Bottom Line: The IRS says multi-factor authentication and a secure VPN should be the minimum for remote access to a tax firm’s office network, and the FTC Safeguards Rule requires multi-factor sign-in for anyone accessing client data. Neither names a product. A VPN alone does not make a firm compliant. A very small firm may be fine on a multi-device consumer plan; a firm that needs an admin console and enforced MFA will want a business plan.

What this page is for

This page is for the partner or office manager of an accounting or tax practice choosing a VPN for staff who work from home, on the road or at a client’s office. It sits under our best VPN for business guide, which explains how a business VPN differs from a personal one. For larger organisations see the enterprise VPN guide. Other regulated fields have different rules; see best VPN for healthcare and best VPN for law firms.

We do not run our own security tests. Every vendor-specific line below is what the vendor says on its own pages, with the date we read it. The IRS and FTC texts are linked under Resources. This is general information, not legal advice.

Does the IRS require tax preparers to use a VPN?

The IRS publication says a secure VPN and multi-factor authentication “should be minimum standards” for remote access to the firm’s office network. That is guidance in a publication, and it names no product. The binding rule is the FTC Safeguards Rule, which asks for a written security plan, MFA on access to client data and encryption in transit. A VPN alone does not make a firm compliant.

Do I need a business plan or will a consumer plan do?

For a firm of 3 to 10 people the honest answer is that the rules do not say, so it comes down to what you need to control. Publication 4557 asks for a secure VPN; it does not ask for a business plan. A multi-device consumer plan gives staff an encrypted tunnel. What it lacks is an admin console to add or remove a person and a way to enforce MFA on the VPN sign-in.

NordVPN is reviewed on our NordVPN page. Whichever you choose, the Safeguards Rule’s MFA requirement applies to access to your systems, so turn it on in your tax software and storage too.

Which business plans include the controls

The controls a tax firm can switch on are multi-factor sign-in (MFA, a second proof beyond a password), single sign-on (SSO, so access follows your staff accounts) and dedicated IP or allow-listing (so a system accepts connections only from a fixed address). Each vendor below says what its plans include, read on 8 October 2026.

GoodAccess has no review page on VPN.com, so it is not linked internally. NordLayer has no review page either, so NordLayer links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say.

What to ask a VPN company before client files go through it

The Safeguards Rule expects a firm to oversee its service providers, so ask:

1. Which security reports or certifications do you hold, and can I see them? Ask for the report, not just the badge, and check its date.
2. Is there a written data-processing or confidentiality agreement, and who signs it? Get it before client files cross the service.
3. Which controls come with my plan? MFA enforcement, SSO and a dedicated IP are gated by plan at the vendors above.
4. What does the vendor log, and for how long? Your own duty to protect client data does not end with the vendor’s promise.

Final Verdict

The VPN is one control. Your written plan, the person who owns it, software logins and staff training decide the rest.

Bottom Line: No VPN makes a defense contractor CMMC compliant. CMMC Level 2 is 110 requirements; a VPN can help with three of them: encryption in transit, validated cryptography (only if its module is validated) and multi-factor sign-in (only if the plan enforces it). A VPN alone does not make a company compliant. Ask any vendor for its CMVP certificate number before CUI crosses its service.

What this page is for

This page is for an owner or IT lead at a small defense supplier choosing a business VPN. It sits under our best VPN for business guide, which explains how a business VPN differs from a personal one. For larger organisations see the enterprise VPN guide. Other regulated fields have different rules; see best VPN for healthcare, best VPN for law firms and best VPN for law enforcement.

We do not run our own security tests. Every vendor-specific line below is what the vendor says on its own pages, with the date we read it. The regulations are linked under Resources. This is general information, not legal advice.

What does a VPN cover under CMMC?

CMMC Level 2 means the 110 requirements of NIST SP 800-171 Rev 2 across every system that handles CUI. A VPN is one technical control. Here is where it fits.

A VPN alone does not make a company compliant. The assessment looks at the whole system security plan.

If the vendor runs the service, the vendor is in scope

A VPN or zero-trust service run by a vendor is a cloud service. DFARS 252.204-7012[1] says an external cloud provider that stores, processes or transmits covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline, and 32 CFR 170.16[2] sets the same test for CMMC Level 2. Whether a service that only passes encrypted traffic counts as handling CUI is a scoping question for your assessor. Ask before you buy, not after.

What about a three-person shop?

A fair question: a company of three, five or ten may wonder whether a multi-device consumer plan is enough. CMMC sets no seat floor. A five-person shop answers the same list of requirements; size changes the cost and the paperwork, not the list. A multi-device plan can meet the transmission requirement only if its module is validated, which consumer plans rarely document. It also gives you no admin console to remove a leaver. If you have no CUI, only federal contract information, you are in Level 1, which is a short list and has no encryption-module rule.

What to ask a VPN company before CUI goes through it

1. What is the CMVP certificate number of the module that encrypts our traffic, and is it Active? Check it on the NIST list yourself.
2. Is the service itself FedRAMP authorized, and which services does that cover? Cloudflare lists “Cloudflare for Government” at High on the FedRAMP Marketplace but does not say on that listing which services are covered.
3. Where do our connections terminate, and who can see the traffic? This matters for ITAR’s end-to-end test.
4. Which controls come with my plan? Dedicated IP, SSO and MFA enforcement are gated by plan.

Controls you can buy, and which plan has them

The controls a team can switch on are dedicated IP or allow-listing (so a system accepts connections only from the team’s fixed address), single sign-on (SSO, so access follows your staff accounts) and multi-factor sign-in (MFA, a second proof beyond a password). Each vendor below says what its plans include, read on 8 October 2026.

NordLayer has no review page on VPN.com, so NordLayer links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say.

Final Verdict

The VPN is one control. Your system security plan, devices, training and assessor decide the rest.

Bottom Line: NERC CIP-005 does not ask a regulated entity to buy a VPN. It asks that remote sessions go through an Intermediate System, that encryption ends there, and that multi-factor authentication is required. A VPN alone does not make an entity compliant. This is an enterprise matter: the small-team shortcut that works for a law office does not apply to a registered entity.

What this page is for

This page is for the IT or security lead at an energy company who needs to understand where a business VPN fits next to the NERC CIP remote-access rules. It sits under our best VPN for business guide, which explains how a business VPN differs from a personal one. For larger organisations see the enterprise VPN guide. Other regulated fields have different rules; see best VPN for healthcare and best VPN for law firms.

We do not run our own security tests, and we did not check any vendor against CIP-005. Every vendor-specific line below is what the vendor says on its own pages, with the date we read it. The standard and the commentary we used are linked under Resources. This is general information, not compliance advice.

Does NERC CIP require a VPN?

The standard names no VPN and no product. CIP-005-7 asks for an Intermediate System, encryption that terminates at it, and MFA for Interactive Remote Access. A VPN can be one piece of that path, but the standard is about the design: where the session ends, what it can reach, and how you show an auditor that nothing bypasses it. A VPN alone does not make an entity compliant.

Can a small team use a consumer VPN instead?

For a registered entity, no, and we would not suggest it. Part 2.1 is about an Intermediate System that sits in front of the protected systems, which is a network design, not something a consumer VPN app sets up for you. ReliabilityFirst, one of NERC’s regional entities, also recommends that a device remotely accessing the system over a VPN should not split-tunnel, meaning it should not send other traffic outside the VPN at the same time. That is a view, not a rule.

If you are a contractor or vendor who connects into a registered entity, ask the entity what its remote-access design requires before you buy anything.

Which business plans include the controls

The controls an entity can switch on are multi-factor sign-in (MFA, a second proof beyond a password), single sign-on (SSO, so access follows your staff accounts) and dedicated IP or allow-listing (so a system accepts connections only from a fixed address). Each vendor below says what its plans include, read on 8 October 2026.

