Insufficient

CactusVPN

Commercial VPNNot publishedRank 10 of 68

Paying monthly

$15.00 per month

Paying yearly

$70.00 billed once a year

Coverage

25 countries with an exit

Free tier

No paid plans only

20 out of 100

Security

66 out of 100

Usability

Visit site

Service class

Commercial VPN — security leads

Security score

20 of 100 · Insufficient

Usability score

66 of 100 · state known · 100% established · 100.0% of the weight read

Legal entity

Cactus VPN LLC

Jurisdiction

unknown

Ultimate owner

Independent; founded and run by co-founders (Sergiu Candja, Pavel Bodeanu, and colleagues), who state they have refused outside buyout offers

Exposure

Medium · dominant channel: ignorance

Retention

Nothing that links traffic to a person

Latest audit

Securitum · 8 May 2026 · One-off · unknown

Countries with exits

Protocols

OpenVPN WireGuard IKEv2 L2TP PPTP SSTP A vendor protocol with published source An obfuscated protocol

Works under active censorship

Claimed to work

Weakest protocol still offered

PPTP

Own DNS inside the tunnel

Yes, checked by someone independent

Platforms

Windows macOS Android iOS Android TV Fire TV Browser extension

Simultaneous devices

unlimited

Kill switch

On every platform

Split tunnelling

Available

Signing up

An email address only

Free tier

No free tier

P2P allowed

Allowed

Major streaming services reachable

Reachable

Price, monthly

$15.00 per month

Price, yearly

$70.00 a year at renewal, billed once

Offered countries that sit under a logging mandateC09_mandate_countries

India Russia

Country of the ultimate beneficial ownerM11_owner_jurisdiction

unknown

Owner group cluster keyM15_owner_group

independent

Date the current owner took controlM16_control_since

not applicable

Role of this brand inside the groupM17_brand_role

principal

Infrastructure shared with cluster siblingsM18_shared_infrastructure

separate

Total published auditsV10_audit_count

Where the security score comes from

Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works

Security fields

67 55 of them feed a channel

Established

42 24 left unknown, 1 not applicable

Completeness

63% the share the model could weigh

Citations

50 across 9 documents

Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:

A weighs 1.00 · 16 hereB weighs 0.85 · 33 hereC weighs 0.70 · 1 here

The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.

A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.

Still open on this record.

Jurisdiction. The about-us page says CactusVPN "started as a small company in Moldova" but that is company narrative, not a registration statement, and the Terms of Service state no governing law or incorporation country at all; the Securitum report names the client only as "Cactus VPN LLC" with no jurisdiction attached. M06 and the fields derived from it stay unknown until a registry record or an explicit jurisdiction clause is found.

Mandate hosting. All 25 countries in the published server list carry a data-retention mandate in this catalogue's own table, so C09b is not a narrow question here, but the server-locations page does not distinguish physical exit points from virtual ones for any location, and no per-country hosting fact was established this session.

the rest of what is open — 97 more words

App-level identifiers and store declarations. C07a, C12 and X12 stay unknown: no Play Store data-safety form or Apple privacy label was read this session, and the Securitum audit's whitebox scope covered server-side configuration and DNS/traffic handling, not what the mobile or extension clients transmit to app stores or analytics SDKs on their own.

Transparency and canary. No /transparency, /transparency-report, /warrant-canary or /canary path resolves on the site, and no such page turned up in the sitemap; that is an absence found by looking, not a sourced "none", so both fields stay unknown rather than being marked none.

On the record as a whole.

The Securitum engagement (20 Apr–7 May 2026, nine person-days, whitebox) inspected four production servers across four of CactusVPN's ~25 listed server countries and the VPN client's connection behaviour (including a Linux app used for testing, which is not among the platforms the downloads page currently lists — apparently manual/legacy client access rather than a listed product).

The report is a bespoke Securitum security assessment, not an ISAE 3000 or SOC 2 engagement, so V07/V15 record that rather than guessing an assurance tier.

Pricing carries a renewal-rate guarantee: the annual ($70/yr) and 2-year ($95/2yr) plans are both stated to renew at the same locked price "for life," which is unusual among providers in this catalogue and is not a lifetime one-time-fee scheme (X07=no).

IgnoranceHow much of this did nobody establish?5 fields read · 4 left unknown · 33.3 points of pressure×0.667

Priced from what is missing: 0.63 of the weighted record is established, on a slope of 0.9 under a cap of 0.6, with a posture of 0.0 relieved by 0.4.

Record completenessS08_completeness

63%

derived from the record itself

Response to a national logging mandatealso read by jurisdictionP04_mandate_response

unknown

nothing published · recorded as asserted

Report a problem with P04_mandate_response

Transparency reportalso read by silence, integrityP05_transparency_report

unknown

nothing published · recorded as asserted

Report a problem with P05_transparency_report

Reported numbers plausible for this scalealso read by integrityP06_report_plausibility

unknown

nothing published · recorded as asserted

Report a problem with P06_report_plausibility

Warrant canary disciplinealso read by disclosureP07_warrant_canary

unknown

nothing published · recorded as

Computed

×0.203 of a clean record completeness 63%

Where the drop comes from: Ignorance. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.667, and its bar above is filled to that.

Exposure is recorded as medium and the integrity status as clean.

Against the rest of the register, this record sits furthest above on Retention — ×0.701 where the register averages ×0.432 — and furthest below on Silence, ×0.775 against ×0.927.

Published score

Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.

Specification

Carried, never scored

Countries with an exit

If this one is not right

Compared with

CactusVPN

Proton VPN

Mullvad VPN

IVPN

Where the security score comes from