, something that, if done, would very likely leak). PIA would have the option of fighting it in court or simply shutting the company down rather than becoming complicit – an extreme but possible measure (Lavabit, a US secure email service, did something similar in 2013 when the FBI wanted its master key: it chose to shut down). Given the background of PIA’s founders, one would expect them to stand up to any attempt at co-optation.

In short, PIA combines the technical robustness of a well-verified no-logs service with the “perceived risk” of being based in a Five Eyes country. So far it has handled that risk very well, even turning it into courtroom success stories that demonstrate its seriousness. Since its acquisition, no new controversies are known; rather, PIA continues to receive good ratings in reviews (4/5 from TechRadar in 2021, highlighting its kill switch, torrent-friendliness and no-logs policy, with the only criticism being that as of 2021 it still had no audit – a criticism since addressed with Deloitte). For investors, PIA is an integral part of Kape’s strategy to dominate the VPN sector in North America; its loyal user base and hard-won reputation make it a valuable asset. For users and activists, PIA remains one of the trusted “classic” VPNs, with a long history of defending privacy even under legal pressure. The key will be to monitor that Kape keeps those policies intact in the long term, and that PIA keeps innovating on transparency (e.g. continuing its open-source practice and publishing the results of future audits). For now, the verifiable facts confirm that PIA not only promises privacy but has backed it up in the most demanding arena of all: a court of law.

ProtonVPN

ProtonVPN is the VPN service launched in 2017 by the same company behind ProtonMail (the popular encrypted email provider). Its parent company is Proton AG, headquartered in Geneva, Switzerland. Proton was founded in 2014 by CERN scientists (Andy Yen, Jason Stockman and others) with the goal of providing secure communications and online privacy in response to the mass surveillance programs revealed by Snowden. This heritage strongly shapes ProtonVPN’s culture: it is run almost like an activist technology project, prioritizing privacy even over commercial considerations.

Proton deliberately chose Switzerland for its favorable legal framework. Switzerland is not part of Five, Nine or Fourteen Eyes, and it has very strict data protection laws. Moreover, although it cooperates internationally in criminal cases, it is not bound by EU directives or by intelligence agreements such as those of the US/UK. In 2010 Switzerland revised its Surveillance Act (BÜPF) to require traditional telecom providers to retain metadata, but services that “merely transport” data (such as VPNs) are not required to retain traffic. ProtonVPN is categorized as such, unlike ProtonMail, which as an email service falls into another legal category. This means that ProtonVPN can legally operate without keeping any connection logs, and Switzerland cannot force it to do so except through a new law (unlikely in its context). In fact, ProtonVPN explicitly states that it keeps no logs of assigned IPs, connection timestamps or DNS requests.

ProtonMail/ProtonVPN’s reputation is very high among activists, but not free of controversy. In 2021 ProtonMail faced criticism after it was forced, by order of the Swiss authorities following a Europol request, to log the IP address of a French activist who used ProtonMail, which led to his arrest. ProtonMail did not encrypt the source IP (by design, for spam mitigation) and complied with the order after exhausting its appeals, since in Switzerland email services are required to cooperate in investigations of serious crimes. Proton explained that it could not legally refuse, but stressed that ProtonVPN, by contrast, cannot be compelled in the same way. It indicated that if the activist had used ProtonVPN, his identity would have been better protected, because Switzerland does not usually apply surveillance to no-logs VPNs and would prefer other methods. Even so, the incident was a wake-up call: it showed that no jurisdiction is infallible if there is enough legal pressure. Proton took action: it added the option of using ProtonMail via Tor and strengthened the transparency of its reports. As for ProtonVPN, to date there is no known public case of this kind involving it, which suggests it has not received orders compromising its service (and possibly, if they did arrive, ProtonVPN might choose to switch off specific servers rather than implement logging, given its ethos).

In 2020 ProtonVPN was integrated more closely with ProtonMail under the Proton AG umbrella; combined plans were offered and accounts were unified. There have been no external ownership changes – Proton remains independent, funded by its users (although in its early days it received grants from institutions such as MIT/ETH Zürich and EU funding for the development of encryption technologies). This reassures its users, since it does not depend on large corporations or venture capital with possible hidden agendas. In 2022–2023 Proton AG did seek growth investment (reports mention ~$50M raised from Swiss and European funds), but the founders retain majority control and the company remains registered in Switzerland.

Security audits and open source

ProtonVPN has been a strong advocate of open source. In January 2020 ProtonVPN released the source code of all its applications (Windows, macOS, Android, iOS, Linux) and at the same time published the results of independent security audits carried out by the firm SEC Consult. The move – being the “first VPN to open-source all its clients” – was widely praised. The audits, whose summaries are public, found only low- and medium-severity vulnerabilities in some applications, which Proton fixed immediately. For example, a couple of local escalation vectors were found in the Windows 1.2 app, and they were already patched in version 2.0. SEC Consult concluded that overall security was solid. Each ProtonVPN repository on GitHub includes a Security Assessment Summary. This transparency lets the community continuously inspect the code for improvements or potential flaws, providing a very high level of trust. ProtonVPN also runs a bug bounty program for researchers.

In addition to auditing its applications, ProtonVPN has had its infrastructure reviewed. In 2022 the firm Securitum carried out a penetration test of the server components that implement the Secure Core functionality (see below), with no critical issues disclosed. And in 2023 Cure53 audited the security of its new command-line application for Linux, again with good results. Proton publishes whitepapers detailing its architecture and threat model for public scrutiny.

On the technical front, in 2023 ProtonVPN implemented a post-quantum encryption system (based on NIST candidate algorithms) as an option in its WireGuard tunnels for Linux users, anticipating future cryptographic threats. It also frequently rolls out innovations in its anti-censorship infrastructure: it has Stealth servers designed to circumvent blocking in countries such as China and Iran (using obfsproxy and DPI traffic-camouflage techniques). These improvements are often tested first by activists and then integrated into the main app.

ProtonVPN uses only high-security dedicated servers in trusted data centers (it avoids virtual VPSs). Several of its “core” servers are housed in physical bunkers: for example, it has one in a former military shelter in the Swiss mountains, and another in a data center under 1 km of rock in Iceland, making physical protection part of its value proposition. Some of these facilities are the ones used for Secure Core.