Cloudflare and Tailscale have no review page on VPN.com, so they are not linked internally. NordLayer has no review page either, so NordLayer links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say. None of these rows says the product acts as an Intermediate System.

What to ask a vendor before it sits in a remote-access path

1. Where does the session end, and can it be the Intermediate System or sit in front of it? This is an architecture question for your compliance team and auditor.
2. Which security reports or certifications do you hold, and can I see them? Ask for the report, not just the badge, and check its date.
3. Which controls come with my plan? Dedicated IP, SSO and MFA enforcement are gated by plan at the vendors above.
4. What does the vendor log, and where is it stored? Your own duty to show evidence does not end with the vendor’s promise.

Final Verdict

The VPN is one control. Your architecture, your impact ratings and your auditor decide the rest.

Bottom Line: The FTC Safeguards Rule does not require a financial firm to buy a VPN. It requires encryption of customer information in transit over external networks and multi-factor sign-in for anyone using an information system, and a VPN can support both. A VPN alone does not make a firm compliant. The plans below differ on dedicated IP, single sign-on and multi-factor controls.

What this page is for

This page is for an owner or compliance lead at a small financial firm choosing a business VPN. It sits under our best VPN for business guide, which explains how a business VPN differs from a personal one. For larger organisations see the enterprise VPN guide. Other regulated fields have different rules; see best VPN for law firms, best VPN for healthcare and best VPN for MSPs.

We do not run our own security tests. Every vendor-specific line below is what the vendor says on its own pages, with the date we read it. The rules are linked under Resources. This is general information, not legal advice.

Does the Safeguards Rule require a VPN?

No. Section 314.4(c)(3) asks for encryption of customer information in transit over external networks, and a VPN is one way to do that for staff on home or public networks. Section 314.4(c)(5) asks for multi-factor authentication for any individual accessing any information system. Neither names a product. A VPN alone does not make a firm compliant, because the Rule is a written programme with a designated Qualified Individual, a risk assessment, vendor oversight and more.

What a VPN covers and what it does not

Is a consumer VPN enough for a small firm?

A fair question: a firm of three to ten people may wonder whether a consumer plan covering that many devices would be enough. It can cover encryption in transit, which is the part a VPN does. The Rule sets no seat floor, and a firm under 5,000 consumers is exempt from four parts of 314.4. It is not exempt from multi-factor sign-in, access control or vendor oversight, and that is where a per-person consumer plan is thin: it has no admin console to remove a leaver’s access, and its terms are not written for a firm’s vendor contract. If you hold customer information, a business plan gives you more to show a regulator.

Controls you can buy, and which plan has them

The controls a firm can switch on are dedicated IP or allow-listing (so a system accepts connections only from the firm’s fixed address), single sign-on (SSO, so access follows your staff accounts) and multi-factor sign-in (MFA, a second proof beyond a password). Each vendor below says what its plans include, read on 8 October 2026.

GoodAccess and Twingate have no review page on VPN.com, so they are not linked internally. NordLayer has no review page either, so NordLayer links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say.

What to ask a VPN company before customer information goes through it

Section 314.4(f) means treating the VPN company as a service provider. In practice, ask:

1. Which security reports or certifications do you hold, and can I see them? Ask for the report, not just the badge, and check its date.
2. Is there a written agreement that requires you to keep customer information safe, and who signs it? The Rule asks for safeguards by contract.
3. Which controls come with my plan? Dedicated IP, SSO and MFA enforcement are gated by plan at the vendors above.
4. What does the vendor log, and for how long? Your own duty to monitor and log does not end with the vendor’s promise.

Final Verdict

The VPN is one control. Your written programme, devices, training and vendor contracts decide the rest.

Bottom Line: No VPN makes a law enforcement agency CJIS compliant. The FBI’s CJIS Security Policy asks for validated encryption in transit, multi-factor sign-in, event logs kept for at least a year, and a signed Security Addendum from private vendors. A VPN alone does not make an agency compliant. Of the vendors we checked, none says on its own pages that it signs the addendum.

What this page is for

This page is for an IT lead or chief at a small police department or sheriff’s office choosing a business VPN. It sits under our best VPN for business guide, which explains how a business VPN differs from a personal one. For larger organisations see the enterprise VPN guide. Other regulated fields have different rules; see best VPN for defense contractors, best VPN for law firms and best VPN for healthcare.

We do not run our own security tests. Every vendor-specific line below is what the vendor says on its own pages, with the date we read it. The FBI policy is linked under Resources. This is general information, not legal advice.

What does the CJIS Security Policy ask of a VPN?

Why is “proof of no logging” the wrong request?

Municipal RFPs sometimes ask a VPN company to prove it keeps no logs. The CJIS policy points the other way: it requires event logging and one-year retention of audit records for the systems that handle CJI. A service that cannot give your agency its connection records leaves a gap in your audit. What to ask is which events are logged, who holds them and whether you can get them. That is our reading of the policy; confirm with your state CJIS Systems Officer.

What about a three-person department?

A fair question: a small department may wonder whether a multi-device consumer plan would do. The policy sets no seat floor and has no small-agency exemption. If a vendor handles CJI for you it works under an agreement that incorporates the policy and signs the Security Addendum, and a consumer subscription that cannot do that does not become acceptable by being small. Of the vendors we checked, none says on its pages that it signs the addendum. Ask your CJIS Systems Officer before you buy.

What to ask a VPN company before CJI goes through it

1. Will you sign the CJIS Security Addendum, and has a state accepted you? Ask for it in writing.
2. What is the CMVP certificate number of the module that encrypts our traffic, and is it a FIPS 140-3 certificate? Check the NIST list yourself.
3. Which events do you log, who holds the logs and can we get them? The policy requires logging and retention.
4. Which controls come with my plan? Dedicated IP, SSO and MFA enforcement are gated by plan.

Controls you can buy, and which plan has them

The controls a team can switch on are dedicated IP or allow-listing (so a system accepts connections only from the team’s fixed address), single sign-on (SSO, so access follows your staff accounts) and multi-factor sign-in (MFA, a second proof beyond a password). Each vendor below says what its plans include, read on 8 October 2026.

NordLayer has no review page on VPN.com, so NordLayer links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say.

Final Verdict

The VPN is one control. Your state’s audit, your staff’s clearances and your own policies decide the rest.

Bottom Line: An MSP does not need one VPN. It needs a way to keep many clients apart and to show each client how it connects. Government cyber agencies tell MSPs to use multi-factor sign-in on every account that reaches customers and not to reuse admin credentials across customers. A VPN alone does not give an MSP a SOC 2 report or ISO 27001 certificate. Of the tools we read, NordLayer and Twingate say they have a partner console for many clients.

What this page is for

This page is for the owner or lead technician at a small managed service provider choosing remote-access tools. It sits under our best VPN for business guide, which explains how a business VPN differs from a personal one. For larger organisations see the enterprise VPN guide. Your clients may face their own rules; see best VPN for financial services and best VPN for law firms.

We do not run our own security tests. Every vendor-specific line below is what the vendor says on its own pages, with the date we read it. The advisory and standards are linked under Resources. This is general information, not legal advice.

What do government agencies tell MSPs about remote access?

Advisory AA22-131A, issued jointly by US and allied cyber agencies in May 2022, gives MSPs and their customers a short list. A VPN touches some of it.

A VPN alone does not make an MSP secure or compliant.

One shared plan or one tenant per client?

A fair question for a small MSP of three to ten people: would a multi-device consumer plan do? For your own office access, perhaps. For client work it points the wrong way. The advisory says not to reuse admin credentials across customers and to keep customer data apart, and one shared plan across clients does the opposite. That is our reading of the advisory, not a rule. A tool with a tenant or network per client is the better fit.

