Benchmark · v0.1 preview
VPN Privacy Benchmark.
An evidence-graded comparison of VPN providers, scored against the 28-criteria Evidence Quality Score (EQS) methodology. Every claim backed by a record. No affiliate weighting.
What this is — and isn't
v0.1 is a preview cut — 10 providers, publicly verifiable facts only (jurisdiction, audit auditor and year, court-tested incidents). It is intentionally narrow.
v0.2 will be the full dataset — 38 providers, all 28 criteria with EQS component scores, published as a versioned CSV/JSON on GitHub alongside an arXiv preprint of the methodology paper. Subscribe via contact for the release notice.
Per-record evidence lives on TheVPNMatrix, which renders all 3,469 underlying records with their EQS components. This page is the academic-framing index; TheVPNMatrix is the operational database.
Benchmark · v0.1
Top providers, publicly verifiable facts.
| Provider | Jurisdiction | Latest audit | Court-tested | Notes | |
|---|---|---|---|---|---|
| Mullvad | Sweden | Assured AB · 2023 Infrastructure | Yes — 2023 Swedish police raid yielded no user data (no-account model) | Accepts cash, no email required, RAM-only servers | Records |
| ProtonVPN | Switzerland | Securitum · 2022 App + infrastructure | Limited — IP logging required only under Swiss court order with specific subject | Open-source apps across all platforms, transparency report | Records |
| ExpressVPN | British Virgin Islands | KPMG · 2022 TrustedServer (RAM-only) infrastructure | Yes — 2017 Turkish authorities seized servers, no user data recovered | Acquired by Kape Technologies 2021 | Records |
| NordVPN | Panama | PwC Switzerland · 2022 No-logs policy + infrastructure | Partial — 2018 Finland datacenter breach disclosed publicly in 2019 | Repeated independent audits since 2018 | Records |
| IVPN | Gibraltar | Cure53 · 2022 Apps + backend | None public | Removed affiliate program 2022, transparency report quarterly | Records |
| Surfshark | Netherlands | Deloitte · 2023 No-logs policy | None public | Re-incorporated from BVI to Netherlands 2021, merged with Nord Security 2022 | Records |
| TunnelBear | Canada | Cure53 · 2023 Apps + backend (annual since 2016) | None public | Owned by McAfee since 2018, one of first VPNs to commit to annual public audits | Records |
| Private Internet Access | United States | Deloitte · 2022 No-logs server configuration | Yes — 2016 FBI subpoena and 2017 grand jury produced no user data | Owned by Kape Technologies, source code public | Records |
| Windscribe | Canada | No comprehensive public audit | Yes — 2022 Ukrainian server seizure produced no user data | Strong transparency reports, generous free tier | Records |
| CyberGhost | Romania | Deloitte · 2022 No-logs policy | None public | Owned by Kape Technologies since 2017, quarterly transparency reports | Records |
Listed alphabetically by provider · scoring bands held until v0.2 dataset import · all facts citable on TheVPNMatrix
How EQS works
Eight components, range −6 to 23.
The Evidence Quality Score (EQS) sums Type, Grade, Source Quality, Independence, Scope, Reproducibility, Age, and Conflict of Interest. A perfect record scores 23; the strong band sits 14–18; anything below 8 is excluded as insufficient evidence until corroborated.
EQS = Type + Grade + SQS + Ind + Scp + Rep + Age + COI
Dataset roadmap
v0.2 — full dataset, GitHub-versioned, arXiv preprint.
38 providers · 28 criteria · 3,469 evidence records · open CSV/JSON with semantic versioning · CHANGELOG · methodology preprint on arXiv (cs.CR).
Notice of v0.2 dataset publication goes out via the Substack