From the article:
| VPN | HQ & Eyes Alliance | Latest Independent Audit | Real-World Test | Retention Verdict* |
|---|---|---|---|---|
| ExpressVPN | British Virgin Islands (no data-retention laws) | KPMG ISAE 3000 Type I, Feb 2025 (ExpressVPN) | Split-tunnelling DNS leak disclosed Feb 2024 (patched) | Gold-standard. RAM-only fleet, annual audits, BVI jurisdiction. |
| NordVPN | Panama | Deloitte 5th audit, Dec 2024 (NordVPN) | 2018 server breach – no logs leaked | Regular audits and positive breach outcome. |
| Surfshark | Netherlands (9-Eyes) | Deloitte, Jan 2023 (Surfshark) | TunnelCrack Wi-Fi leak (Aug 2023) → patched in <7 days. | Strong audit hygiene but concerning jurisdiction. |
| Proton VPN | Switzerland | Securitum, Apr 2024 (securitum.com) | N/A | Open-source clients + Swiss privacy laws. |
| Mullvad | Sweden (14-Eyes) | Assured AB config audit 2023 | Swedish police raid Apr 18 2023 left empty-handed (Mullvad VPN) | Minimal-data design proven in the wild. |
| Private Internet Access | USA (5-Eyes) | Deloitte, Apr 2024 (Private Internet Access) | Multiple US subpoenas produced no logs | Paper-trail-verified despite US HQ. |
| CyberGhost | Romania (EU, outside Eyes) | Deloitte, May 2024 (CyberGhost VPN) | N/A | Second audit boosts trust. |
| TunnelBear | Canada (5-Eyes) | Cure53 7th audit, Dec 2023 (TunnelBear: Secure VPN Service) | N/A | Longest unbroken audit streak. |
| Windscribe | Canada (5-Eyes) | Cure53 server image audit 2022 | 2025 Greek/Canadian court case upheld no-logs stance (Tom’s Guide) | Policy tested – passed. |
| Hotspot Shield | USA (5-Eyes) | Performance/security review by AV-Test only; no dedicated no-logs audit (vpnMentor) | AV-TEST performance audit only; no no-logs audit to date. (CVE Details) | Speed king, privacy laggard. |
Archived links:
You telling me any of those are not related to israel ? Where they are registred and who truly run them is two different things and I believe a column of who truly is behind is relevant.
Expressvpn, pia and cyber ghost are owned by kape technologies
They lost me at calling ExpressVPN the gold standard. Even their audit is bs. KPMG is the same company that provides the “always-on” audit to PureVPN.
Any article that still uses the “eyes” as a factor in their evaluation is a massive red flag. Very public intelligence alliances are the least of your worries.
ExpressVPN is a Chinese govt aproved company… do all audits you want. You need trust. Audits doesn’t matter. They can change everything after. I trust IVPN and Mullvad
So i wouldn’t recommwnd them to anyone with people in china but i kind of trust them a little more for my use case now.
If you like one spy over another, be my guest. I think companies that spy are not worth it at all.
Any of them have port forwarding? Thought not…
Proton does… but you need to use a shell script to enable it on Linux. It’s easy enough and documented on their site, but it’s annoying. Mullvad does not, that’s why I moved away from them. Can’t speak for others
Do you know if Proton’s port forwarding times out and needs to be reconfigured every so often in the same way the other commenter mentions about Windscribe?
For Linux it does timeout and basically just need to run a bash while loop to keep open. I’m not sure if windows is the same way, but from what I hear it’s more integrated.
Overall the port forwarding is not that big of a hassle on Linux. It’s an opt in feature and I just have bash aliases to enable the port forwarding when I need it.
Proton is too fucking expensive.
Same price as Mullvad, about a fiver a month, if you buy a year at a time. Annoying that you have to buy a year upfront but works out to the same price