Which tools say they run many clients?

Each vendor below says what it offers, read on 2 November 2026.

Twingate and Tailscale have no review page on VPN.com, so they are not linked internally. NordLayer has no review page either, so NordLayer links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say. Partner pricing is set by each vendor’s partner team, and we did not read any.

What do SOC 2 and ISO 27001 mean for an MSP?

We found no regulation that requires an MSP to hold either. A client or insurer may ask. A SOC 2 report is written by a CPA firm about a service organisation’s controls; ask which type and which period it covers. An ISO 27001 certificate comes from a certification body, not from ISO; check the issuer, scope and edition. Both describe the MSP as a whole. Using a tool whose vendor holds a report does not make the MSP’s own work covered by it.

What to ask a VPN company before client access goes through it

1. Can I give each client its own network or tenant, and who can see across them? Ask how admins are assigned per client.
2. Which controls come with my plan? MFA enforcement, SSO and dedicated IP are gated by plan at the vendors above.
3. Which security reports do you hold, and can I see them? Ask for the report, not the badge, and read its scope.
4. What does the vendor log, and who can see it? Your clients may ask you the same question.

Final Verdict

The VPN is one control. Your credential hygiene, contracts and monitoring decide the rest.

Bottom Line: 21 CFR Part 11 does not mention a VPN. It puts validation, access limits and audit trails on the system that holds the electronic records, and the EU’s Annex 11 asks for controls that restrict access to authorised persons. A VPN alone does not make a pharmaceutical company compliant. A business plan can add MFA, single sign-on and a fixed IP in front of those systems.

What this page is for

This page is for the IT, quality or security lead at a pharmaceutical, biotech or contract research company choosing a VPN for staff and partners who reach lab, quality or document systems from outside. It sits under our best VPN for business guide, which explains how a business VPN differs from a personal one. For larger organisations see the enterprise VPN guide. Other regulated fields have different rules; see best VPN for healthcare and best VPN for law firms.

We do not run our own security tests. Every vendor-specific line below is what the vendor says on its own pages, with the date we read it. The regulations are linked under Resources. This is general information, not regulatory advice.

Does FDA Part 11 require a VPN?

No. Part 11 sets controls for electronic records and signatures, and the text of 11.10 does not mention a VPN or a network. The controls it lists, such as validation, access limits and audit trails, apply to the record system. A VPN can support the access side by controlling who reaches the system from outside, but a VPN alone does not make a company Part 11 compliant, and Part 11 does not certify products.

Do I need a business plan or will a small plan do?

It depends less on headcount than on what the VPN sits in front of. A start-up of 3 to 10 people whose regulated records live in a validated system with its own logins and audit trail may need only a small-team plan, because the Part 11 controls are in that system. A multi-device consumer plan has no admin console to add or remove a person and no way to enforce MFA on the VPN sign-in.

Which business plans include the controls

The controls a company can switch on are multi-factor sign-in (MFA, a second proof beyond a password), single sign-on (SSO, so access follows your staff accounts) and dedicated IP or allow-listing (so a system accepts connections only from a fixed address). Each vendor below says what its plans include, read on 8 October 2026.

Cloudflare and GoodAccess have no review page on VPN.com, so they are not linked internally. NordLayer has no review page either, so NordLayer links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say. We did not find, and do not claim, any provider document that says its VPN is Part 11 compliant or validated.

What to ask a VPN company before regulated work goes through it

1. Which security reports or certifications do you hold, and can I see them? Ask for the report, not just the badge, and check its date.
2. Do you claim anything about Part 11, GxP or validation? If a vendor says yes, ask for the document. Validation of your own system is still yours.
3. Is there a written agreement, and who signs it? Annex 11 expects written agreements with third parties that maintain systems.
4. What does the vendor log, and for how long? Connection logs may matter for your own access records; the audit trail of the regulated record stays in the record system.

Final Verdict

The VPN is one control. Your validated systems, procedures and quality team decide the rest.

Bottom Line: PCI DSS does not name a VPN. It requires multi-factor authentication for all access into the systems that hold card data, remote access included, and the PCI Council tells small merchants to keep card data out of their own systems where they can. A VPN alone does not make a business compliant. A business plan helps by adding MFA, single sign-on and a fixed IP in front of back-office tools.

What this page is for

This page is for the owner or IT lead of a shop, a chain or an online store choosing a VPN for staff who work on back-office, admin or payment-related systems from outside the store. It sits under our best VPN for business guide, which explains how a business VPN differs from a personal one. For larger organisations see the enterprise VPN guide. Other regulated fields have different rules; see best VPN for healthcare and best VPN for law firms.

We do not run our own security tests. Every vendor-specific line below is what the vendor says on its own pages, with the date we read it. The PCI Council documents are linked under Resources. This is general information, not legal or audit advice.

Does PCI DSS require a VPN?

No PCI document we read says so. The standard asks for MFA on all access into the card-data environment (Requirement 8.4.2) and on remote access that starts outside your network (8.4.3). A VPN can carry that MFA, but the standard asks for the control, not the product. A VPN alone does not make a business compliant, and your payment processor or acquiring bank may set its own validation steps.

Do I need a business plan or will a consumer plan do?

It depends on how many people connect and what they reach. A shop with 3 to 10 people whose card payments run entirely on a hosted checkout or a payment terminal from a validated provider may use a VPN only to protect staff on public Wi-Fi, and a multi-device consumer plan can do that. The Council guide’s advice to avoid holding card data is what keeps that setup simple.

NordVPN is reviewed on our NordVPN page. If staff can reach systems that hold card data, MFA on that access is a PCI DSS requirement whichever VPN you pick, so enforce it on the systems themselves.

Which business plans include the controls

The controls a retailer can switch on are dedicated IP or allow-listing (so a system accepts connections only from a fixed address), single sign-on (SSO, so access follows staff accounts) and multi-factor sign-in (MFA, a second proof beyond a password). Each vendor below says what its plans include, read on 8 October 2026.

GoodAccess has no review page on VPN.com, so it is not linked internally. NordLayer has no review page either, so NordLayer links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say.

What about a vendor that says it supports PCI DSS?

NordLayer says on its compliance page that its platform “encrypts cardholder data in transit” and that it “provides security tools that can support compliance efforts”. Its pages show a PCI-DSS badge, and we found no attestation document linked from them. That is marketing wording, not proof that the service has been assessed. Ask any vendor you shortlist:

1. Do you hold an Attestation of Compliance (AOC) for PCI DSS, and what does it cover? Ask for the document and its date, not the badge.
2. Which PCI controls do you take on, and which stay with us? A responsibility matrix answers that.
3. Which controls come with my plan? Dedicated IP, SSO and MFA enforcement are gated by plan at the vendors above.
4. What do you log, and for how long? Your own duty to protect card data does not end with the vendor’s promise.

Final Verdict

The VPN is one control. Your payment setup, staff, devices and service providers decide the rest.

Bottom Line: 404 Media reported on 29 October 2026 that Proton’s CEO pushed staff to adopt AI and called a request for security testing “loser thinking”, and Proton did not dispute the reporting, according to 404 Media. We found nothing in the parts we could read that changes how Proton VPN handles user data. The claims about Proton’s internal conduct come from one outlet’s anonymous sources, not from our own confirmation.

Disclosure. vpn.com earns a commission when readers buy Proton VPN through our links, and from other VPN providers that compete with it. Proton VPN is ranked #3 of 22 on our Trust Score, at 85/100. This story does not change that score, and it contains no purchase links.

Status. Facts checked against our research record on 2 November 2026. We have not asked Proton for comment; its public statements are quoted as relayed by other outlets.

What happened

Reports ran over five days, from 404 Media’s story on planned staff interviews to the cancellation of those interviews.