Key features: Secure Core and a zero-logs policy

One of ProtonVPN’s flagship features is Secure Core, a multi-hop design that routes the user’s traffic first through an ultra-secure server in Switzerland, Sweden or Iceland, and from there to the final VPN destination. The idea is to mitigate the threat of a VPN server in a high-risk country being compromised: even if an adversary controlled an exit node (say, in Turkey), the traffic would already have passed through a “core” server operated by Proton in a safe location (e.g. its Swiss bunker), so the user’s real IP never appears on the Turkish server. Secure Core offers a double layer of privacy and is available to users on the Plus/Visionary plans. Internally, it means ProtonVPN maintains its own internal network between facilities in those trusted countries and the rest of its nodes. This approach reflects Proton’s constructive paranoia.

ProtonVPN also includes as standard an ad and tracker blocker called NetShield, which filters malware, phishing and ad-tracking domains via DNS. It can be configured at three levels (off, block malware, block malware + ads) and runs on the VPN servers, improving performance compared with local extensions. Another useful feature is VPN Accelerator, which optimizes OpenVPN connections using multithreading and TCP tuning, improving speeds by up to 400% on long-distance connections (Proton published a technical blog post about this improvement in 2021).

As for its no-logs promise, ProtonVPN says it does not log or retain any information about its users beyond what is strictly necessary for the subscription (account email, payment details). It does not log connection metadata or bandwidth consumed. Its privacy policy is very clear on this. This has been indirectly validated: in 2019 the Russian authorities tried to block ProtonVPN (as well as ProtonMail) when the company refused to cooperate with censorship; ProtonVPN told Russian users how to get around the block and never gave in. There have also been censorship attempts in Iran, and ProtonVPN turned its status page into an accessible mirror to guide Iranian users. To this day, ProtonVPN has not been involved in any case in which customer privacy was compromised, whether through its own actions or a breach. In its transparency report, Proton states how many legal orders it receives (typically very few) and that so far none could be fulfilled with user data, because there is none.

An anecdote: in 2020 France’s Interior Minister publicly complained that terrorists were allegedly using ProtonVPN to hide. Proton replied that it condemns any criminal use, but pointed out that every VPN and communications provider can be used for good or ill, and that weakening privacy for everyone is not the answer. The online community came to ProtonVPN’s defense on that occasion, considering it more secure than French services that do keep logs.

Final considerations (mergers and investors)

Unlike the other VPNs in this report, ProtonVPN has not changed hands or merged with other VPN companies. It retains its independence and its freemium model (it has a limited free plan, which makes it accessible to activists in repressive countries). ProtonVPN works closely with the privacy community: in 2023 it joined forces with Mozilla, which recommended it to certain users in its Firefox browser, and with the Brave browser, which added quick access to ProtonVPN. Also in 2023, Proton and Mullvad jointly launched an initiative called “VPN Alternatives” to promote the idea that users can rely on transparent VPNs instead of insecure proxies.

For investors, ProtonVPN is part of Proton AG, which, although profitable, reinvests most of its revenue in development. Its latest moves (new offices in Vilnius and Prague; more than 400 employees in 2025) indicate that it is scaling up to compete with the commercial leaders. Proton always stresses that its priority is to deliver scientifically backed security rather than growth at any cost. This keeps it in a premium reputational segment, competing directly with Mullvad, IVPN and other VPNs favored by the free software community.

On the Five Eyes front: Switzerland remains outside the intelligence alliances, but it has specific legal cooperation agreements. It is not automatically aligned with the EU on surveillance (it is not an EU member), which so far has worked in ProtonVPN’s favor. For example, Switzerland refused to implement the EU data retention directive. The only risk would be Switzerland tightening its laws under pressure (in 2020 there were debates about expanding domestic intelligence capabilities, but they were not aimed at VPNs). ProtonVPN has shown it is willing to fight any such attempt politically, and even to relocate critical servers if necessary. Given the strong global user base that trusts it (ProtonMail/VPN have over 70 million accounts combined), it is unlikely that Switzerland, which prides itself on being a privacy haven, would take measures that drive Proton away.

In conclusion, ProtonVPN stands out for its transparency, security innovation and grounding in a neutral jurisdiction. Its biggest challenge has been educating the public about the legal differences between its VPN and its email service (in the wake of the 2021 case), but it has tackled this with more communication. The facts show that ProtonVPN has not compromised its users; on the contrary, it has invested in additional protections (Secure Core, open source, audits) to shield itself from state or third-party threats. It is considered a very high-trust VPN by journalists, activists and cryptographers, on a par with Mullvad or IVPN, and its ongoing commitment to the community (e.g. cooperating with the Tor Project) reinforces that position.

Mullvad

Mullvad VPN is a Swedish provider founded in 2009, operated by Amagicom AB, headquartered in Gothenburg, Sweden. “Mullvad” means mole in Swedish, perhaps reflecting its aim of making the user “invisible” underground. Mullvad is famous in the privacy community for its radically anonymous and transparent approach. For example, it requires neither an email address nor any personal data to create an account: the system simply generates a random account number, and that is all the identification the user needs. Mullvad accepts cash payments sent by post (even banknotes with no return address, credited to the anonymous account) – you can literally send €5 in an envelope to Sweden and top up your VPN without leaving a trace. It also accepts Bitcoin, Monero, bank transfers, etc. This shows how far Mullvad goes to minimize the information it holds about its customers.

Sweden is Mullvad’s home jurisdiction. That said, Sweden is part of the 14 Eyes alliance (as a member of the “SIGINT Seniors Europe” intelligence network). This creates the paradox that one of the most private VPNs is based in a country belonging to the Western intelligence alliance. However, the domestic legal situation is complex: Sweden implemented data retention laws for ISPs in 2012 (following the European directive), but VPN services are not considered electronic communications operators for the purposes of mandatory retention. Mullvad confirms that it is not subject to any local law requiring it to log user activity. In addition, Sweden has robust constitutional protections for privacy and government transparency.

