There are a lot of VPN review sites. Most of them have a problem: the rankings are determined by who pays the most for affiliate placement, not by which VPN is actually better.
We built Privacy Ranker to fix that. Here’s exactly how we evaluate products.
What We Actually Check
No-Log Policy Verification
A VPN’s no-log claim is the most important thing to verify, and also the hardest. Any VPN can write “we don’t log your traffic” in their privacy policy. Very few have had that claim tested externally.
We check for:
Third-party audits. Has the VPN commissioned an independent audit of their no-log claims? Not just a generic security audit, but a specific examination of logging infrastructure. We note the auditing firm, the date, and the scope. An audit from five years ago is worth less than one from last year. An audit that only checked servers in one country is worth less than one covering all infrastructure.
Real-world verification. Has the VPN been subpoenaed or had servers seized? How did they respond? Some VPNs have had servers seized by law enforcement and subsequently demonstrated they had nothing to hand over because nothing was logged. That’s the most credible verification possible.
Policy specificity. Vague policies (“we may collect aggregate data for service improvement”) get scored lower than specific ones that enumerate exactly what is and isn’t collected.
DNS Leak Testing
A VPN that leaks your DNS queries defeats its own purpose. Rather than publish leak numbers of our own, this site records what independent testers and the providers themselves have documented: whether the provider runs its own DNS resolvers inside the tunnel, whether IPv6 and WebRTC are handled or simply blocked, and whether third-party audits or published leak-test results exist covering the default configuration and split tunneling. Where no independent result exists, the entry says so instead of implying one.
Kill Switch Reliability
A kill switch cuts your internet connection if the VPN drops, preventing your real IP from being exposed. The entries here record what the provider documents and what independent reviewers and audit reports have found: whether the kill switch is enabled by default or opt-in, and whether it operates at the OS or firewall level (more reliable) or inside the application (less reliable).
Jurisdiction
Where a VPN is legally based determines what data retention laws apply and which governments can compel them to hand over data. We note the country of incorporation and any relevant data retention requirements in that jurisdiction.
Key factors:
- Is the country part of the 5/9/14 Eyes intelligence-sharing alliance?
- Does the country have mandatory data retention laws?
- Has the VPN faced government orders in its jurisdiction, and how did it respond?
Protocol Support
We document which protocols each VPN supports: WireGuard, OpenVPN, IKEv2, and proprietary protocols. WireGuard is the current performance and security standard. Providers that only offer proprietary protocols without open audits get a note in their review.
Scoring
We do not publish a numeric rating for each VPN. Our rankings are an editorial ordering built from the evidence above: published audits and their scope, transparency reports and documented law-enforcement history, jurisdiction, and the provider’s own documentation. Each ranking explains in the post why one provider sits above another, so you can check the reasoning against the cited sources.
The privacy stack builder re-ranks the same evidence on six criteria, each weighted from 0 to 10. Its default weights are:
- Audit recency and count: 6
- Jurisdiction (intelligence-sharing exposure): 5
- Open source: 7
- Anonymous signup and payment: 5
- Price: 4
- Usability: 6
These weights are our defaults, not yours. Change any of them and every tool re-ranks against what you actually care about. Speed is not one of the criteria, because this site does not run or publish speed tests.
What We Don’t Do
We don’t accept payment for placement. VPNs can’t buy better scores by advertising with us.
We carry no affiliate links today. If that changes, the affected post will say so on the page and the disclosure page will name the program.
We don’t rank on evidence we don’t have. Where a provider has no published audit, no independent leak or kill-switch testing, and no documented law-enforcement history, the entry says the claim is unverified rather than assigning it a score it hasn’t earned.
We don’t update reviews just because a provider asks us to. Reviews are updated when something material changes: a new audit is published, a security incident occurs, pricing moves, or new independent testing is released.
How Often We Update
Rankings are reviewed on a rolling basis. We flag any review that’s more than 12 months old as potentially outdated. If a provider publishes a new audit, gets acquired, changes their privacy policy materially, or has a public incident, we update the relevant review within two weeks.
Our goal is to give you the most accurate current picture, not to maintain stable rankings for affiliate conversion rates.
Corrections
We make mistakes. If you find a factual error in any of our reviews — a wrong audit date, an incorrect policy summary, a scoring criterion applied inconsistently — email corrections@privacyranker.com. We’ll investigate and issue a correction notice on any review we update.
Credibility is the only thing a review site has. We take corrections seriously, and our about page sets out how they are handled.
The criteria above are applied in our NordVPN, Mullvad and ProtonVPN comparison and the VPN jurisdiction analysis. For the reader-facing version of the same checks, see what makes a VPN actually private.