The graphic shows four steps. Two details sit outside it. The interviews were due 4 to 11 November, per 404 Media’s 26 October report[1] and Proton’s staff email as quoted by Tom’s Guide. And on 27 October Tom’s Guide published Proton’s public comment on the plan, relayed from a Proton comment on Reddit.

What 404 Media reported

On 29 October, 404 Media[2] published an investigation by Joseph Cox, based on eight current and one former Proton employee, Slack chats, meeting recordings and an AI manifesto written by the company’s chief technology officer. It reports that CEO Andy Yen is pushing Proton to build with AI despite employees’ security concerns.

According to the report, management set up an email address for staff to flag anything blocking AI adoption, and software tracks the share of AI-written code. It also quotes a Slack message from Yen saying 2026 will be the last year Proton hires engineers.

The sharpest exchange came in the security channel at the end of August. 404 Media says an employee asked for a few days to pentest new code before release, and that Yen answered with “loser thinking” and said it is “possible to be fast and secure”. He later told the team to “stop lovingly handcrafting all our code and use AI more.”

Employees told 404 Media they have security concerns about building security products with AI but feel unable to voice them, for fear that Yen will berate them in front of colleagues or threaten their jobs. The accounts are anonymous.

What Proton said and did

According to 404 Media, a Proton spokesperson did not dispute any of its reporting or its characterization of what is happening inside the company. The spokesperson said some people at Proton are unhappy with the company’s direction or misunderstand it, and that many are anxious.

Proton’s public line, as relayed by Tom’s Guide[3], is that AI is changing the industry and the company must evolve how it works. Proton also says it is not doing layoffs and using AI as an excuse, that it has a talent shortage and that it is hiring. That sits against the Slack message attributed to Yen about engineer hiring, and we could not resolve the difference.

On 30 October, after the all-hands meeting, Yen cancelled the staff re-interviews, according to 404 Media’s follow-up[4], which cites audio of the meeting. Goosed[5] reports, from employees it quotes, that the AI-usage criteria will instead be folded into regular performance reviews. One employee told 404 Media, “I don’t think he will change anything.” Goosed says staff reaction was split.

Some Proton users say publicly that they have cancelled or will not renew, and 404 Media reports social-media calls for Yen to resign. We have not read the original posts and found no published count of cancellations or revenue impact.

Reported versus confirmed

Almost everything in this story traces to one reporter’s investigation. The graphic below separates what was reported from what Proton has acknowledged.

Where each item stands: Proton’s own staff email, as Tom’s Guide quotes it, confirms that the re-interviews were planned. That they were cancelled is reported by 404 Media and Goosed, and the meeting audio is unpublished. That AI use will be folded into performance reviews comes from Goosed alone, citing employees, and Proton has made no statement we found. Proton’s “no layoffs” line and the Slack message about engineer hiring are both Proton-side statements, and we could not resolve the difference. For user cancellations there is no count and no Proton statement, so we treat them as unverified. The pentest remark and the staff fear of raising concerns remain single-source: the Slack messages are unpublished, the employees anonymous, and Proton acknowledged unhappiness but not the conduct alleged.

What it means for Proton users

The governance claims rest on a single investigation built largely on anonymous sources, so treat them as reported, not established. The practical question for a Proton customer is which products use AI and what Proton promises about them.

Read plainly, Proton’s description of Lumo means its servers can read a prompt while answering it, so Lumo is not end-to-end encrypted the way Proton Mail is. The one independent source calls that fair but true of any hosted AI assistant, not only Proton’s.

If you use Lumo or Scribe, treat those privacy terms as Proton’s promises, not verified guarantees. If you use only the VPN, the reporting we read does not describe any change to how it handles user data. For the product itself, see our Proton VPN review and the VPN research index.

What this does not change

The Trust Score rates eleven product and service criteria, and company governance is not one of them, so this report does not change Proton VPN’s score. Under our methodology a breach, a privacy incident or a new audit would trigger a review.

What we could not confirm

• Most of the investigation. 404 Media’s main article is partly paywalled. We read the free portion, roughly the first third.
• The underlying evidence. The Slack messages and the meeting audio have not been published, so we could not inspect them.
• Proton’s side. We read Proton’s public comment only as relayed by Tom’s Guide, which carries Proton VPN affiliate deals on the same page, not the original post.
• User numbers. We found no count of cancelled subscriptions.

Bottom Line: Ask any VPN company for a signed business associate agreement (BAA) before patient data crosses it, and expect the answer to depend on your plan: NordLayer says it signs one only on annual or longer billing, and Cloudflare says only with enterprise customers. A VPN alone does not make a practice HIPAA compliant.

What this page is for

This page is for a practice manager or owner choosing a business VPN. It sits under our best VPN for business guide, which covers what a business VPN is and how it differs from a personal one. For larger organisations see the enterprise VPN guide, and for the general privacy picture the data protection guide. Law firms face a different rule; see best VPN for law firms.

We do not run our own security tests. Everything vendor-specific below is what the vendor says on its own pages, with the date we read it, and HHS and federal regulation text are linked under Resources. This is general information, not legal advice.

Is there a HIPAA compliant VPN?

No. HHS says the Office for Civil Rights does not endorse, certify or recommend specific technology or products, so no VPN carries a government HIPAA certification. Cloudflare’s own page makes the same point: HHS does not recognize a certification for HIPAA compliance. A vendor can sign a BAA and offer controls that support your programme. A VPN alone does not make you compliant.

What to ask a VPN company before patient data crosses it

1. Will you sign a BAA, and on which plan and billing term? Get the answer in writing. NordLayer says it will not sign on monthly billing.
2. Is the VPN product itself covered by the BAA? A company can sign a BAA for one product and not another. Proton, for example, says it offers BAAs to all users, but we could not confirm from public pages that the VPN is covered.
3. Which controls come with my plan? Dedicated IP, single sign-on (SSO) and multi-factor sign-in (MFA) are gated by plan at the vendors below.
4. What happens before the BAA is signed? NordLayer says patient data may not go through it until the BAA is executed, so a monthly trial is for testing without patient data.

Which plans say they sign a BAA

Every row is what the vendor says on its own pages, read on 8 October 2026, with NordLayer, Cloudflare and Proton read again on 29 October 2026. A vendor page is evidence of what the vendor says, not of what it will sign.

Cloudflare has no review page on VPN.com, so it is not linked internally. NordLayer has no review page either, so NordLayer links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say.

Final Verdict

Whatever you pick, the VPN is one safeguard. Your risk analysis, staff training and vendor contracts are what a regulator asks about.

Bottom Line: The ABA texts we read do not require a law firm to buy a VPN. Model Rule 1.6(c) asks for reasonable efforts to protect client information, and Opinion 498 says lawyers should consider a VPN when connecting over Wi-Fi. A VPN alone does not make a firm compliant. The plans below differ on dedicated IP, single sign-on and multi-factor sign-in.

What this page is for

This page is for a partner or office manager at a small firm choosing a business VPN. It sits under our best VPN for business guide, which explains how a business VPN differs from a personal one. For larger organisations see the enterprise VPN guide. A medical practice faces a different rule; see best VPN for healthcare.

We do not run our own security tests. Every vendor-specific line below is what the vendor says on its own pages, with the date we read it. The ABA texts are linked under Resources. This is general information, not legal advice.

Does the ABA require lawyers to use a VPN?

No ABA text we read says so. Rule 1.6(c) sets a standard of reasonable efforts, and Opinion 477R says that standard is not a hard and fast rule. Opinion 498 says lawyers should consider using a VPN when connecting over Wi-Fi. A VPN alone does not make a firm compliant, and your state bar may add its own tests.