The acid test came in April 2023, when Swedish police served a search warrant on Mullvad’s offices in Gothenburg with the intention of seizing equipment and looking for user data. Mullvad announced it publicly: “on April 18, six officers came with a search warrant seeking customer information”. Mullvad’s legal team argued on site that the warrant was unfounded, since the company stores no logs or personal data that could serve the warrant’s purpose. After explaining to the officers how the service works, and after they consulted the prosecutor, the officers left without taking anything. Mullvad stated that no customer data was compromised since there was, in fact, nothing useful to seize. The incident was covered by international outlets such as The Verge, which highlighted that Mullvad “stayed true to its no-logs policy, and thanks to that the police left empty-handed”. Mullvad later formally requested the case documents to review them and said it would keep improving its measures so that no physical intervention could affect customer privacy. This failed raid demonstrated in practice the robustness of Mullvad’s model, much like PIA’s cases in the US: if no data is stored, a raid cannot reveal identities. The police were looking for shortcuts that Mullvad does not provide.

Mullvad remains 100% independent. It has not accepted acquisitions or mergers. Its founders (Fredrik Strömberg and Daniel Berntsson, among others) are still in charge, and the company remains small (around 40 employees). Mullvad’s business model is to charge a low flat fee (€5/month) and reinvest in infrastructure and development, with no spending on extravagant marketing. In fact, Mullvad has no affiliate program or advertising: its growth has been organic, through word of mouth among privacy enthusiasts. This stance contrasts with providers such as Nord or Express that invest heavily in marketing; Mullvad prefers to spend on security.

Audits, open source and security

Mullvad has been audited by third parties on several occasions. In 2018 Cure53 audited its application (in collaboration with Assured AB), finding a few non-critical flaws that were fixed. In 2020 the Swedish firm Assured AB audited Mullvad’s server infrastructure (in particular, verifying the absence of logs and the security of its OpenVPN/WireGuard configuration). Mullvad published a summary stating that the audit was satisfactory and confirmed its level of security. Mullvad also has a history of taking part in academic research: it has worked with universities on studies of VPN traffic, and it even maintained a research blog with findings (e.g. in 2020 it disclosed a WireGuard bug together with students).

Importantly: all of Mullvad’s client applications are open source (GPL v3). This includes its software for Windows, macOS, Linux, Android and iOS. Mullvad hosts the code on GitHub and updates it there. Thanks to this, in 2022 researchers from Atos found two vulnerabilities in the Windows app (CVE-2022-1245 and 2022-1686) related to directory permissions and potential local escalation. Mullvad fixed them and noted that neither allowed traffic to be compromised or IPs to leak; they only affected the local system if someone already had access (limited risk). There was no known real-world exploitation. Mullvad’s rapid response was possible because the community could audit the code.

In 2023 Mullvad completed a major technical project: migrating all its servers to “diskless” infrastructure (RAM-only). It announced that during the year it had “removed every trace of disks from its VPN infrastructure”, implementing its own secure boot system called stboot to load servers from an in-memory image. Mullvad reported that its network had already been audited twice in this configuration (in 2022 and 2023). Now, if any Mullvad server is powered off, it immediately loses all memory, ensuring that there is no persistent data even in cases of physical seizure (as happened). Mullvad was one of the last major providers to adopt RAM-only (perhaps because of earlier limitations in its boot system), but it is now on a par with ExpressVPN, Nord, etc. on this measure.

Mullvad has also partnered with the Tor Project: in April 2023 they jointly launched the Mullvad Browser, a browser derived from the Tor Browser code but designed to be used with a VPN instead of the Tor network. This browser, available for free, applies the same anti-fingerprinting techniques as Tor Browser, so a Mullvad user can achieve a high level of anonymity without using the (slower) Tor network. The logic is this: Tor protects your IP, but its browser protects your identity from web tracking; Mullvad provides IP protection, Mullvad Browser provides fingerprint protection, and combined they deliver very solid privacy. This collaboration with Tor shows Mullvad’s dedication to comprehensive privacy solutions, beyond the typical scope of a commercial VPN provider. Mullvad also launched Mullvad Leta, a search engine that can be integrated into its browser (based on Google results, but proxied for privacy).

In terms of features, Mullvad is minimalist: it does not offer things like multi-hop, exotic protocol choices or “fancy” apps. Its philosophy is “do a few things and do them well”. It supports OpenVPN and WireGuard; it was one of the first to adopt WireGuard (in fact, its founder took part in early discussions with Donenfeld about the design). Mullvad does not offer split tunneling in its official apps (although on Linux it is trivial to configure manually). Nor has it offered port forwarding since 2023 – a decision that was controversial among some P2P users. Mullvad argued that port forwarding (opening a port reachable from the internet to the user’s device) was being used for malicious activity (running covert C2 servers), and since its ethos is privacy, not anonymity for abuse, it decided to remove the feature to reduce the attack surface. This sparked debate, but Mullvad held its ground, which is consistent with its integrity even if it loses some torrenting customers.

Relations with governments and public stance

Mullvad has been very active in defending privacy at the political level. In 2022–2023 it got involved in the campaign against the EU proposal known as “chat control” (a regulation to scan private communications for CSAM). Mullvad sent open letters, funded events and even street protests in Sweden against the law, arguing that it violates fundamental rights. It also sponsors privacy projects (Qubes OS, Tor, etc.) and even organizes its own conference (Sec-T).

On its blog, Mullvad has been very candid about legal pressure: for example, it warned that a 2020 Swedish law (allowing police to use spyware on devices with judicial authorization) did not affect VPNs but did show worrying trends. It has also published documents on how it would handle a hypothetical legal request: “we could not hand over anything, and if we were forced to implement real-time surveillance, we would rather shut down the service” – a stance similar to Lavabit’s, mentioned above. Mullvad has hinted that, given its small size, even shutting down and reopening in another country would be feasible in an extreme scenario. This reassures hardcore users, who trust that Mullvad would put its principles first rather than become complicit in surveillance.

The only known brush with “Fourteen Eyes” was in 2016, when the Swedish intelligence services (FRA) wanted to expand their international interception. Mullvad took part in the public debate on the issue. But there was no direct impact on the VPN.

