Insufficient

Private Internet Access

Commercial VPNUnited StatesRank 6 of 68

Paying monthly

$11.95 per month

Paying yearly

$47.88 billed once a year

Coverage

91 countries with an exit

Free tier

No paid plans only

25 out of 100

Security

73 out of 100

Usability

Visit site

Offered countries that sit under a logging mandateC09_mandate_countries

United Arab Emirates China India Kazakhstan Turkey Vietnam

Country of the ultimate beneficial ownerM11_owner_jurisdiction

Owner group cluster keyM15_owner_group

kape

Date the current owner took controlM16_control_since

2019-12

Role of this brand inside the groupM17_brand_role

secondary_brand

Infrastructure shared with cluster siblingsM18_shared_infrastructure

unknown

Total published auditsV10_audit_count

Service class

Commercial VPN — security leads

Security score

25 of 100 · Insufficient

Usability score

73 of 100 · state known · 100% established · 100.0% of the weight read

Legal entity

PIA Private Internet Access, Inc., 5555 DTC Parkway, Suite 360, Greenwood Village, CO 80111, USA

Jurisdiction

United States

Ultimate owner

Teddy Sagi, via Unikmind Holdings Limited (Isle of Man), sole shareholder of Kape Technologies plc since the May 2023 delisting; Kape owns PIA Private Internet Access, Inc.

Exposure

Medium · dominant channel: integrity

Retention

Nothing that links traffic to a person

Latest audit

Deloitte Audit SRL (Romania) · 19 Dec 2025 · Repeated, at no fixed interval · unknown

Countries with exits

Protocols

WireGuard OpenVPN IKEv2

Works under active censorship

Claimed to work

Weakest protocol still offered

not applicable

Own DNS inside the tunnel

Yes, on the provider's word

Platforms

Windows macOS Linux iOS Android Routers Android TV Apple TV Browser extension

Simultaneous devices

unlimited

Kill switch

On every platform

Split tunnelling

Available

Signing up

An email address only

Free tier

No free tier

P2P allowed

Allowed

Major streaming services reachable

Reachable

Price, monthly

$11.95 per month

Price, yearly

$47.88 a year at renewal, billed once

Where the security score comes from

Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works

Security fields

67 55 of them feed a channel

Established

59 6 left unknown, 2 not applicable

Completeness

89% the share the model could weigh

Citations

96 across 35 documents

Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:

A weighs 1.00 · 17 hereB weighs 0.85 · 64 hereC weighs 0.70 · 15 here

The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.

A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.

Still open on this record.

What the report is. The security score rests on a Deloitte Audit SRL limited assurance report under ISAE 3000 (Revised), signed 19 December 2025 for the configuration as of 31 October 2025. Read what that is: the conclusion is negative assurance — "nothing has come to our attention" — against a description PIA's own management wrote, and the report states it provides no assurance for any other period.

Who the report is for. The auditor also restricts the report to PIA management and disclaims responsibility to any other reader, so the strongest document in this record is one whose author declines a duty of care toward the person reading it here. Procedures were performed on a sample basis, which is why fleet coverage is recorded as a sample.

the rest of what is open — 143 more words

What it did not examine. The report covers infrastructure only. C07a_app_sdk and C12_device_identifier are app-side facts it never examined; they now cite the privacy policy instead, which describes analytics for website visitors and opt-in diagnostic reports carrying platform and app version. Reading either as a statement about SDKs compiled into the app is the weakest link in this record, and the open-source clients are where it would actually be settled.

The 2016 subpoena rests on PIA's own word, not the court file. The only detailed account of the McWaters case (S.D. Fla., 9:16-cr-80043) sits on an affiliate site this record cannot cite; CourtListener's docket for that case names no subpoena, no provider and no outcome. P03_court_record and P12_case_history now stand on PIA's own transparency-report statement that it was subpoenaed in 2016-2017 and produced nothing — a B-level self-declaration, not a verified court record.

On the record as a whole.

First fill 2026-08-26, refreshed 2026-09-12 on P03_court_record, P12_case_history and V12_client_open_source, refreshed again 2026-09-13 on M08_user_scale, P02_disclosure_history, P03_court_record, P05_transparency_report, P06_report_plausibility, P08_requests_received, P09_data_provided and P12_case_history, and refreshed again 2026-09-13 on U04_price_monthly and U04b_price_yearly.

The 2026-09-13 pass found PIA had published its Q1 2026 and Q2 2026 transparency reports since the record's last look at Q4 2025; the record now cites the Q2 2026 post (19 requests received, 0 resulting in data provided, covering April-June 2026, published 2026-08-06) as the freshest, with the same subpoenas/warrants/other/foreign breakdown structure as before.

the rest of what is open — 252 more words

M08_user_scale, P02_disclosure_history, P03_court_record and P12_case_history were re-read against the same sources and stand unchanged; the main transparency-report page still names no case beyond the 2016-2017 subpoenas already on file. The pricing re-read against the same buy-vpn-online page found both figures unchanged: month-to-month $11.95, one-year plan $47.88 billed for the first year and autorenewing at the same $47.88 with no intro/renewal gap, consistent with PIA's flat-rate pricing noted elsewhere in the catalogue.

Sourced from privateinternetaccess.com's own pages and blog, the two Deloitte ISAE 3000 (Revised) 'Independent Limited Assurance Report' PDFs (April 2024 and December 2025, both opened and read directly), Kape Technologies' own site, the Isle of Man/Companies House-sourced reporting on Kape's 2023 take-private by Unikmind Holdings (Teddy Sagi), and the official pia-foss GitHub organisation for the open-source clients.

The public CourtListener docket for United States v. McWaters (9:16-cr-80043, S.D. Fla.) was opened but names no subpoena, VPN provider or outcome; the affiliate writeup (vpncompare.co.uk) that describes that subpoena in detail was dropped as a forbidden source, and TorrentFreak's own coverage returned HTTP 403 to every fetch attempt this run, curl included. P03/P12 now rest on PIA's own transparency-report self-declaration instead.

Wikipedia was dropped from V12 in favour of the GitHub organisation itself. No affiliate or 'best VPN' aggregator site was used as a factual source anywhere in this record, even though several turned up repeatedly in search results with plausible-looking numbers (server counts, user counts, audit dates) that could not be cross-checked against a primary page and were discarded rather than used.

IntegrityHas it been caught saying one thing and doing another?16 fields read · 2 left unknown · 1 not applicable · 45.9 points of pressure×0.541

What this channel priced on this record:Monetisation 0.2Absolute claims 0.04Owner transparency 0.06Owner group history 0.25

User base scale (mass >=10M, mid >=1M, niche <1M)also read by silenceM08_user_scale

mid

Binvestegate.co.uk2019-12

Report a problem with M08_user_scale

Other businesses of the owner groupM10_owner_other_business

antivirusreview_directoryadtech_adware

Cen.wikipedia.org Ckape.com26 Aug 2026

Report a problem with M10_owner_other_business

Transparency reportalso read by ignorance, silenceP05_transparency_report

fresh_with_numbers

Computed

×0.254 of a clean record completeness 89%

Where the drop comes from: Integrity. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.541, and its bar above is filled to that.

Exposure is recorded as medium and the integrity status as unexamined.

Against the rest of the register, this record sits furthest above on Retention — ×0.812 where the register averages ×0.432 — and furthest below on Integrity, ×0.541 against ×0.658.

Published score

Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.

Specification

Carried, never scored

Countries with an exit

What changed

If this one is not right

Compared with

Private Internet Access

Proton VPN

Mullvad VPN

IVPN

Where the security score comes from