Controls you can buy, and which plan has them

The controls a firm can switch on are dedicated IP or allow-listing (so a system accepts connections only from the firm’s fixed address), single sign-on (SSO, so access follows your staff accounts) and multi-factor sign-in (MFA, a second proof beyond a password). Opinion 477R lists multi-factor authentication to access firm systems among available tools. Each vendor below says what its plans include, read on 8 October 2026.

GoodAccess has no review page on VPN.com, so it is not linked internally. NordLayer has no review page either, so NordLayer links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say.

What to ask a VPN company before client files go through it

Opinion 477R says a lawyer should do due diligence on vendors providing communication technology, including checking references and credentials. In practice, ask:

1. Which security reports or certifications do you hold, and can I see them? Ask for the report, not just the badge, and check its date.
2. Is there a written data-processing or confidentiality agreement, and who signs it? Get it before client files cross the service.
3. Which controls come with my plan? Dedicated IP, SSO and MFA enforcement are gated by plan at the vendors above.
4. What does the vendor log, and for how long? Your own duty to protect client information does not end with the vendor’s promise.

Final Verdict

The VPN is one control. Your passwords, devices, supervision of staff and state bar rules decide the rest.

This page covers laptops and desktops only. For the full list across every device, read our best free VPN guide. For a phone, see best free VPN for phone. If you would rather pay, the paid-plan guides cover Windows, Mac and Linux.

App or Browser Extension on a Laptop

An app routes the whole laptop’s traffic through the VPN: your browser, your email program, your chat apps and your updates. A browser extension routes only that browser. Both have a place, and the right one depends on what you are trying to protect.

If you want protection on cafe or hotel Wi-Fi, install the app. If you only want to try a provider for ten minutes, the extension is lighter.

The Free Plans Compared

Each row comes from the provider’s own plan data on our site, checked on 2026-10-12. A cap or limit can change, so check the plan page before you install.

Kill switch and split tunneling by system

This is the part of a free plan that most affects a laptop on public Wi-Fi. The table shows only what each provider says on its own website. “Not stated” does not mean the feature is missing: it means the provider does not say, so we do not claim it either way.

A kill switch blocks your traffic if the VPN drops, so your real connection is not exposed for a moment. Whether a provider gives you that feature on its free plan, rather than only on a paid one, is also worth checking in the app after you install it.

Our Picks

Proton VPN: Best Overall

Proton VPN is the first free plan to try on a laptop. It is the only one here with no data cap, and the free plan has no ads. It states both a kill switch and split tunneling on Windows and Mac, and it also offers a browser extension.

The free plan allows one device and assigns you a server in one of its ten free countries, so you cannot choose where you connect. Proton VPN ranks #3 of 22 on our Trust Score.

• Free data: No cap
• Free devices: 1
• Desktop extras: Kill switch, split tunneling
• Limit to know: No manual server choice

Best for: Anyone who wants one free VPN on a laptop and does not want to watch a data meter.

Windscribe: Best for Control

Windscribe’s free plan covers an unlimited number of devices, so one account can cover a laptop, a phone and a tablet at once. On Windows and Mac it states a Firewall setting that blocks traffic outside the VPN[1], and split tunneling to keep chosen apps outside it. It also includes a built-in ad and tracker blocker.

The cost is the cap: 10 GB a month once you confirm your email. That fits browsing and email and will not last long under video calls or large downloads.

• Free data: 10 GB a month with a confirmed email
• Free devices: Unlimited
• Desktop extras: Firewall setting, split tunneling
• Limit to know: The cap

Best for: Someone who wants desktop controls and several devices on one free account.

Hide.me: Best for Light Use

Hide.me’s free plan gives you 10 GB a month and a choice of five server locations. It supports its full set of protocols on the free plan, WireGuard included. It does not state a kill switch or split tunneling by system, so treat those as unknown until you see them in the app.

• Free data: 10 GB a month
• Free locations: 5
• Limit to know: Free device count and system-level features not stated

Best for: Occasional use where you want to pick a location yourself.

TunnelBear: Best for Beginners

TunnelBear is the easiest of the four to start with, and its Cure53 security audits have been published since 2016. The free plan allows only 2 GB a month[2], with all server locations, which makes it a way to try a VPN app for the first time, not an everyday plan.

• Free data: 2 GB a month
• Free locations: All
• Limit to know: The lowest cap of the four

Best for: A first look at what a VPN app does on a laptop.

How to Set Up a Free VPN on a Laptop Safely

1. Open the provider’s own website, not a search result for “free VPN”, and download the app from there.
2. Install the app and create a free account. A trustworthy free plan should not ask for a card.
3. Turn on the kill switch or Firewall setting if the app has one.
4. Find where the app shows your remaining data, so the cap does not catch you out.
5. Add the browser extension only if you want a separate, lighter option for one browser.

What a Free Plan Will Not Do on a Laptop

A free plan limits data, servers or speed, and a laptop uses more data than a phone in the background: system updates, cloud backups and video calls all count. If the VPN has to stay on all day, a paid plan is the better fit. Our guides for Windows and Mac rank those.

For access to content in other regions, free plans are the weakest choice: the free server pools are small, and the terms of the service you want to reach still apply.

Final Verdict

Start with the Proton VPN app, then move to a paid plan if the free limits get in the way. Whichever you choose, download it from the provider’s own website.

Resources for this page

Charts and reference images from our research, free to view and share.

• Best Free VPN for Laptop: Windows and MacPDF · 0.7 MB

This page covers phones and tablets only. For the full list across every device, read our best free VPN guide. If you would rather pay for a phone app, see the paid-plan guides for Android and iPhone.

What Is Different About a Free VPN on a Phone

A phone changes three things about a free plan. It moves between Wi-Fi and cellular, so a data cap runs down faster than on a laptop. It installs apps from a store, so the risk is a look-alike app rather than a bad download link. And it is one device, so a free plan that allows a single connection fills up quickly.

The Free Plans Compared

Each row below comes from the provider’s own plan data on our site, checked on 2026-10-12. A cap or limit can change, so check the plan page before you install.

Kill switch and split tunneling by platform

This is where a phone differs most from a laptop. The table shows only what each provider says on its own website. “Not stated” does not mean the feature is missing: it means the provider does not say, so we do not claim it either way.

Proton VPN states a kill switch in all its apps and the others do not break it down by platform. If a kill switch matters to you, it is the one provider here that says so for both phones.

iPhone and Android Are Not the Same Risk

On an iPhone, apps come from the App Store only, so the risk is a look-alike listing. Check that the developer name matches the provider’s website before you install.

On Android, the Play Store is the first place to check, but Android also lets you install an app file from outside the store. A 2016 peer-reviewed study of 283 Android apps that use the VPN permission[1] found apps that leak traffic, intercept encrypted connections and inject tracking code, which is the main reason this page recommends installing only from a store listing the provider links to from its own website. Our guide to malware explains what a fake VPN app can do once it is installed.

Our Picks

Proton VPN: Best Overall

Proton VPN is the first free plan to try on a phone. It is the only one here with no data cap, and the free plan has no ads. It runs on both iPhone and Android and states a kill switch in all its apps.

The free plan allows one device and assigns you a server in one of its ten free countries, so you cannot choose where you connect. Proton VPN ranks #3 of 22 on our Trust Score.

• Free data: No cap
• Free devices: 1
• Android extras: Split tunneling
• Limit to know: No manual server choice

Best for: Anyone who wants one free VPN on a phone and does not want to watch a data meter.

Windscribe: Best for Many Devices

Windscribe’s free plan covers an unlimited number of devices[2], which makes it the one to pick if the VPN has to cover a phone, a tablet and a laptop at once. It adds a built-in ad and tracker blocker and supports split tunneling on Android.

The cost is the cap: 10 GB a month once you confirm your email. That is enough for browsing and messaging and will not last long if you stream video on cellular.

