- Insufficient1
Coverage149countries
Paying monthly$14.99monthly
Paying yearly$139.08yearly total
Free tierNopaid plans only
Devices10at once
17 out of 100Security
70 out of 100Usability
Servers in country
Providers with exit locations in Malawi: a server here gives you an address in the country. The register’s table records no mandate for VPN operators here; the briefing below sets out what the law asks of providers.
Only a few providers publish an exit here.
Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.
Malawi’s Electronic Transactions and Cyber Security Act, in its text consolidated to 31 December 2017, obliges hosting and access intermediaries to preserve data identifying whoever created content, leaves the retention period to future regulations, and requires providers of encryption services to declare their technical characteristics and source code to the regulator.
The Electronic Transactions and Cyber Security Act (Act No. 33 of 2016, Cap. 74:02, 2017 text) requires an intermediary service provider to preserve the data that identifies any person who contributed to the content of its services (s. 29(1)); the High Court may require it to be handed over, and the Malawi Communications Regulatory Authority may issue regulations on how long it is kept (s. 29(2)–(3)). Intermediaries need not monitor content (s. 25(2)(a)).
Whether these duties reach a VPN operator is not established.
An intermediary must give users a means of restricting access to certain services, set up a system for reports of unlawful content, tell the Authority of illegal content reported to it, and remove or disable stored content on a takedown notice (ss. 28–30).
A person may not provide cryptographic services or products without registering with the Authority (s. 52), and a provider of encryption services must declare its technical characteristics and source code (s. 67).
The Act punishes unauthorised access, interception or interference with data (s. 84: a fine of K2,000,000 and five years), child pornography (s. 85), and cyber harassment (s. 86: obscene or indecent requests, or threats of injury; K2,000,000 and five years). Offensive communication (s. 87), meaning wilful and repeated electronic communication to disturb another’s peace or privacy, and cyber stalking (s. 88) carry K1,000,000 and twelve months.
The Act leaves it to the Minister’s regulations to specify when interception of data may be permitted (s. 84(2)). The order of the rows is the security score, and a server’s location is not a recommendation.
Malawi
Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.
A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.
More countries
Coverage149countries
Paying monthly$14.99monthly
Paying yearly$139.08yearly total
Free tierNopaid plans only
Devices10at once
Security
Usability
What moved
Every row is the record’s own history[], filtered to U02_server_countries and P04_mandate_response; the whole log holds every field.
29 Aug 20261 changes
NordVPNResponse to a national logging mandateP04_mandate_response
not on the record changed to withdrew_physical
