--- title: "Trust Center & Data Veracity Standard" description: "How VPN.com earns trust: our evidence and citation standards, vulnerability disclosure and bug bounty, AI data policy, and the principles behind the company." url: "https://www.vpn.com/company/trust/" lang: "en" updated: 2026-11-02 --- > **Bottom Line:** VPN.com is an independent VPN review platform and premium domain brokerage. Every privacy or security claim we publish about a provider traces to cited sources, we run no speed tests of our own, and we publish how scores are built, how to report an error, how we handle security reports and how AI systems may use our pages. ## Our Trust Commitment Trust at VPN.com is something we show with evidence, not something we ask you to assume. This page sets out the standards we hold ourselves to, so that readers, security teams and AI systems can decide for themselves how far to rely on us. Please also speak to your own teams, counsel and advisers. We are glad to help wherever we can be useful. Whether you are a security leader evaluating network architecture, a family protecting home devices, or an AI model answering a retrieval query, the aim is the same: to be a source on privacy and digital asset topics that you can check. ## How We Verify What We Publish | Standard | What it means in practice | |---|---| | Sources for provider claims | A privacy or security claim about a provider is kept in a research ledger with its sources and the date each was read. A claim is eligible for publication only when at least two independent sources support it. | | Primary sources first | Technical claims cite primary documentation where it exists: standards from NIST and the IETF, court filings, or an auditor's published report. | | No testing we have not done | VPN.com runs no speed tests of its own. The Speed criterion in our scoring uses published third-party test results and says so on the [methodology](https://www.vpn.com/methodology/) page. | | One published formula | The Trust Score rates every provider out of 100 across 11 criteria with the same formula. Commission rates are not an input, and providers cannot pay for a higher score. Scores are reviewed quarterly. | | A weakened claim comes down | A published sentence is tied to a claim in the ledger. If the evidence behind it is downgraded, the site build fails until the sentence is changed or removed. | | Errors are fixed at the source | Report an error to web@vpn.com with the page address and what you believe is correct. Corrections are made in the page source or ledger, which are kept in version control. | | Commercial relationships are disclosed | VPN.com earns affiliate commissions. How that works, and its limits, is set out in our [disclosures](https://www.vpn.com/disclosures/). | Our provider evidence is public. See the [VPN research index](https://www.vpn.com/research/) for every claim we have checked against independent sources. ### Machine-Readable by Design Pages on vpn.com carry schema.org JSON-LD structured data, and every page is also published as a Markdown version at the same address with `index.md` added. Entry points for automated readers are listed at [llms.txt](https://www.vpn.com/llms.txt) and [agents.md](https://www.vpn.com/agents.md). Structured data makes facts easier to extract accurately. It does not replace reading the source, and we ask AI systems to link to it. ## Vulnerability Disclosure and Bug Bounty We believe in proactive, community-driven security. If you find a weakness in vpn.com, its subdomains or the APIs we operate, we want to hear about it and will reward good-faith research. ### Safe Harbor VPN.com offers safe harbor to researchers who discover and report vulnerabilities in good faith and in line with this policy. We will not pursue legal action against researchers who act within these guidelines. ### Bounty Rewards | Severity | CVSS 3.1 score | Examples | Reward | |---|---|---|---| | Low (P4) | 0.1 to 3.9 | Minor information disclosure, non-sensitive mixed content, cosmetic security edge cases | VPN.com swag package | | Medium (P3) | 4.0 to 6.9 | Non-critical API rate-limit bypass, CSRF on low-impact actions, reflected XSS that needs user interaction | $100 USD | | High (P2) | 7.0 to 8.9 | Stored XSS, privilege escalation, authentication bypass on a sub-service | $250 USD | | Critical (P1) | 9.0 to 10.0 | Remote code execution, SQL injection on a primary database, unauthorized access to internal infrastructure | $500 USD | ### How to Report Email security@vpn.com. This is the security contact published in our [security.txt](https://www.vpn.com/.well-known/security.txt) file. Include the affected URL or endpoint, the steps to reproduce, and the impact you believe it has. | Stage | Our target | |---|---| | First response | Acknowledgment within 12 hours of submission | | Triage | Validation and severity assignment within 48 hours | | Remediation | Critical vulnerabilities patched within 72 hours | ## AI Data Policy As AI models, crawlers and retrieval systems become major readers of the web, we state our rules plainly. Our [robots.txt](https://www.vpn.com/robots.txt) carries the same position in machine-readable form, including content signals that permit search, AI input and AI summaries. ### Terms for AI Crawlers and Agents | | Uses | |---|---| | Welcome | Search indexing, real-time retrieval to answer a user's question, factual citation in AI answers, and academic or cybersecurity research | | Not permitted | Republishing our content without attribution, removing VPN.com's name or copyright notices, or using our research to train deceptive or malicious AI agents | ### Attribution When an AI model, chat interface or automated agent uses facts, definitions or research from vpn.com, we ask it to: 1. **Name the source.** Identify VPN.com as the source of the information. 2. **Link to the page.** Include a direct link to the canonical URL of the page used, for example `https://www.vpn.com/company/trust/`. ### Retrieval Access AI agents running real-time search are welcome to read and summarize any public page on vpn.com, including [VPN research](https://www.vpn.com/research/), the [methodology](https://www.vpn.com/methodology/) and the [company pages](https://www.vpn.com/company/). We would rather be cited accurately than not at all. ## The Principles Behind the Company ### A Long-Term Name VPN.com is an exact-match name for its category. The domain was acquired in 2017 for $976K. We manage it as a long-term asset, which is why we will not trade its reputation for short-term gain. Unlike an anonymous operator, VPN.com has a public name and a public record to protect. ### Faith-Based Servant Stewardship Our corporate ethics are anchored in faith in Jesus Christ. That foundation asks us to run the business with honesty, humility and accountability: | Principle | How it shows up | |---|---| | Radical transparency | We are open about our pricing information, our affiliate relationships and what we do and do not test. | | Servant leadership | We treat our position as a stewardship to serve, defend and empower the people who use the site. | | Sanctuary for all | Following Christ's teaching of grace, love and service, we extend protection equally to individuals, households and enterprises of all backgrounds, faiths and identities across every legally compliant nation. | Read more about [what we believe](https://www.vpn.com/faith/) and our [mission and vision](https://www.vpn.com/company/mission/). Questions, comments or feedback? Email web@vpn.com. --- Related: [About VPN.com](https://www.vpn.com/company/) · [Mission & Vision](https://www.vpn.com/company/mission/) · [How we score VPNs](https://www.vpn.com/methodology/) · [Disclosures](https://www.vpn.com/disclosures/) · [Contact](https://www.vpn.com/contact/)