• Free data: 10 GB a month with a confirmed email
• Free devices: Unlimited
• Android extras: Split tunneling
• Limit to know: The cap; kill switch on phones not stated

Best for: Households with several devices and light data use.

Hide.me: Best for Light Use

Hide.me’s free plan gives you 10 GB a month and a choice of five server locations. It supports its full set of protocols on the free plan, WireGuard included.

Hide.me does not state a kill switch or split tunneling by platform, so treat those as unknown until you see them in the app.

• Free data: 10 GB a month
• Free locations: 5
• Limit to know: Free device count and platform-level features not stated

Best for: Occasional use where you want to pick a location yourself.

TunnelBear: Best for Beginners

TunnelBear is the easiest of the four to start with, and its Cure53 security audits have been published since 2016. The free plan allows only 2 GB a month[3], with all server locations.

Treat it as a way to try a VPN app for the first time, not as an everyday plan.

• Free data: 2 GB a month
• Free locations: All
• Limit to know: The lowest cap of the four

Best for: A first look at what a VPN app does on your phone.

How to Set Up a Free VPN on Your Phone Safely

1. Open the provider’s own website, not a search result for “free VPN”, and follow its link to the App Store or Google Play.
2. Check that the developer name on the store listing matches the provider.
3. Install the app and create a free account. A trustworthy free plan should not ask for a card.
4. Turn on the kill switch if the app has one, and switch on connecting automatically on untrusted Wi-Fi.
5. Find where the app shows your remaining data, so the cap does not catch you out.

What a Free Plan Will Not Do on a Phone

A free plan is built to give you a taste of the paid service. It limits data, servers or speed, and a phone uses data in the background that you do not see. If you want a VPN that stays on all day, a paid plan on a nearby server is the better fit. Our best VPN for Android and best VPN for iPhone guides rank those.

For access to content in other regions, free plans are the weakest choice: the free server pools are small, and the terms of the service you want to reach still apply.

Final Verdict

Start with Proton VPN, then move to a paid plan if the free limits get in the way. Whichever you choose, install it from a store link on the provider’s own website.

Resources for this page

Charts and reference images from our research, free to view and share.

• Best Free VPN for Phone: iPhone and AndroidPDF · 0.7 MB

What changes on a PC

Split tunneling on Windows

Split tunneling sends some apps through the VPN and the rest outside it. For gaming, the common uses are keeping a large game download off the tunnel, or keeping one game on it. We list only what each provider says on its own site.

Source: each provider’s own pages, checked 2026-10-08 (ExpressVPN[1], NordVPN[2], Surfshark[3]). CyberGhost’s Windows exclusions apply to websites, not apps, so it cannot keep a single game off the tunnel.

Launchers and anti-cheat

Steam, Epic Games and Battle.net sign in over their own servers, and a VPN changes the address they see. If a launcher stalls or asks you to verify your account, connect to a server in your own country first. Do not switch servers mid-download.

Anti-cheat software is the part we cannot promise. Systems differ, and a publisher can restrict VPN traffic in its rules. Read the game’s support page before you rely on a VPN in ranked or tournament play, and test in a casual match first.

Keeping ping low

1. Pick a nearby server. Distance adds more delay than protocol. Choose a server close to the game’s host region, not necessarily close to you.
2. Use a WireGuard-based protocol. NordVPN’s NordLynx, ExpressVPN’s Lightway and Surfshark’s WireGuard are built for low overhead. Compare them in our WireGuard vs OpenVPN guide.
3. Test both ways. Play a match with the VPN off and on, and keep the server that plays best. If your connection was already fine, the VPN may only add delay.

Which to choose

Final Verdict

For one game on the tunnel and the rest outside it, choose a provider with per-app Windows split tunneling: NordVPN, ExpressVPN or Surfshark. Then connect to a nearby server, test your ping both ways, and check the game’s anti-cheat rules before ranked play.

Resources for this page

Charts and reference images from our research, free to view and share.

• Best VPN for PC Gaming: Split Tunneling and PingPDF · 0.7 MB

What a VPN does for region-locked games

Terms come first

Platforms set their own rules. Valve’s Steam subscriber agreement, for example, enforces regional store restrictions, and a VPN does not override an account’s region. Connecting through another country is not illegal, but it can conflict with a platform’s terms, and the publisher can limit your account. We describe access to other regions’ servers and stores, not a way around any rule. Do not use a VPN to buy at a price your account region does not allow.

Country coverage

Coverage decides how many regional servers you can reach. The counts are the providers’ own figures.

How to set it up

1. Check the game’s terms and the region it needs. Note the country, not just the continent.
2. Connect to a server in that country before you open the launcher or store, and keep it connected for the session.
3. Check your account region. If the store still shows your own region, the account decides, not the IP. A VPN cannot change that.
4. Turn on the kill switch so a dropped tunnel does not send your real location to the game mid-session.

Which to choose

Final Verdict

A VPN gives access to other regions’ servers and stores only as far as the platform’s terms and your account region allow. Pick the provider that covers the country you need, connect before you launch, and treat the result as access, not a guarantee.

Resources for this page

Charts and reference images from our research, free to view and share.

• VPN for Region Locked Games: Access and TermsPDF · 0.7 MB

This guide covers the phone side of streaming only. For the general picture, see our best VPN for streaming guide, and for platform basics our best VPN for Android and best VPN for iPhone guides.

What Changes When You Stream on a Phone

A TV or a laptop usually sits on one connection. A phone does not. Five things matter on mobile that barely matter anywhere else.

App Store Region vs VPN Location

These are two separate things, and mixing them up causes most phone streaming problems.

Your app store (Apple App Store or Google Play) follows the country on your account: Apple[1] and Google Play[2] each make you change that setting in the account, with a valid payment method from the new country. A VPN does not change it. If a streaming app is not listed in your store, a VPN alone will not add it.

Your VPN location is what the streaming app itself sees once it is open. Connect to a server in the country whose library you want access to, where the service’s terms allow it, then open the app. If the app already installed on your phone shows the wrong catalog, close it fully, connect the VPN, and open it again so it reads your new location.

Mobile Data Usage

Streaming is the heaviest thing most people do on a phone. As a rough guide, Netflix states[3] that standard definition uses up to 1 GB an hour, HD up to 3 GB and 4K up to 7 GB. The exact amount depends on the service, the quality setting and the device.

A VPN adds a small amount of overhead on top, usually a few percent. The bigger lever is the quality setting inside the streaming app: most services let you cap quality on cellular. If you are on a limited plan, download shows on Wi-Fi to watch later instead.

Switching Between Wi-Fi and Cellular

When your phone changes network, the old connection ends and the VPN tunnel has to be rebuilt on the new one. WireGuard has built-in roaming[4]: when one side’s IP address changes, the other updates automatically. WireGuard-based protocols (NordLynx, standard WireGuard) and Lightway rebuild quickly, so a stream usually recovers after a short pause. OpenVPN takes noticeably longer. Our WireGuard vs OpenVPN comparison covers the difference.

Turn on the kill switch. During the short gap while the tunnel rebuilds, it blocks traffic so the app never sees your real location. The trade-off is that video may pause for a second or two.

Battery

Encrypting every packet costs power. WireGuard-based protocols are leaner than OpenVPN. The simplest saving is to connect when you start watching and disconnect when you finish, rather than leaving the VPN on all day.

Casting From Your Phone to a TV

Casting sends video from your phone to a TV or a stick on the same network. A VPN on the phone changes what happens, and it depends on how you cast.

• Casting the screen. If your phone mirrors its screen to the TV, the phone is doing the work, so the VPN on the phone covers the stream.
• Casting from the app. Many apps hand the video to the TV, which then loads it on its own connection. In that case the phone’s VPN does not cover the TV, and the TV connects from your real location.
• A router or a TV app. To cover the TV itself, use a VPN app on the TV or stick where one exists (see our Fire TV guide), or a VPN-compatible router.

