Not recommended

Webroot VPN

Commercial VPNUnited StatesRank 67 of 68

Paying monthly

$3.99 per month

Paying yearly

$35.99 billed once a year

Coverage

Not published no country list published

Free tier

No paid trial only

0 out of 100

Security

58 out of 100

Usability

Visit site

Service class

Commercial VPN — security leads

Security score

0 of 100 · Not recommended

Usability score

58 of 100 · state known · 83% established · 82.4% of the weight read

Legal entity

Webroot LLC

Jurisdiction

United States

Ultimate owner

OpenText Corporation

Exposure

Medium · dominant channel: jurisdiction

Retention

Source IP address

Latest audit

unknown · unknown · unknown · unknown

Countries with exits

not published

Protocols

IKEv2 L2TP PPTP OpenVPN

Works under active censorship

Does not work

Weakest protocol still offered

PPTP

Own DNS inside the tunnel

unknown

Platforms

Windows macOS Android iOS

Simultaneous devices

Kill switch

On every platform

Split tunnelling

Available

Signing up

An email address only

Free tier

A trial only

P2P allowed

Allowed

Major streaming services reachable

unknown

Price, monthly

$3.99 per month

Price, yearly

$35.99 a year at renewal, billed once

Offered countries that sit under a logging mandateC09_mandate_countries

unknown

Country of the ultimate beneficial ownerM11_owner_jurisdiction

Owner group cluster keyM15_owner_group

opentext

Date the current owner took controlM16_control_since

2019-12

Role of this brand inside the groupM17_brand_role

acquired_brand

Infrastructure shared with cluster siblingsM18_shared_infrastructure

unknown

Total published auditsV10_audit_count

unknown

Where the security score comes from

Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works

Security fields

67 55 of them feed a channel

Established

30 36 left unknown, 1 not applicable

Completeness

46% the share the model could weigh

Citations

42 across 14 documents

Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:

A weighs 1.00 · 4 hereB weighs 0.85 · 33 hereC weighs 0.70 · 5 here

The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.

A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.

Still open on this record.

Server footprint. Webroot advertises "80 locations in more than 65 countries" but no current itemized country list could be read: the provider's own knowledge-base article naming countries is dated October 2018 (35 countries) and is stale against the current marketing figure, so U02_server_countries and the fields derived from it stay unknown rather than publish a truncated list.

Architecture and server ownership. Whether Webroot operates its own exit infrastructure or rents it from a contractor could not be established from a citable source this session: the one document describing this in detail is an IDG/PCWorld review, which this catalogue's source table refuses outright as press paid by affiliate links. C00_architecture and C08_servers_ownership stay unknown pending a citable primary or independent-technical source.

the rest of what is open — 150 more words

No independent audit found. No no-logs audit, pentest, or transparency report could be located on Webroot's own site or its legal hub, and no independent audit of the VPN's privacy claims turned up in a search; absence of evidence is not evidence of absence, so the whole V block is recorded unknown rather than no.

Device identifier ambiguity. Google Play's data-safety form marks "Device or other IDs" as collected and shared for analytics, but that category spans everything from an installation-scoped token to a persistent hardware identifier and the app's own privacy prose does not name which. C12_device_identifier is left unknown rather than guessed.

Enforcement history. No seizure, court order, or law-enforcement demand against Webroot's VPN turned up in a search of the provider's own site or public records, so P01-P03 are recorded none_known rather than left unknown, per the catalogue's own convention for a genuine search that found nothing.

On the record as a whole.

Webroot Secure VPN / WiFi Security is a consumer VPN sold by Webroot LLC (Broomfield, Colorado), acquired by Carbonite in March 2019 and brought under OpenText Corporation (Waterloo, Ontario, Canada; NASDAQ/TSX: OTEX) when OpenText acquired Carbonite in December 2019.

Pricing differs by channel: the website sells only annual plans (3/5/10-device tiers, first-term promotional pricing with the discount clearly stated to renew at the higher list price shown on the pricing page), while the iOS app additionally offers month-to-month billing at $3.99-$5.99.

The website's secure-vpn product page markets "no-log policy" and the iOS App Store listing states outright "Webroot does not collect or log browsing activity, IP addresses or downloaded data" and "ZERO ACTIVITY LOGGING".

the rest of what is open — 175 more words

The one privacy document either page ultimately points to — Webroot's own Consumer Terms and Conditions, section 10.2, and the OpenText privacy policy it defers to — states the Service collects "Your Device's IP address and approximate geographic location" as part of ordinary operation, with no stated deletion window.

Webroot's own Google Play data-safety declaration lists Location, Device or other IDs and Personal info as collected and shared with third parties for analytics.

This is a direct, dated contradiction between the provider's own marketing claim and the provider's own legal and regulatory filings, recorded as X01_documented_lie = lie_about_logging and X12_store_data_declaration = contradicts_no_logs.

The knowledge-base subdomains community.webroot.com and answers.webroot.com served a certificate that does not match their hostname throughout this session (confirmed independently by WebFetch, curl and a Playwright browser navigation), which is a real access failure rather than an adverse finding; content from the server-locations article was read despite it via an insecure connection and is flagged here rather than cited at full weight for anything but the stale country count already discounted in key_gaps.

JurisdictionCan someone compel what exists, without the provider getting a say?5 fields read · 3 left unknown · 80.1 points of pressure×0.199

Where the company sits 0.6, where its owner sits 0.45, the exits it offers 0.05, the gag-order regime 0.05.

Hosting in the mandate countries it offersC09b_mandate_hosting

unknown

nothing published · recorded as asserted

Report a problem with C09b_mandate_hosting

Incorporation country mandates retentionC10_company_under_mandate

yes

Bprod-cms.carbonite.com27 Jan 2025

Report a problem with C10_company_under_mandate

Beneficial owner sits under a retention regimeC11_owner_under_mandate

yes

Asec.gov14 Sep 2026

Report a problem with C11_owner_under_mandate

Response to a national logging mandatealso read by ignorance

Computed

×0.003 of a clean record completeness 46%

Where the drop comes from: Jurisdiction. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.199, and its bar above is filled to that.

Exposure is recorded as medium and the integrity status as caught_lying.

Against the rest of the register, this record sits furthest above on Architecture — ×0.950 where the register averages ×0.900 — and furthest below on Jurisdiction, ×0.199 against ×0.680.

Published score

Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.

Specification

Carried, never scored

If this one is not right

Webroot VPN

Proton VPN

Mullvad VPN

IVPN

Where the security score comes from