The state of VPN privacy

Price and the security score are read from different halves of the record and never touch. The 2 priced records at acceptable or above ask a median of $61.74 a year; the 62 below that line ask $57.37. Of the 32 records priced above the register’s median of $57.37, 1 clears the acceptable line. The cheapest record that clears it is Proton VPN, at $53.88 for the year.

A record that is not sold has no yearly price and says so; a record whose price was not established says that instead. Neither is a zero, and neither is in a median.

Owner group	Records	Infrastructure between them	Owner’s country	Brand role
Pango Group5 records	OVPN, UltraVPN, Total VPN, Betternet, Touch VPN	A shared backend ×3, Separate infrastructure, Not established	United States ×3, Not established ×2	Not established ×2, A brand the group acquired, A secondary brand, The group's principal brand
Gen Digital4 records	AVG VPN, Norton VPN, Avira VPN, Avast VPN	Not established ×4	United States ×4	A brand the group acquired ×2, The group's principal brand ×2
Kape Technologies3 records	Private Internet Access, CyberGhost VPN, ExpressVPN	Not established ×3	Isle of Man ×3	A brand the group acquired ×2, A secondary brand
Innovative Connecting2 records	Turbo VPN, VPN Proxy Master	The same server fleet ×2	China ×2	A secondary brand, The group's principal brand
Nord Security2 records	NordVPN, Surfshark	Separate infrastructure ×2	Not established ×2	The group's principal brand ×2
Ziff Davis2 records	StrongVPN, IPVanish	Not established ×2	United States ×2	A brand the group acquired ×2
Certida1 record	VyprVPN	Not established	United States	The group's principal brand
Disrupt1 record	PureVPN	Not established	United Arab Emirates	The group's principal brand
IVPN1 record	Portmaster	Not established	Not established	A brand the group acquired
Kunlun Tech1 record	Opera VPN	Separate infrastructure	China	The group's principal brand
Malwarebytes1 record	Malwarebytes VPN	The same server fleet	Not established	The group's principal brand
McAfee1 record	TunnelBear	Not established	Not established	A brand the group acquired
Miss Group1 record	PrivateVPN	Not established	Sweden	A brand the group acquired
OpenText Corporation1 record	Webroot VPN	Not established	Canada	A brand the group acquired
SoftEther Project1 record	VGVPN Gate	A shared backend	Japan	A secondary brand
Independent45 records
Not established5 records	PandaVPN, VPNBook, FastestVPN, HideMyAss, Hola VPN	—	Not established ×4, United States	Not established ×4, A secondary brand

18 of the 77 records share an owner with at least one other record on this register, in 6 groups; the largest is Pango Group, with OVPN, UltraVPN, Total VPN, Betternet and Touch VPN. 7 records run on a fleet or backend shared with a sibling. Each brand is scored on its own record, and the model imports a sibling’s documented lie only through the cluster rule, never its score.

38 of the 77 records say an independent audit exists; for 26 of them the report was read, for 12 the claim stands on the provider’s announcement alone, and 9 have none. A report that was read is only as good as its scope, so the tables below also say what the audit looked at, who signed it, how often it recurs, and how old the latest one was on 26 September 2026.

The Documented column counts, among the records carrying that value, those where the value rests on a source that can be read rather than on the provider’s announcement. It is the difference between an audit that happened and an audit that was said to.

18 of the 77 records carry at least one documented enforcement event — a seizure, a court order, a subpoena, a mandate or a breach — 24 events in all. In 11 of those records every event ended with nothing produced, which is practice evidence and ages far more slowly than an audit; in 7, something was handed over. The remaining 59 have simply never been tested in public, and silence at scale is priced as its own channel.

11 of the 77 records carry a documented gap between what the provider said and what it did, 5 of them about logging and 2 about who owns the service. 18 carry a gap between the marketing and the audit that was meant to back it, and 37 still advertise total anonymity or military-grade encryption. The model presumes nothing here: a record is clean only after it was looked at, and 33 have not been.

Band	Security score	Records	Share	Who
Strong	75 and above	0	0%	none at this pin
Acceptable	55 and above	2	3%	Proton VPN, Mullvad VPN
Weak	35 and above	2	3%	IVPN, AirVPN
Insufficient	15 and above	11	14%	hide.me, Private Internet Access, RiseupVPN, OVPN, CyberGhost VPN, CactusVPN, UltraVPN, NordVPN, Surfshark, X-VPN, PrivateVPN
Not recommended	below 15	53	69%
No data	any score	9	12%	PotatoVPN, AstrillVPN, iTop VPN, Disconnect, Touch VPN, PandaVPN, VPN Master Pro, VPNBook, Steganos VPN

The median security score on the register is 6 out of 100, and the spread runs from 0 to 70. The score is a product over eight independent risk channels, so one bad channel decides it; the channel that decided most often is retention, dominant on 39 of 77 records. Usability is a separate additive sum, never averaged in, and the order of every list on the site follows security alone.

The 77 records are incorporated in 30 countries and their ultimate owners sit in 16, with 36 owners not established at all. 22 records are incorporated where the law mandates retention, which the model prices as its own risk on the jurisdiction channel; the secret-order column is the regime of the incorporation country, and a country’s own mandate is the model’s fact, not the record’s.

46 of the 77 records publish a list of exit countries, running from 4 to 168; 7 reach a hundred or more, and 31 publish no list at all, a fact about disclosure before it is one about reach. 9 records allow unlimited simultaneous connections; the rest allow between 1 and 20. 31 offer a free tier rather than a trial, and a free tier funded by something other than the user is flagged on its record.

The register is a sample, not a census: membership is decided by hand, one provider at a time, and nothing here estimates what it misses. A provider absent from these tables is evidence about that hand-picking before it is evidence about the provider. The model’s other limits are published in full on the methodology page, and a wrong number is corrected the day it is reported — tell us.