If casting from an app stops working while the VPN is on, it is usually because the phone and the TV are no longer on the same network. Try the cast with the VPN off first, then decide which device needs the VPN.

How to Set Up a VPN for Streaming on Your Phone

1. Pick a VPN with an app for your phone. Both iOS and Android apps are standard among the top providers.
2. Install the app and allow the VPN profile when the phone asks.
3. Turn on the kill switch and, if offered, auto-connect, so the phone reconnects on its own after a network change.
4. Choose a server in the country whose library you pay for. Closer servers usually keep video smoother.
5. Connect first, then open the streaming app. If the catalog looks wrong, close the app fully and reopen it.
6. Test on Wi-Fi and on cellular, because the best server on one is not always the best on the other.
7. Disconnect when you finish to save battery.

Android and iPhone Differences

On Android, the system lets a VPN app route only a chosen list of apps[5], so many VPN apps offer split tunneling, so you can send only the streaming app through the VPN and leave the rest of the phone on your normal connection. iOS cannot route single apps in the same way, so on an iPhone the whole phone uses the VPN while it is connected. Check the provider’s own page for the current feature list before you buy.

Common Phone Streaming VPN Problems

The Streaming App Still Shows the Wrong Library

Close the app fully, connect the VPN, then reopen it. Try another server in the same country. Services update their blocks over time, so access can change.

Video Buffers or Drops to Low Quality

Move to a closer server and test again. If it only happens on cellular, the problem may be the signal rather than the VPN. Try the other network.

The App Says a VPN Was Detected

Some services block known VPN IP ranges. Try a different server. If it keeps failing, the service may not allow VPN use, and you should not work around that.

Casting Stops Working

The phone and the TV must be on the same network. Check the cast with the VPN off, then see which device needs the VPN.

Final Verdict

Streaming on a phone needs a VPN that handles network switches and a simple app, not just fast servers. Choose a WireGuard-based protocol or Lightway, switch on the kill switch and test your own streaming apps on Wi-Fi and cellular.

Watching on a TV instead? Read our Fire TV guide, or see the best VPN for streaming overview.

VPN.com does not encourage or condone using VPN services to violate the terms of service of any platform. Information on this page is provided for educational purposes. Users are responsible for complying with the policies of the services they use.

Resources for this page

Charts and reference images from our research, free to view and share.

• Best VPN for Streaming on Phone: iPhone & Android Apps, Data & CastingPDF · 0.7 MB

Bottom Line: For mobile gaming, choose a VPN that reconnects fast when your phone moves between Wi-Fi and 5G, runs a lightweight protocol (WireGuard, NordLynx or Lightway) and has a kill switch. NordVPN is the best all-rounder, and Surfshark is the best value if you also game on a tablet.

Phones are where a lot of people play. They are also the hardest place to run a VPN well. Your phone hops between Wi-Fi and cellular, goes to sleep, runs on a battery and shares a network with whatever else you have open. A VPN that works fine on a desktop can drop you out of a match on a phone.

This guide covers the gaming side of phone VPNs only. For the general picture, see our best VPN for Android and best VPN for iPhone guides, and for the full list across every platform, see the best VPN for gaming hub.

What Changes When You Game on a Phone

A console or PC sits on one wired or Wi-Fi connection. A phone does not. Five things matter on mobile that barely matter anywhere else.

Network Switching Mid-Match

This is the biggest mobile-only problem. When your phone changes network, the old connection dies and a new one starts. A VPN tunnel has to be rebuilt on the new network. If that takes too long, the game sees a dropped connection and puts you back at the menu.

WireGuard has built-in roaming[1]: when one side’s IP address changes, the other updates automatically. WireGuard-based protocols (NordLynx, standard WireGuard) and Lightway rebuild the tunnel quickly. OpenVPN takes noticeably longer, so avoid it as your default on a phone. Our WireGuard vs OpenVPN comparison covers the difference.

Turn on the kill switch. During the short gap while the tunnel rebuilds, a kill switch blocks traffic so your real IP is never exposed to the lobby. The trade-off is that the game may pause for a second or two rather than leak. For a casual game, that is fine. For ranked play, test it before you rely on it: walk from Wi-Fi to cellular in a private match and see whether the session survives.

Ping: Wi-Fi vs Cellular

A VPN adds a small delay because your traffic takes an extra hop. On a nearby server, that delay is usually small. On a far server, it is not. Pick the server closest to the game’s host region, not the one closest to you if the two differ, and test on both Wi-Fi and cellular, because the best server on one is not always the best on the other.

A VPN can also help in one specific case. If your carrier or home ISP routes game traffic over a congested path or throttles it at peak hours, a VPN can sidestep that route. If your ping is already good, a VPN will not make it better.

Battery

Encrypting every packet costs power. WireGuard-based protocols are leaner than OpenVPN, so they are easier on the battery. The simplest saving is to connect only for play sessions and plug in for long ones. Leaving the VPN on all day to game for an hour is the most common cause of a drained phone.

Lobby IP Exposure and DDoS

How exposed you are depends on how the game connects. Games that route everything through the publisher’s dedicated servers show other players much less. Games with peer-to-peer connections can expose your IP address to the people you play against. If someone gets that IP and floods it with junk traffic, your connection can drop. CISA describes volumetric attacks as aiming to consume available bandwidth[2].

A VPN replaces your IP with the VPN server’s IP, so an attack lands on the server, not your phone. This protects against direct IP attacks. It does not stop in-game cheating, account bans or a bad match. We cannot tell you which specific titles use peer-to-peer, since that varies by game and changes with updates, so check a game’s own documentation if exposure is your main concern.

Split Tunneling: Android Only

Split tunneling lets you send only some apps through the VPN. On a phone this is handy: the game goes through the VPN, while your banking or navigation app uses your normal connection and does not trip fraud checks.

It depends on the operating system:

• Android: Supported by NordVPN[3], Surfshark[4] (called Bypasser) and ExpressVPN[5]. CyberGhost does not offer split tunneling on Android.
• iPhone and iPad: Apple blocks the network access that true per-app split tunneling needs, so no provider delivers it. Surfshark offers a website-level workaround[4], which does not help for a game app.

So on an iPhone, the VPN covers the whole device while it is on. Turn it off when you finish playing.

Best VPNs for Mobile Gaming

All four providers below have iOS and Android apps and list a kill switch. The differences are in how they handle the phone-specific points above.

Note: Apple blocks the network access that per-app split tunneling needs, so no provider routes individual apps on iPhone. See our best VPN for iPhone guide.

NordVPN: Best Overall for Mobile Gaming

NordVPN runs NordLynx, its WireGuard-based protocol, which is built for fast reconnects and low overhead. Its Android app supports split tunneling, so you can keep a game on the VPN and a banking app off it. It covers up to 10 devices, enough for a phone, a tablet and a laptop.

Best for: Phone gamers who want the safest all-round pick, particularly on Android.

Surfshark: Best Value for Phone and Tablet Gamers

Surfshark has no device limit, so a phone, a tablet and a handheld all connect at once on one subscription. It uses WireGuard and includes Bypasser split tunneling on Android. Lowest entry price of the four.

Best for: Households where several people game on different devices.

ExpressVPN: Best for Staying Connected

ExpressVPN runs Lightway, its own protocol, which ExpressVPN says it built to reconnect quickly when your network changes. The app is simple: open it and tap one button. Split tunneling is available, and it carries a 30-day money-back guarantee so you can test it on your own network.

Best for: Players who want an app that reconnects reliably and stays out of the way.

CyberGhost: Best for Beginners

CyberGhost uses WireGuard by default on Android and offers the longest money-back window of the four at 45 days, which gives you time to test ping on your own Wi-Fi and cellular network. The drawback for gamers is that there is no split tunneling on Android, so the whole phone goes through the VPN.

