How to evaluate a VPN provider without taking claims on trust

What to look at

This guide names no providers and publishes no rankings or speed figures. Services, owners and policies change; the questions below stay useful.

Criteria for comparing providers, and the evidence that answers each one.
Criterion	What to look for	Ask yourself
Ownership	A named company, where it is registered and who owns it	Can I find out who runs this service?
Logging	A specific policy saying what is and is not recorded, and for how long	Does it list connection times, addresses or payment data separately?
Independent checks	Published audit reports with a date and a stated scope	Did the audit cover the servers and apps I would use, recently?
Legal requests	A transparency report on government and legal requests	How has the provider responded to requests before?
Jurisdiction	The country whose law applies to the provider	What could the provider be required to keep or hand over there?
Protocols and apps	Open, well-reviewed protocols and apps for my devices	Are the apps maintained and updated?
Terms and payment	Clear terms, a refund policy, and payment options I am comfortable with	Can I leave easily if it does not suit me?

Reading a no-logs policy

A no-logs policy describes what a provider says it does. It is not something you can verify from the outside.

Look for the exceptions: payment records, account emails, crash reports and support conversations are often kept.
Check whether the policy distinguishes activity logs (what you did) from connection logs (when and from where you connected).
Prefer policies backed by an audit or by a public record of how legal requests were answered.
Note the date. A policy or audit from several years ago says little about the service today.

Claims that call for more caution

Promises such as "100% anonymous" or "military-grade, unhackable security". No service can promise either.
No company name, address or owner anywhere on the site.
Reviews or comparison sites that earn a commission from the provider they rank first, without saying so.
Apps that ask for permissions unrelated to a VPN, such as contacts or messages.
A free service with no clear explanation of how it pays for its servers.

Provider checklist

Before you sign up

0 of 7 done

I know who owns and runs the service, and where it is based.
I have read the privacy policy, including what it does keep.
I found an independent audit or transparency report, and checked its date and scope.
It supports my devices with maintained apps or standard protocols.
I have read the terms, including what uses they forbid.
I know how to cancel and whether there is a refund period.
Using it is lawful where I am, and allowed on the networks and devices I will use it on.

Terms used here

No-logs policy

A provider's statement that it does not keep records of your activity. It is a promise, not a technical fact; look for independent evidence and read what exactly is excluded.

Independent audit

A review of a provider's systems or policies by an outside firm. Its value depends on what was in scope, when it was done and whether the report is published.

Jurisdiction

The country whose laws apply to a provider. It affects what data the provider can be legally required to keep or hand over.

VPN protocol

The set of rules a VPN uses to set up the tunnel and encrypt traffic. Common open protocols include WireGuard, OpenVPN and IKEv2 with IPsec.