To sum up, Mullvad is probably the commercial VPN most aligned with a philosophy of absolute privacy. The facts: it asks for no personal data, keeps no logs (confirmed 100% in a raid), is open source, has passed audits, runs advanced infrastructure (now RAM-only), has never compromised users, and fights intrusive laws. Its commercial disadvantage may be that it does not invest in marketing or branding, but its user base cares little about that; in fact, many value it precisely for having no telemetry or advertising. Mullvad, despite being in a 14 Eyes country, has shown more integrity than some services in “exotic countries” that ended up exposing data (e.g. there have been cases of VPNs in Hong Kong or Malaysia with leaked logs). In the balance of jurisdiction vs. practices, Mullvad shows that strong no-logs practices can prevail even in the face of an attempted police seizure in a country that cooperates with the West. This sends a powerful message: well-designed, warrant-proof privacy works.

For investors, Mullvad is an outlier: it forgoes explosive growth to stay true to a mission. Even so, it has set trends that others later followed (RAM-only, certified no-logs, accepting cash). In the technical community it commands respect comparable to that of ProtonVPN and IVPN.

IVPN

IVPN (Invisible VPN) is a boutique provider launched in 2009, registered in Gibraltar under the company Privatus Limited. Although small in market share, IVPN has earned a solid reputation among experts for its uncompromising commitment to privacy and transparency. IVPN was founded with the vision of offering a no-compromise alternative to mainstream commercial VPNs. Its CEO, Nicholas Pestell, and his team (many with backgrounds in IT security) adopted early on measures that would later become standard: IVPN has never kept logs, not even temporary connection records; it allows accounts to be created under a pseudonym and accepts payment in cash/Monero; and it actively rejects marketing techniques it considers unethical (it was the first to publish a manifesto against the “lifetime” subscriptions some VPNs were selling, explaining that the model is unsustainable and misleading).

Gibraltar, where IVPN is based, is a British Overseas Territory. Legally, Gibraltar has autonomy over most internal affairs, including commercial regulation. It is not part of the United Kingdom or (since Brexit) the EU, and therefore is not automatically within Five Eyes – although, given its link to the UK, one can assume there would be some cooperation with British services if the need arose. There is no public record of Gibraltar issuing orders against VPN services. Given its size, it is unlikely to be a focus of intelligence pressure. IVPN has said it has not received any legal requests for data, and that if it did, its no-logs policy would prevent it from complying (similar to PIA). It publishes an annual transparency report with these metrics.

IVPN is independent and self-funded. It is not controlled by any large corporation and has not been the subject of acquisitions. This allows it to focus on its niche without outside pressure from investors. Its growth is organic and modest, with a target audience that values reliability more than the number of server locations.

Audits, open source and security measures

IVPN has been quite proactive in opening itself up to external audits. Since 2019 it has carried out annual security audits with Cure53. The first, in 2019, covered its client applications for Windows, macOS, iOS and Android, just as IVPN decided to open-source all its apps. Cure53 found a number of issues (some critical, such as a flaw in the iOS app that allowed an API call to be intercepted under certain conditions), but IVPN fixed them quickly and published the full reports. This transparency – acknowledging flaws and fixing them in public – earned it respect. Since then, IVPN has undergone annual audits: in 2020 Cure53 again audited its server infrastructure and authentication system, with no serious findings; in 2021 and 2022 it repeated the exercise with incremental audits of its new features (such as its filtering firewall). On its website IVPN has a section listing all the Cure53 reports, raising the bar for transparency.

As mentioned, IVPN open-sourced its code (desktop and mobile clients on GitHub) at the same time as the 2019 audit. This means anyone can verify that its apps do nothing strange (for example, they contain no third-party trackers; in fact, IVPN prides itself on not including Google Analytics or similar tools in its apps, something that has been found in competitors’ apps).

At the infrastructure level, IVPN runs its own servers in ~45 locations. Since 2020 it has deployed diskless servers booting from secure USB in several sensitive regions, and most of its servers are now RAM-only (as it confirmed on its blog). It also supports Multi-hop, allowing users to chain up to 4 hops through different countries (it calls this “Cascade”). It even offers cross-protocol multi-hop: you can enter via OpenVPN and exit via WireGuard or other combinations, to diversify attack vectors.

Another differentiating feature is AntiTracker, introduced in 2020, an ad/tracker blocker similar to Pi-hole built into its DNS servers. It has two modes: block ads and malware, or block those plus social media domains (for users who want to eliminate Facebook, Twitter, etc. telemetry entirely). AntiTracker runs the filter list directly on its DNS resolver nodes, increasing privacy (requests to known ad domains never leave the tunnel). IVPN was one of the first to offer such a feature; today most of the big players have an equivalent.

IVPN has also implemented technical niceties such as “Obfsproxy” (obfuscation via Shadowsocks) to get around VPN blocking in places such as China, and it allows selective port forwarding on certain servers (useful for torrents).

Account security: being so anonymity-oriented, IVPN allows sign-up without an email address, but users can optionally link one for account recovery. However, it recommends not doing so to maximize privacy. It has enabled TOTP 2FA for those who do use an account with an email address.

As for leaks: there are no known incidents of IVPN exposing user data or of breaches in its systems. In 2021 there was a stir on Reddit when a script that appeared to log certain connections was found in its server config, but it turned out to be a misunderstanding: IVPN clarified that it was a generic internal script not used in production. The episode reflected the trust users place in the company by scrutinizing its code – something made possible by its open policy.

Ethical stance and relationship with Five Eyes

IVPN has taken a strong position on business ethics: it has refused to take part in deceptive “free VPN” schemes, does no ad injection and keeps no browsing histories. It published an extensive whitepaper titled “No, not all VPNs are the same”, exposing questionable industry practices (such as creating dozens of white-label brands under the same company, spam tactics, paid reviews, etc.) and distancing itself from all of them.

In its transparency report, IVPN discloses how many legal requests it has received: it typically reports 0 requests or a couple of DMCA letters that it cannot link to any user. According to the company, it has never received a formal court order. This suggests that IVPN may not have been on agencies’ radar as much as larger providers. Given its scale, that is plausible. However, being in Gibraltar, a UK-allied territory, one might be concerned. IVPN says that if it received an order, its lawyers would argue that it cannot comply and would contest it; and if it were forced to install some kind of surveillance system (unlikely without a local legal basis), it would rather shut down operations than betray its users. This is a recurring theme among Mullvad, IVPN and other “hardcore” VPNs: they are small companies willing to cease to exist if pushed to the extreme, which gives them moral credibility.

