Open almost any VPN’s homepage and you will be sold on the same handful of things: blistering speeds, thousands of servers in dozens of countries, and a price that drops if you commit for two years. All of that is real, and all of it matters for whether a VPN is pleasant to use. Almost none of it tells you whether the VPN actually protects your privacy. The features that determine that are quieter, harder to market and rarely the headline, which is exactly why they are worth understanding before you hand a company the job of carrying all of your internet traffic.
This piece sets aside the marketing and looks at what genuinely decides a VPN’s privacy: where the company is based, whether its claims have been independently verified, what it actually logs, and who owns it. It also draws a line, because the point of a VPN is often misunderstood, and knowing what it does not do is part of judging it honestly. We assess individual providers in depth in our NordVPN review and Proton VPN review, and the framework below is how we approach every one of them.
Jurisdiction: the law the provider lives under
A VPN provider is a company, and like any company it is subject to the laws of the country it is based in. Those laws determine what it can be legally compelled to collect, retain and disclose. This is why privacy-focused providers so often make a point of telling you where they are incorporated: the legal environment sets the outer boundary of what the service can promise, regardless of its intentions. A provider based somewhere with strong privacy protections and no mandatory data-retention obligations can credibly offer more than one operating under laws that compel logging.
Jurisdiction is important, but it is not the whole story, and it is easy to overweight. A conscientious, independently audited provider in a less-than-ideal jurisdiction can still be more trustworthy in practice than a poorly run one in a favourable location. Treat jurisdiction as a foundation that shapes what is possible, then look at the other factors to judge what the provider actually does with that latitude.
Audits: the difference between a claim and evidence
Every serious VPN advertises a no-logs policy, which creates an obvious problem: the words are free, and you cannot see the servers. The mechanism the industry has developed to bridge that gap is the independent audit, where an outside firm examines the provider’s systems, configurations and sometimes its code, and publishes whether the privacy claims hold up. An audit is not a perfect guarantee, because it is a snapshot in time and its rigour varies, but it is the closest thing to real evidence a buyer can point to. It converts trust me into someone independent checked.
The practical rule follows directly: a no-logs claim backed by a recent, reputable third-party audit is worth far more than the same claim with nothing behind it. When comparing providers, look for who audited them, when, and how thorough the scope was. A provider that submits to repeated independent scrutiny is making a costlier, more credible commitment than one that simply asserts its own trustworthiness on a marketing page.
Logging policy and ownership: read the detail, know who you are trusting
Beyond the audit sits the policy itself, and here the detail matters more than the slogan. No logs is a headline; the substance is in what the provider specifies it does and does not record. There is a meaningful difference between connection metadata, activity logs, timestamps, bandwidth counters and account information, and a trustworthy policy is specific about each rather than hiding behind a blanket phrase. When a policy is vague, that vagueness is itself information. The clearer and more precise the logging disclosure, the more you can actually evaluate it.
The final factor is the one people skip: who owns the company. A VPN privacy promise is only as durable as the organisation making it, so ownership, corporate history and track record all bear on how much weight to give the promise. A provider with a long record of standing behind its policies, transparent about who runs it, is a different proposition from an opaque service with an unclear business model. This is also why free VPNs deserve particular caution, because running a network costs money, and a service with no visible way of paying for itself has, historically, sometimes funded itself in the one way a privacy tool never should, by monetising the very data it promised to protect.
What a VPN does not do
Judging privacy honestly also means being clear about the limits. A VPN encrypts your traffic against your local network and hides your IP address from the sites you visit, which is genuine and useful protection. It does not make you anonymous. You remain identifiable through the accounts you log into, the cookies and fingerprints your browser carries, and through the provider itself, which is precisely why the provider’s trustworthiness is the whole game. A VPN is one layer in a privacy stack, valuable in its place, but it is not a cloak of invisibility, and any provider that implies otherwise is overselling.
What it means for buyers
When you compare VPNs, resist letting the speed charts and server tallies make the decision. Those determine whether a VPN is nice to use; they say nothing about whether it deserves your trust. Weigh the four factors that actually govern privacy instead: the jurisdiction that bounds what the provider can promise, the independent audits that turn its claims into evidence, the specificity of its logging policy, and the ownership and track record of the company behind it. A provider that scores well on those, even if it is a touch slower or pricier, is protecting you in the way that matters. And keep the scope honest, because a VPN is a strong privacy layer, not a guarantee of anonymity, and choosing one well means knowing exactly what you are and are not buying.
