Not recommended

Whoer

Commercial VPNUnited Arab EmiratesRank 53 of 68

Paying monthly

$9.90 per month

Paying yearly

$29.90 billed once a year

Coverage

20 countries with an exit

Free tier

No paid trial only

3 out of 100

Security

63 out of 100

Usability

Visit site

Offered countries that sit under a logging mandateC09_mandate_countries

Russia Turkey

Country of the ultimate beneficial ownerM11_owner_jurisdiction

unknown

Owner group cluster keyM15_owner_group

independent

Date the current owner took controlM16_control_since

not applicable

Role of this brand inside the groupM17_brand_role

principal

Infrastructure shared with cluster siblingsM18_shared_infrastructure

separate

Total published auditsV10_audit_count

unknown

Service class

Commercial VPN — security leads

Security score

3 of 100 · Not recommended

Usability score

63 of 100 · state known · 67% established · 64.7% of the weight read

Legal entity

Sam digital solutions FZE

Jurisdiction

United Arab Emirates

Ultimate owner

unknown

Exposure

Medium · dominant channel: retention

Retention

Source IP address

Latest audit

unknown · unknown · unknown · unknown

Countries with exits

Protocols

unknown

Works under active censorship

unknown

Weakest protocol still offered

unknown

Own DNS inside the tunnel

Yes, on the provider's word

Platforms

Windows macOS Linux Android iOS Routers Browser extension

Simultaneous devices

Kill switch

On every platform

Split tunnelling

Available

Signing up

An email address only

Free tier

A trial only

P2P allowed

unknown

Major streaming services reachable

unknown

Price, monthly

$9.90 per month

Price, yearly

$29.90 a year at renewal, billed once

Where the security score comes from

Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works

Security fields

67 55 of them feed a channel

Established

26 40 left unknown, 1 not applicable

Completeness

42% the share the model could weigh

Citations

40 across 14 documents

Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:

B weighs 0.85 · 39 hereD weighs 0.35 · 1 here

The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.

A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.

Still open on this record.

Ownership history. whoer.net's Terms of Use name Whoix Ltd. under the law of Nauru, its Apps Privacy Policy names WHOIX LTD in Cyprus, and the live whovpn.net checkout together with both app store listings name Sam digital solutions FZE in a UAE free zone. None of the three documents acknowledges the other two or explains the transition between them, so which entity actually controls user data today is asserted rather than reconciled.

Independent audit. No audit of any kind — no-logs, infrastructure, or application security — was found on whoer.net, whovpn.net, or either app store listing. The no-logs claim rests entirely on the provider's own privacy policy, a declaration rather than a finding, so V01 through V15 stay unknown rather than a scored absence.

the rest of what is open — 148 more words

Protocol list. Router setup pages name OpenVPN, L2TP and SSTP, and an App Store changelog adds SSTP as a recent addition, but no page enumerates the full set offered through the apps themselves. Recording only what surfaced risks understating the list, so U07 and its derived C13 stay unknown rather than a truncated one.

App store data declaration. Google Play declares the Android app collects no data at all, while Apple's privacy label lists Location, Contact Info, Identifiers, Usage Data and Diagnostics as linked to the user's identity — categories the privacy policy never mentions and that sit awkwardly beside a "we don't track" pitch.

Device limit. The website advertises no cap on simultaneous connections, while both app store listings state a single account covers up to five devices. U10 is filled from the more specific, cross-platform figure; the discrepancy with the website's own marketing copy is unresolved.

On the record as a whole.

whoer.net (an IP/DNS-leak toolset first) is the domain providers.csv fixes as identity, and website is set to its own https://whoer.net/vpn page, the one place on that domain that frames the VPN and links onward to "Buy VPN".

The actual paid product, however, is sold and operated at whovpn.net under the brand WhoVPN (app-store name "WhoX") — that domain hosts the download, pricing, servers, terms, privacy policy and checkout, and both app stores name its operator as the seller — and most of this record's fields are sourced there rather than from whoer.net directly.

M08_user_scale is filled from the provider's own unverified homepage claim ("Trusted by over 1 million users"), sourced at level D. C05_payment_anonymous reflects only the Cryptomus crypto gateway disclosed in the ToU/privacy policy; the $1/$1.50 trial checkout observed directly offered only Apple Pay, Mastercard, Visa and Google Pay.

the rest of what is open — 99 more words

Pricing recorded is the standard month-to-month/annual first-term charge shown on /download and /servers; whovpn.net/trial additionally runs a $1 (yearly) / $1.50 (monthly) 30-day introductory funnel that renews into the same standard prices, so no separate renewal figure was needed. whoer.net's own /vpn page is an affiliate-style "best VPN" comparison that ranks WhoVPN, the operator's own product, at the top alongside unrelated third-party VPNs (BiuBiu, Ostrich, Potato, VPN.ht) with no disclosure of common ownership — the basis for X11.

An affiliate programme is independently confirmed by robots.txt disallowing /affiliate/ and by the "Partner With Us" page linked from About Us.

RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 12 left unknown · 75.0 points of pressure×0.250

Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.0), at credence 0.0 from the audit and 0.2975 from how the provider engaged, against a severity of 0.75 for what is actually retained.

Retention linkable to a person as declaredmaterialC01_linkable_retention

source_ip

Bwhovpn.net14 Sep 2026

Report a problem with C01_linkable_retention

Persistent device identifier the provider holdsC12_device_identifier

unknown

nothing published · recorded as asserted

Report a problem with C12_device_identifier

At least one independent auditmaterialV01_audit_exists

unknown

nothing published · recorded as asserted

Report a problem with V01_audit_exists

How the report is publishedV02_report_publication

unknown

nothing published · recorded as asserted

Computed

×0.025 of a clean record completeness 42%

Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.250, and its bar above is filled to that.

Exposure is recorded as medium and the integrity status as unexamined.

Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.849 where the register averages ×0.680 — and furthest below on Integrity, ×0.413 against ×0.658.

Published score

Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.

Specification

Carried, never scored

Countries with an exit

If this one is not right

Whoer

Proton VPN

Mullvad VPN

IVPN

Where the security score comes from