There is no record of IVPN cooperating with any government. Nor of any hacking incidents. Its weakness may be coverage: as it is not that large, it does not have thousands of servers, and in heavily censored countries (China, Iran) its presence is limited – although tech-savvy enthusiasts use it with obfs without much trouble.

IVPN also takes part in the VPN Trust Initiative, although it often goes beyond what is proposed (for example, the VTI recommends audits, and IVPN already does them annually; it recommends educating users, and IVPN has extensive threat guides on its website, etc.). It does not spend on advertising; in fact, in 2019 The Wirecutter (NYTimes) recommended it as the best VPN for security, and IVPN’s servers nearly collapsed under the avalanche of new users, showing it the limits of not having oversized infrastructure. It then invested in more capacity.

For investors, IVPN is a niche player – it is not chasing the masses but the loyalty of a few. Its intangible value lies in being a benchmark for good practice. For example, Mozilla initially partnered with IVPN for its pilot Firefox Private Network service in 2019 before moving to Mullvad; choosing IVPN for that first experiment showed the high esteem in which the open-source community holds it.

As far as Fourteen Eyes is concerned, Gibraltar, although British, is hardly a global espionage hub. Nevertheless, IVPN takes precautions: its headquarters are there mostly for convenience (stable jurisdiction, English-speaking, outside the EU), but it keeps no critical data in Gibraltar. Its servers are spread around the world, with the most sensitive ones in neutral countries (Iceland, Switzerland, etc.). It could easily move the company if Gibraltar became problematic.

In summary, IVPN is one of the most transparent VPNs and one of the most committed to absolute privacy, at the cost of being less well known. The facts: it has published all its audit reports (including critical findings and how they were resolved), open-sourced its code, has not been involved in any data controversy and maintains its stance free of corporate interference. Its only “minus” is that, not having been tested in a high-profile legal case, some might wonder how it would react; but its track record suggests it would do the right thing by its users. It is often compared to Mullvad – both are seen as the trusted VPNs of the technical community – with Mullvad having more infrastructure and IVPN more public communication (e.g. excellent educational articles on its blog). For users looking for the closest thing to an idealistic VPN, IVPN lives up to its principles with verifiable facts: no logs, no trackers, annual audits, no investors who could force compromises.

TunnelBear

TunnelBear is a provider founded in 2011 in Toronto, Canada, known for its friendly (bear-themed) approach and ease of use. For years it operated as a small local startup, until in March 2018 it was acquired by the cybersecurity company McAfee (then partly owned by Intel). The financial details were not disclosed, but McAfee is believed to have wanted to add a quality VPN to its product suite. Since the purchase, TunnelBear has continued to exist as a separate brand within McAfee, with its team in Canada largely retained. McAfee, although it has gone through restructurings (it was independent, then part of Intel, then independent again after 2017), is a US company, so TunnelBear came under US (Five Eyes) control with the acquisition.

Before that, TunnelBear was already in a Five Eyes country (Canada), so its home jurisdiction did not change in that respect. Canada, like Australia and the UK, has implemented retention laws for ISPs, but they have not been applied to VPN services specifically. TunnelBear had built a reputation for privacy, and when selling, its co-founder Ryan Dochuk promised that it would operate “as a separate team within McAfee” and keep making the “bear-filled products you know and love”. However, some users expressed concern that an antivirus corporation, known for sometimes invasive practices, was now the owner. TechCrunch noted that “now that it belongs to McAfee, TunnelBear will have to comply with US law” and advised keeping an eye on changes to the terms of service or privacy policies after the acquisition. In practice, no obvious negative changes to TunnelBear’s policy have been seen since (it still says it keeps no activity logs). But the mere association with a Silicon Valley giant led some enthusiasts to migrate to other, “more independent” VPNs.

Security audits and pioneering transparency

TunnelBear was one of the first VPNs to undergo annual security audits and publish them, even before it was acquired. Starting in 2017, it hired Cure53 to audit its infrastructure and applications. It published the results every year, and the practice became almost a company standard. For example, its second annual audit in 2018 covered its VPN servers, applications and backend: Cure53 carried out an in-depth review over 30 days and found a number of issues (2 critical, 4 high, etc.), all of which TunnelBear fixed quickly. Cure53 commented favorably on the improvement in TunnelBear’s security year after year. The cycle continued: in 2019, 2020, 2021 and 2022 TunnelBear kept carrying out audits (the 2020 one covered its apps and servers, with 3 critical findings fixed, for example). By 2022 it announced it had completed its 7th consecutive annual audit. No other mainstream VPN had that track record at the time. This earned TunnelBear a lot of credibility among security-conscious users, demonstrating a sustained commitment rather than a one-off marketing audit.

In the audits, Cure53 never reported catastrophic vulnerabilities left unfixed; rather, it highlighted that TunnelBear was becoming more robust year after year. Despite the change of ownership, McAfee allowed TunnelBear to continue these audits unhindered, which is a good sign. McAfee may even have leveraged TunnelBear’s know-how for its own VPN product (Safe Connect), integrating TunnelBear technologies.

TunnelBear was also a pioneer in simplicity with privacy: its app did not offer a thousand settings, but automated everything (e.g. it would automatically select the best location if you wanted). It included a kill switch called VigilantBear and an obfuscation mode called GhostBear to evade DPI on restrictive networks. GhostBear obfuscates OpenVPN traffic so that it looks like random noise, which is useful in countries that block VPNs. TunnelBear always maintained that it is not a VPN for hackers but for ordinary users who want basic security (in fact, it explicitly blocked BitTorrent traffic on its servers to discourage copyright infringement). This made it less attractive to some, but it won over business users and travelers.

