methods / choosing-a-vpn
How to choose a VPN: audits, logging and refunds
Short answer
Judge a VPN by evidence, not badges: a no-logs policy tested in court or by independent audit, a jurisdiction you accept, WireGuard or OpenVPN support, a kill switch, and payment options you can accept. Mullvad, IVPN, PIA, Proton and OVPN publish that kind of proof.
The VPN market is not primarily a security market - it is an affiliate market. Most "best VPN 2026" pages exist to earn commissions, and the features they praise are the ones that sell. This guide inverts the order: decide what you need a VPN for, then demand evidence from providers, then pay.
First: do you even need one?
Match the tool to the problem before the wallet: name-level filtering falls to encrypted DNS, casual SNI filtering to the free WARP tunnel, a reading need on a locked-down device to the archive, and anonymity to Tor. A VPN is the right tool when you need a different exit location under your control - geo access, protecting traffic on hostile networks, or a stable IP for daily use.
The evidence checklist
- No-logs with proof, not adjectives. The strongest proof is a real event: Mullvad disclosed a 2023 police search of its Gothenburg office where investigators left without customer data because none existed to take [1]. Private Internet Access has disclosed similar court-tested history [5]. Independent audits (dated, published) and routine transparency reports are the next tier - IVPN publishes both [3][4]. A homepage badge is none of these.
- Jurisdiction you can live with. The company's legal home decides which courts can compel what. There is no perfect country, but there is a simple test: would you accept your own government receiving that request? Read where the company is incorporated, not where its servers sit.
- Modern protocols. WireGuard or OpenVPN - anything sold as proprietary "military-grade" without named protocols is marketing filler. Kill switch support is non-negotiable: when the tunnel drops, traffic must stop leaking [8].
- Payment options that fit your threat model. If your threat is "my identity linked to my browsing", a card payment undoes the VPN. Mullvad famously accepts cash by envelope and issues anonymous account numbers [2]; others accept crypto. If your threat is just filtering, identity-linked payment is fine - be honest about which case you are in [8].
- Transparency as a habit. Regular transparency reports, open-source clients, and public incident responses. IVPN's reports [3] and Mullvad's incident disclosure [1] are the model; a provider with no page on the subject is telling you something too.
- Honest marketing. Lifetime deals, review-farm badges, "military-grade encryption" and fake countdown timers are warning signs, not features. The good providers are boring on purpose [8].
The providers that publish evidence
We track providers in a live snapshot on our data pages; these five have public track records worth reading in their own words [1][3][5][6][7]:
- Mullvad - anonymous numbered accounts, cash payment, a no-logs policy tested under a real warrant [1][2]. No streaming promises; privacy is the product.
- IVPN - small, privacy-first, publishes transparency reports and audits [3][4].
- Private Internet Access - long track record with court-tested no-logs history and regular audits [5].
- Proton VPN - Swiss jurisdiction, open-source clients, audited no-logs policy, and the honest free tier covered in our free tiers guide [6].
- OVPN - another audited, court-proven no-logs provider [7].
None of these links are affiliate links - that is the point of this guide.
The mistakes people pay for
- Choosing by "which VPN unblocks X". Unblocking is a cat-and-mouse race that changes weekly; logging policy and jurisdiction cannot be un-bought. Choose for the durable feature.
- Trusting review-site badges. The commission model means the "best VPN" lists you find in search are auctions. Read the provider's own transparency material instead [8].
- Paying for anonymity while logging in everywhere. The VPN hides your IP from sites; your logins reattach your identity. If anonymity is the goal, Tor is the tool; a VPN is a location and pipe tool [8].
- Auto-renewing multi-year plans on a bad provider. Test one month first. A provider confident in its product sells short terms.
A note on legality and expectations
VPNs are legal in most countries and used by companies daily; a few states restrict or license them, and censorship networks sometimes block known VPN endpoints - packet-trick tools and Psiphon exist for exactly those networks. And a VPN never makes you anonymous: it relocates trust from your ISP to the provider, which is why every check in this guide is about finding a provider you can actually trust [8]. This guide is information, not legal advice.
Measure honestly, too: after installing, verify the exit on the 1.1.1.1 help page, and test whether your block actually fell with OONI Probe [10].
FAQ
What does no-logs actually mean?
The provider keeps no record of which sites you visited or which address you used while connected. The only versions worth trusting are the ones with evidence: an independent audit, a published transparency report, or - the strongest - a policy that survived a real police search.
Does the VPN's country really matter?
Yes - it decides which legal system can compel the provider. There is no magic 'safe' country, but you should know where the company is incorporated and whether you accept its courts and data-retention rules.
Is a VPN illegal anywhere?
VPNs are legal in most countries and used routinely by businesses. A few states restrict or license them, and heavily censored networks may block VPN endpoints. This guide is information, not legal advice - know your local situation.
Will a VPN slow my connection down?
Some - you add a hop and encryption. On a well-run provider the loss is modest and often unnoticeable for reading and messaging; congestion is the bigger factor, which is why free tiers and oversold servers feel slow.
Should I buy a multi-year plan?
Not before testing. Buy one month, verify the exit, test against your actual block, and check the apps on your devices. Providers confident in their service sell short terms.
Do VPNs work on school or work networks?
Technically often yes, but managed networks have their own rules and may log the attempt. The honest tool there is a zero-install method - the archive or a translate proxy - not a VPN fighting the administrator.
What is better for unblocking: a VPN or WARP?
WARP is free and beats name- and handshake-level filtering, but it has no exit-country picker, so geo blocks stay. If your block is a site-side wall, you need a VPN whose exit sits in an allowed country - that is what you pay for.