Not recommended

GNUVPN

Commercial VPNPortugalRank 40 of 68Usability: floor only

Paying monthly

$6.99 per month

Paying yearly

$41.99 billed once a year

Coverage

Not published no country list published

Free tier

No paid trial only

6 out of 100

Security

55 out of 100

Usability

Visit site

Offered countries that sit under a logging mandateC09_mandate_countries

unknown

Country of the ultimate beneficial ownerM11_owner_jurisdiction

Owner group cluster keyM15_owner_group

independent

Date the current owner took controlM16_control_since

unknown

Role of this brand inside the groupM17_brand_role

unknown

Infrastructure shared with cluster siblingsM18_shared_infrastructure

unknown

Total published auditsV10_audit_count

Service class

Commercial VPN — security leads

Security score

6 of 100 · Not recommended

Usability score

55 of 100 · state no_data · 42% established · 41.2% of the weight read

Legal entity

GNUAPP UNIPESSOAL LDA

Jurisdiction

Portugal

Ultimate owner

GNUAPP UNIPESSOAL LDA

Exposure

Low · dominant channel: integrity

Retention

Session metadata

Latest audit

unknown · unknown · One-off · unknown

Countries with exits

not published

Protocols

unknown

Works under active censorship

unknown

Weakest protocol still offered

unknown

Own DNS inside the tunnel

No, DNS is resolved outside it

Platforms

Windows macOS iOS Android Linux Browser extension

Simultaneous devices

Kill switch

unknown

Split tunnelling

unknown

Signing up

An email address only

Free tier

A trial only

P2P allowed

unknown

Major streaming services reachable

unknown

Price, monthly

$6.99 per month

Price, yearly

$41.99 a year at renewal, billed once

Where the security score comes from

Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works

Security fields

67 55 of them feed a channel

Established

38 27 left unknown, 2 not applicable

Completeness

61% the share the model could weigh

Citations

60 across 18 documents

Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:

B weighs 0.85 · 49 hereC weighs 0.70 · 11 here

The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.

A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.

Still open on this record.

Jurisdiction contradicts itself across the provider's own documents. The privacy policy states headquarters are "located in Saint Vincent and the Grenadines," while the Terms of Use for the same site state they are "governed by ... the laws of Portugal" with exclusive jurisdiction to Portuguese courts — matching the entity's own name, Lisbon address and Portuguese registration number printed on both pages.

The app-store privacy declarations contradict the FAQ's no-tracking claim. "Do you track my actions?" says GnuVPN "does not collect any data about our users" and shares nothing with third parties, but Google Play's data-safety page lists five categories — including precise location — shared with third parties for advertising, and Apple's label separately declares "User Content" used to track the user across other apps.

No server list, protocol list or transparency report could be established. "55+ countries" is a marketing figure, not an enumerable list, and the only protocol named anywhere is one FAQ line crediting security to "the SoftEther protocol" — too thin to state as the full offered list. No transparency report, warrant canary, case-history event or independent no-logs audit exists; the only external validation is the app-security MASA badge.

On the record as a whole.

GNUAPP UNIPESSOAL LDA also publishes an ERP app and an eSIM brand (esimsecure.com) under the same entity; no sibling VPN brand under a shared group was identified. The 'Verified'/MASA badge is Google's App Defense Alliance Mobile App Security Assessment (app-level, not a no-logs audit) surfaced on the Play Store listing and explained on GnuVPN's own FAQ; no report, firm name or date is published for it.

U04_price_monthly (6.99) is the reference price shown struck through next to every discounted tier and matches the '1-month subscription' referenced in the refund-policy FAQ; no separate 1-month tile is offered on the pricing page itself. No stated renewal price was found for the 1-year plan distinct from its $41.99 first-term total.

IntegrityHas it been caught saying one thing and doing another?16 fields read · 5 left unknown · 1 not applicable · 72.1 points of pressure×0.279

What this channel priced on this record:Lie 0.4Monetisation 0.1Store declaration 0.45Owner transparency 0.06

User base scale (mass >=10M, mid >=1M, niche <1M)also read by silenceM08_user_scale

unknown

nothing published · recorded as asserted

Report a problem with M08_user_scale

Other businesses of the owner groupM10_owner_other_business

app_portfolio

Capps.apple.com Besimsecure.com13 Sep 2026

Report a problem with M10_owner_other_business

Transparency reportalso read by ignorance, silenceP05_transparency_report

none

Cgnuvpn.com13 Sep 2026

Report

Computed

×0.057 of a clean record completeness 61%

Where the drop comes from: Integrity. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.279, and its bar above is filled to that.

Exposure is recorded as low and the integrity status as caught_lying.

Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.950 where the register averages ×0.680 — and furthest below on Integrity, ×0.279 against ×0.658.

Published score

Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.

Specification

Carried, never scored

If this one is not right

GNUVPN

Proton VPN

Mullvad VPN

IVPN

Where the security score comes from