TunnelBear maintains a clear no-activity-logs policy: it does not log source IPs, sites visited, DNS queries or anything else. It stores only the user’s email address and the amount of data used during the month (because its free version is limited to 500 MB a month, and to enforce that it does need to know how much you have used). This is one of the few logs it keeps: bandwidth consumed on free accounts. On paid accounts that metric is not needed, and usage is not logged (according to the company). That is perhaps a small trade-off compared with Mullvad, which has no idea how much you use. Even so, nothing is kept about when you connected or to which server on paid accounts.

After passing into McAfee’s hands, TunnelBear stopped publishing its annual transparency report (it published one in 2018, but it then appears to have been folded into McAfee). However, the audit reports did continue. As of 2023 it is unclear whether McAfee’s new owners (it was sold to Symphony Technology Group in 2022) will keep up this pace of public audits, but they are expected to, since it was a strong selling point for the brand.

Incidents and Five Eyes position

There are no known security breaches or leaks of TunnelBear user data. A possible risk arose in 2018 when, upon its integration into McAfee, there was speculation that TunnelBear user data could be affected by a breach of McAfee’s huge database, but nothing of the sort happened. Nor are there any public cases of authorities approaching TunnelBear for data. This may be because its user base was smaller or less associated with illicit activity (since it did not encourage P2P or getting around streaming geoblocking – in fact, TunnelBear was not one of the most effective for Netflix; it was more about securing public Wi-Fi).

If that happened, TunnelBear would be subject to Canadian and US law at the same time. Canada has close agreements with the US; in 2018 it passed Bill C-59, which expanded the surveillance powers of its CSIS agency. And the US has the CLOUD Act, which could allow US authorities to demand data stored by US companies even if it sits on foreign servers. Since TunnelBear/McAfee is a US company, in theory a FISA or NSA order could force it to cooperate. The advantage, however, is that TunnelBear keeps little data (and in its 2018 transparency report it stated that it had no data to hand over in response to the few requests it received). It would be essential for TunnelBear to maintain its strict no-logs policy under McAfee, so that not even Five Eyes could obtain much. For now, there is no indication to the contrary.

Culturally, after the purchase, TunnelBear lost some of its independent visibility (e.g. its blog is no longer as active; its Twitter became more corporate). Some enthusiasts migrated to other open-source services. But many casual users stayed loyal because the brand is likable and the service “just works”.

For investors, the TunnelBear acquisition showed that the big security suites value VPN integration as a feature. McAfee has probably monetized TunnelBear by using its free service to upsell subscribers and by integrating it into bundles. TunnelBear as a standalone brand may not be seeking massive expansion; it sits within the McAfee portfolio, aimed at users who want a one-click VPN.

In short, TunnelBear pioneered regular security audits, maintains a decent privacy policy and, after years under McAfee, has no known serious lapses. However, its location in a Five Eyes country (Canada) and its ownership by a Five Eyes company (US) place it in the least favorable jurisdictional zone. So far this has not translated into actual incidents, but the most vigilant users might prefer VPNs in neutral jurisdictions. In its favor, its technical track record is impeccable, which suggests that even if an order landed, TunnelBear probably could not hand over anything substantial (at most, records of the MB used by a given free account). And its relatively small size (some 20M users of its free version as of 2018, of whom a fraction pay) makes it a less attractive target than, say, a NordVPN with tens of millions of customers.

Key facts about TunnelBear The first in the VPN industry to run annual public audits, with no known breaches, it was absorbed by a cybersecurity giant while keeping its identity. It represents the transition from indie VPN to part of the corporate mainstream. Although it may no longer be the choice of hardcore activists (because of its jurisdiction), it remains one of the VPNs with the greatest respect for technical security in the general consumer segment, with a positive legacy that McAfee will hopefully continue.

Windscribe

Windscribe is a VPN provider launched in 2016 and headquartered in Ontario, Canada. It is a relatively young company compared with the others here, and it has become popular thanks to its generous free version (10 GB a month at no cost) and its irreverent tone on social media. Windscribe is owned by Windscribe Limited, a private company founded by Yegor Sak and Alex Paguis. It has not been acquired by any larger corporation; however, one of its co-founders (Paguis) separately founded another service called ControlD (custom DNS), and there is technology collaboration between the two. In essence, Windscribe remains independent and run by its creators.

Windscribe’s main jurisdiction is Canada, a Five Eyes member. This means that in theory it could face government requests similar to those TunnelBear faced in its day. Windscribe says it has a strict no-logs policy: it keeps no connection histories or source IPs, storing only the username, concurrent connection time and the amount of data transferred over a period (to monitor the quotas of its free plan). One peculiarity is that Windscribe lets you use its service without registering at all in “Build-a-Plan” mode – generating temporary credentials – which is unusual. In general, its free model means it handles a large number of users, which brings security and monetization challenges.

The 2021 incident: unencrypted servers seized

Windscribe faced a serious security controversy in June 2021, when it emerged that two of its VPN servers in Ukraine had been seized by local authorities as part of an investigation. The serious part was that Windscribe admitted those servers were not properly encrypted or configured to its latest standard. Specifically, those nodes ran an old OpenVPN configuration that did not use perfect forward secrecy (PFS) and also stored both the server’s private key and an internal certificate on disk without encryption. This meant that anyone with physical control of the server could obtain the private key and potentially use it to stand up a fake VPN server (impersonating Windscribe) and thus intercept the traffic of users who connected believing it was legitimate. It was a significant security failure. Windscribe explained that those servers were part of a “legacy stack” (old infrastructure) that had not been upgraded to its new full-encryption system. Although it said it had no evidence that anyone had exploited the key for MitM attacks, it acknowledged the seriousness: “anyone with those keys could have decrypted user traffic on those servers”.

The community harshly criticized Windscribe for this oversight, since by 2021 any serious VPN is expected to encrypt its servers or at least not store keys unprotected. Windscribe published a mea culpa blog post detailing a 10-point plan to remediate the situation: among other things, immediately deploying PFS in OpenVPN (enabling TLS-crypt), regenerating all root certificates, fully encrypting all its servers with a RAM-only stack and a new management system, and commissioning an external audit of its upgraded infrastructure. It delivered on several points over the following months: by the end of 2021, Windscribe announced that its new infrastructure (“Project FreshScribe”) was in testing with in-memory servers and would undergo an independent audit in December.

