- Insufficient1
Coverage149countries
Paying monthly$14.99monthly
Paying yearly$139.08yearly total
Free tierNopaid plans only
Devices10at once
17 out of 100Security
70 out of 100Usability
Servers in country
Providers with exit locations in Barbados: a server here gives you an address in the country. The register’s table records no mandate for VPN operators here; the briefing below sets out what the law asks of providers.
Only a few providers publish an exit here.
Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.
Barbados routes cybercrime investigation through judges: under the Computer Misuse Act, in operation since 2005, a judge orders a provider to produce subscriber data or disclose traffic data. The Interception of Communications Bill, 2025 would limit an initial interception warrant to 120 days.
Under the Computer Misuse Act (Cap. 124B, in operation since 18 July 2005), a judge may order an Internet service provider in Barbados to produce information about persons who subscribe to or use its service (s. 18), a system’s controller to disclose traffic data identifying the providers and the path of a communication (s. 19), or preserve stored data for up to 14 days, extendable on a judge’s authority (s. 20).
The Interception of Communications Bill, 2025, as amended in the Senate on 20 August 2025, lets a judge direct persons to furnish information, facilities or technical assistance for a warrant (s. 8(5)). It limits an initial warrant to 120 days (s. 9) and creates an Independent Monitoring Commission. Parliament’s bill page lists it as passed, with no assent date. Neither text imposes a standing retention period on providers.
The Cybercrime Bill, 2023, gazetted on 11 December 2023, would repeal the Computer Misuse Act; the 29 January 2024 text is still a Bill. Its section 19 would punish, by up to seven years, publishing data that intimidates or threatens violence, or disseminating words “not caring whether they are true or false” that cause ridicule, contempt or embarrassment. Whether any of these reaches a VPN operator is not established.
The Computer Misuse Act addresses conduct against systems and data (illegal access, interference, interception, devices and access codes in ss. 4–12), not content, and it contains no power to block sites.
The Act creates no speech offences, so a post is reached only where it involves an offence against a system or data: illegal interception of a non-public transmission carries a fine of $50,000 or five years (s. 7). Where an offence is under investigation, a judge can order the Internet service provider to produce subscriber information (s. 18), which is how a user behind an address is identified.
Every order under the Computer Misuse Act comes from a judge (ss. 18–20). The order of the rows is the security score, and a server’s location is not a recommendation.
Barbados
Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.
A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.
More countries
What moved
Every row is the record’s own history[], filtered to U02_server_countries and P04_mandate_response; the whole log holds every field.
29 Aug 20261 changes
NordVPNResponse to a national logging mandateP04_mandate_response
not on the record changed to withdrew_physical