Indeed, in December 2022 Windscribe had an external audit (by Cure53) carried out on its new in-memory VPN stack, and it published a summary. The results were positive: Cure53 reviewed its modified OpenVPN server and deployment scripts (pre-release) and found no critical flaws, validating that the architecture was now solid. In addition, in 2022 Windscribe had its mobile applications audited by Leviathan Security to make sure there were no leaks in the mobile apps. That audit found some minor issues on Android/iOS, which were fixed in updates.

Also in response to the incident, Windscribe open-sourced its desktop applications on GitHub in mid-2021, and gradually its mobile apps, seeking transparency to win back trust. Its client for Windows, Mac and Linux is now open source, allowing public scrutiny (Leviathan in fact took advantage of this in its analysis).

In short, Windscribe stumbled in 2021 but took serious corrective action. The seizure in Ukraine could have exposed user traffic (in theory, if someone had recorded traffic and then obtained the key, they could decrypt non-PFS sessions). It is unclear whether that happened; Windscribe said “we don’t believe any traffic was compromised”, but the possibility existed. The event put Windscribe in the spotlight, and it has worked to make amends ever since.

Features and post-incident philosophy

Windscribe has many privacy-oriented features: its package includes ROBERT, a firewall/DNS filter that blocks ads, trackers, malware and even categories such as pornography or gambling, configurable by the user. It runs at the account level in the cloud and complements the VPN. It also offers multiple protocols: OpenVPN, IKEv2, WireGuard, and “Stealth” modes (Stunnel, WebSockets) to get around blocking. Its paid “Pro” plan allows unlimited device connections (no cap, unlike the typical 5 or 10), which is generous.

Since the incident, Windscribe has become more vocal on global privacy issues. In 2022 its CEO, Yegor Sak, gave interviews criticizing the hypocrisy of governments that demand backdoors in VPNs while leaking data themselves; he also discussed its case in Greece (mentioned below) as an example of why logs should not be kept. Windscribe published its first transparency report in 2021, listing the orders it had received: it mentioned some DMCA requests and a Greek court order.

This Greek order is interesting: in 2023 the Greek authorities demanded information from Windscribe to identify a user allegedly involved in cybercrime. Since Windscribe had no logs, it could not help. Not satisfied, the authorities charged the CEO (Yegor Sak) with “assisting in concealing criminals” – essentially accusing him of not handing over data. Legal proceedings in Greece dragged on for 2 years, but in April 2025 the Athens court dismissed all charges against Sak, recognizing the validity of its no-logs policy. The case, reported as a “Windscribe no-logs court victory”, was celebrated by the community, since a judge essentially confirmed that a VPN cannot be required to hand over what it does not have. Windscribe called it “an unequivocal validation” of its policy at a level no audit could provide. After the acquittal, the CEO spoke out publicly against global pressure to weaken encryption, reinforcing his image as a privacy advocate.

Windscribe being in a Five Eyes jurisdiction (Canada) remains something to watch. However, its experience in Greece and its self-criticism after the 2021 incident have strengthened its position. Now all its servers are encrypted and run in RAM, its keys use PFS, its apps are open source, and it has passed audits of both apps and servers. This brings it closer to the standards of Mullvad/IVPN, which is remarkable for a service that also serves millions of free users.

One particular factor: Windscribe is very popular with novice users because of its free plan, which can sometimes attract attention (for example, in 2020 it came to light that cybercriminals were recommending Windscribe Free to hide their tracks, which may have prompted the action in Greece). Windscribe will have to strike a balance between offering open privacy to many and avoiding abuse by bad actors, without giving in to the temptation of logging.

To date, there is no known collaboration between Windscribe and Five Eyes. After 2021, Canadian agencies probably looked into its case; but in its transparency report Windscribe lists no orders from CSIS or the RCMP, only DMCA notices and the Greek order. It may be that it has not been served, or that any request prevents it from disclosing it (although it would presumably signal this by the absence of its canary). Its website states that it has never given identifying information to third parties.

Key facts

Windscribe had a serious failure (2021) that could have compromised users, but it responded with transparency and rapid improvements. Since then, it has been externally audited and won a court case validating its no-logs policy. These facts show both a real mistake and a sincere commitment to putting it right. Windscribe is establishing itself as a more trustworthy player than before: its current infrastructure meets high standards, and its team learned the hard way, which usually produces a stronger security culture.

Nevertheless, for ultra-sensitive users, the shadow of 2021 may take time to lift. But objectively, with its open apps, completed audits and its court test in Greece, Windscribe has won back trust. The company likes to joke around on social media, but when it came down to it, it showed seriousness when it mattered.

Being in Canada (Five Eyes), its best protection is technical: having no data to hand over. As we saw, that worked with Greece; with the bigger Five Eyes players a similar outcome can be expected. In any case, its warrant canary is something to monitor. And as a final recommendation, Windscribe should keep up its pace of regular audits (ideally annual) to ensure its security holds and to fully repair its image.

Comparative conclusions

In light of everything set out above, the strengths and controversies of each VPN investigated can be summarized side by side in the following table:

Overall comparison of key aspects

• ExpressVPN, NordVPN, Surfshark, CyberGhost, PIA – account for a large share of the market, now in two groups (Kape and NordSec). They have invested in no-logs audits and server hardening (RAM-only) to counter concerns about their jurisdictions (the BVI, Panama, Romania and the US, respectively). Nevertheless, their corporate concentration and, in some cases, a past tied to adware or breaches mean users should keep an eye on how they evolve. So far, their no-logs policies have withstood testing (notably PIA in court and Express/CyberGhost in Big Four audits). Acquisition by Five Eyes companies has not – as far as is known – led to privacy compromises, but the need for ongoing scrutiny remains, especially if stricter regulations emerge in the UK or the US.
• ProtonVPN, Mullvad, IVPN – remain independent and are seen as the gold standard for rigor. Based in Switzerland and Sweden/Gibraltar respectively, they rely on friendlier legal frameworks (although Sweden is 14 Eyes, Mullvad has shown the technical strength to counter that). These VPNs prioritize transparency: open source, frequent audits, minimal customer data. They have had no significant incidents (Mullvad and IVPN none at all; ProtonVPN handled the challenges arising from the ProtonMail context well). They are frequently recommended for activists and journalists who need maximum security, and the facts gathered back this up.
• TunnelBear and Windscribe – both Canadian, aimed at mass-market users (one via McAfee, the other through a freemium model). Both have shown a commitment to security: TunnelBear was a pioneer in audits and its record so far is clean, but its absorption by McAfee (Five Eyes) puts it in a scenario of trust based on corporate promises rather than independent verification going forward (it remains to be seen whether McAfee continues the transparency). Windscribe stumbled with a serious error, but learned from it and corrected course, openly and in the courts. It is still in Five Eyes, but at least its current stack and the case law it has won allow it to claim a much higher level of trustworthiness than in 2020.

In terms of the technologies used to protect privacy, almost all of them now converge on certain practices: diskless (RAM) servers, tunnels with Perfect Forward Secrecy, execution in ephemeral containers, strict control of infrastructure, and in-house DNS with malware/ad blocking. This significantly reduces attack vectors and the information that could be seized. In addition, several have released their client source code (PIA, ProtonVPN, Mullvad, IVPN, Windscribe) – a positive trend toward transparency. Those that have not yet done so (Express, Nord, Surfshark) at least publish audit results and regularly use outside security firms.

A key point is presence in Eyes countries

We have seen examples here where a theoretically hostile jurisdiction did not prevent a pro-privacy outcome (PIA and Windscribe in court, Mullvad in a raid, TunnelBear with no incidents). This suggests that what really matters is the company’s technical implementation and stance, more than the flag it operates under. However, neutral jurisdictions add a layer of legal protection that should not be underestimated (for example, Switzerland with ProtonVPN: no intelligence agency can simply force it to spy without a tortuous international legal process).

The flag matters less than the engineering. A theoretically hostile jurisdiction did not prevent a pro-privacy outcome — PIA and Windscribe in court, Mullvad in a raid, TunnelBear with no incidents: what really matters is the company’s technical implementation and stance, more than the country whose flag it operates under.

For investors and analysts, the sector shows remarkable professionalization: what used to be a somewhat opaque industry is now full of security reports, certifications and consolidation. Kape and NordSec have invested hundreds of millions in absorbing competitors, betting that demand for privacy will keep rising. This brings opportunities (economies of scale, unified standards) but also risks (less real diversity, a potentially more attractive target for surveillance). User trust is fragile in this business – a single scandal of exposed logs can destroy a reputation – which is why we see all these players emphasizing audits and no-logs in their marketing.

From the perspective of activist/technical users, two leagues emerge: the “purist” VPNs (Proton, Mullvad, IVPN), which maximize principles and transparency, and the “commercial” VPNs (Nord, Express, etc.), which combine good privacy measures with a mass-market approach (more locations, streaming, polished apps). The gap between them has narrowed: today ExpressVPN, for example, is almost as technically solid as Mullvad (except for its closed code), and Mullvad is almost as easy to use as Express (except that its mobile app is not as feature-rich). This is good for end users, because it means that whatever they choose, if it is one of these major providers, they probably get a decent level of security.

The “purists” Proton, Mullvad, IVPN

• Put principles and transparency ahead of the feature list.
• Zero outside investors and open source where it matters.
• Tested in real confrontations: raids, court orders.

The “commercial” players Nord, Express and co.

• Good privacy measures with a mass-market approach.
• More locations, streaming and polished apps.
• Backed by groups that have invested hundreds of millions in the sector.

The sector’s two leagues, with the technical gap between them narrowing all the time.

Nevertheless, our research shows that each provider has particular traits and history worth taking into account:

Independence Mullvad, IVPN or ProtonVPN

If you value total independence and transparency, Mullvad or IVPN have the edge (zero outside investors, everything open, tested in real confrontations); ProtonVPN also offers the strength of an encrypted ecosystem (mail, VPN) in Switzerland.

Performance NordVPN and Surfshark

If you are after global performance and extra features, NordVPN and Surfshark shine (servers in 50+ countries, built-in antivirus, etc.), but they come with more corporate baggage (the merger, the Tesonet past), which they appear to handle well but which is worth monitoring.

Track record ExpressVPN and PIA

If you prioritize long-standing reliability, ExpressVPN and PIA have been in the trenches and have confirmed no-logs records. They are now part of conglomerates, so their challenge is to keep that privacy culture alive under new management.

Audits CyberGhost and TunnelBear

If you value frequent public audits, CyberGhost and TunnelBear have been exemplary in publishing them, which builds trust despite their ownership by Kape and McAfee respectively. CyberGhost in particular, after 2 Deloitte audits, has vindicated itself in the eyes of skeptics.

Free Windscribe

If a robust free version appeals to you, Windscribe stands out, but its incident calls for informed caution: the good news is that it responded with candor and improvement.

Which provider fits, depending on what you are really prioritizing.

In conclusion, the commercial VPN sector has matured: today there is verifiable evidence – audit reports, court cases, official statements – that allows users and analysts to assess how far each service can be trusted beyond the marketing. It has become almost standard for providers to proclaim “no-logs audited by a Big Four firm” or “open source and proven in court”, which raises the bar for the whole industry. However, it is essential to stay vigilant: legislative threats (e.g. attempts to ban VPNs or require logging, as in India, or EU proposals) are lurking, and how each company reacts will be the ultimate test of its commitment. For now, based on the facts gathered, all the VPNs investigated have taken concrete steps to protect their users’ privacy, albeit to different degrees and in different contexts. For end users, the choice will depend on the balance they prefer between absolute rigor and practicality, knowing that the players analyzed here represent the elite in trustworthiness within the vast VPN market.

References: The references throughout this report link to verified primary sources, including articles from the tech press (Wired, TechCrunch, Reuters, Vice, etc.), reports from audit firms and official publications from the VPNs themselves, ensuring the accuracy of the facts presented.

Related service

Offensive cybersecurity services

Keep reading

• NIS2 in Spain, two years without a law: where transposition stands and what to do this quarter
• European compliance calendar 2026-2030: CRA, AI Act, Data Act and everything still to come
• ISO 27001 in 2026: what has really changed and what you still need to get certified

Book a call