Best for: First-time VPN users who want a long refund window to test with.

Region-Locked Mobile Games and App Stores

Some mobile games launch in one country first. A VPN changes the IP your phone appears to have, but app stores mostly look at the country on your account, not your connection.

• Apple App Store: Your store region is tied to your Apple Account and payment method[6]. A VPN alone does not change which store you see.
• Google Play: The store follows the country on your Google account. A VPN alone usually does not change it, and Google requires a wait of at least 90 days between country changes[7].

What a VPN can do is let the game itself connect from a region where it is live, once you have the app. Games and stores both set their own rules, and using a VPN to get around a regional release may break their terms. Check before you try it, because the risk is an account ban, and a ban is worse than waiting for the launch.

How to Set Up a VPN for Mobile Gaming

1. Install the app and sign in. Allow the VPN configuration when your phone asks.
2. Choose the protocol. Set it to WireGuard, NordLynx or Lightway. Avoid OpenVPN unless a network blocks the others.
3. Turn on the kill switch. On Android, also enable Always-on VPN[8] under Settings > Network > VPN so a restart does not leave you exposed.
4. Pick a server near the game’s host region. Test ping on Wi-Fi, then on cellular.
5. On Android, add the game to split tunneling if you want only the game on the VPN.
6. Test the switch. In a private match, walk from Wi-Fi to cellular and check the session holds.
7. Disconnect when you finish to save battery.

Common Mobile Gaming VPN Problems

The Game Drops When I Leave Wi-Fi

The tunnel is rebuilding on the new network. Switch to WireGuard, NordLynx or Lightway, which reconnect faster than OpenVPN, and make sure the kill switch and Always-on VPN are enabled.

High Ping After Connecting

Move to a closer server and test again. If it is still high, try the other network, since cellular and Wi-Fi often favor different servers.

Battery Drains Fast

Connect only while you play. Leave the protocol on WireGuard, NordLynx or Lightway, and close the app after you disconnect.

The Game Says VPN Detected or Will Not Connect

Some games block known VPN IP ranges. Try a different server. If it still fails, the game may not allow VPN use, and you should not work around that.

Final Verdict

Mobile gaming needs a VPN that handles network switches, not just one with a fast desktop speed. Choose a WireGuard-based protocol or Lightway, switch on the kill switch and test the Wi-Fi to cellular handoff yourself.

Not sure about platform support? Read our best VPN for Android and best VPN for iPhone guides, or see how console players set up in our Xbox and PlayStation guides.

VPN.com does not encourage or condone using VPN services to violate the terms of service of any platform. Information on this page is provided for educational purposes. Users are responsible for complying with the policies of the services they use.

Resources for this page

Charts and reference images from our research, free to view and share.

• Best VPN for Mobile Gaming: Ping, Network Switching & BatteryPDF · 0.7 MB

VPNs with Free TrialsTrust Score

#1CyberGhost9,600+ servers

CyberGhost's privacy record rests on one kind of evidence done well and several kinds absent

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.234.23

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 23 · Independent sources: 6 · Scores updated Nov 2, 2026

Read review

#2NordVPN7,213 servers

NordVPN's privacy and security record is strong on process and mixed on proof

93 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score66/70

App store ratings, part of the score

4.664.59

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 31 · Independent sources: 11 · Scores updated Nov 2, 2026

Read review

#3Surfshark4,500+ servers

Surfshark's evidence mixes real, readable third-party documents with provider assertions

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.714.64

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 32 · Independent sources: 5 · Scores updated Nov 2, 2026

Read review

Can You Get a CyberGhost Free Trial?

CyberGhost

Free trial & guarantee

CyberGhost's privacy record rests on one kind of evidence done well and several kinds absent

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.234.23

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 23 · Independent sources: 6 · Scores updated Nov 2, 2026

Trust Score rank #3 / 22 9,600+ servers 100 countries 45-day money-back guarantee

Visit CyberGhost Read our review

CyberGhost offers no traditional free trial on desktop. Mobile users on Android and iOS get a limited 7-day free trial. The real risk-free option is CyberGhost’s 45-day money-back guarantee on plans of 6 months or longer. You pay upfront, test every feature, then request a full refund before day 45.

CyberGhost Free Trial Availability

CyberGhost’s free trial exists only on mobile platforms. Android users can access it through the Google Play Store. iOS users get the same 7-day window through the App Store. Both require no payment details upfront on the app store listing.

The mobile trial includes full access to CyberGhost’s server network of 9,600+ servers across 100 countries. You get the same encryption, kill switch, and streaming capabilities as paying subscribers. After 7 days, the app automatically converts to a paid subscription unless you cancel.

Desktop users on Windows, Mac, and Linux have zero free trial option. The only path to testing CyberGhost on desktop is the 45-day money-back guarantee.

How the 45-Day Money-Back Guarantee Works

CyberGhost’s money-back guarantee covers all plans of 6 months or longer. Monthly plans only get a 14-day refund window. This makes the long-term plans the smarter choice for risk-free testing.

During the guarantee period, you access every feature without restrictions. That means 7 simultaneous device connections, all server locations, and all specialty servers. Streaming-optimized servers, torrenting servers, and gaming servers all work during this window.

The guarantee requires no reason for cancellation. CyberGhost advertises a “no questions asked” policy on refunds. You simply request your money back before the deadline.

Step-by-Step Refund Process

Getting your refund from CyberGhost takes about 5-10 minutes of effort. Follow these steps exactly.

Step 1: Open CyberGhost’s website and navigate to the support section. Click the live chat option available 24/7. You can also email support, but live chat processes refunds faster.

Step 2: Tell the support agent you want to cancel your subscription and request a refund. They may ask why you are leaving. A simple answer like “it didn’t meet my needs” works fine.

Step 3: The agent confirms your refund request and processes it on the spot. You receive an email confirmation within minutes. The actual refund hits your account in 5-10 business days depending on your payment method.

Step 4: Verify the refund appeared in your bank or PayPal account. Contact support again if the refund does not arrive within 10 business days.

One exception exists: purchases made through the Apple App Store or Google Play Store must be refunded through those platforms directly. CyberGhost’s support team cannot process app store refunds.

What You Get During the Guarantee Period

The 45-day guarantee period gives you a complete, unrestricted CyberGhost experience. Nothing is locked or limited.

You get access to 9,600+ servers in 100 countries with full-speed connections. WireGuard, OpenVPN, and IKEv2 protocols are all available. The built-in kill switch, DNS leak protection, and split tunneling work from day one.

Streaming is a strong point of the service. CyberGhost maintains dedicated servers optimized for Netflix, Disney+, BBC iPlayer, and 30+ other platforms. You can connect up to 7 devices simultaneously across Windows, Mac, iOS, Android, Linux, and smart TVs.

CyberGhost Trial vs Competitor Free Options

CyberGhost’s 45-day guarantee is 15 days longer than NordVPN and Proton VPN. That extra time matters when testing streaming reliability across different regions. Proton VPN wins on zero-cost access with its permanent free tier, but that tier limits you to servers in 3 countries with no streaming support.

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• CyberGhost Free Trial: 7 Days on Mobile + 45-Day GuaranteePDF · 0.7 MB

Compare VPN PricingTrust Score

#1CyberGhost9,600+ servers

CyberGhost's privacy record rests on one kind of evidence done well and several kinds absent

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.234.23

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 23 · Independent sources: 6 · Scores updated Nov 2, 2026

Read review

#2NordVPN7,213 servers

NordVPN's privacy and security record is strong on process and mixed on proof

93 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score66/70

App store ratings, part of the score

4.664.59

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 31 · Independent sources: 11 · Scores updated Nov 2, 2026

Read review

#3Surfshark4,500+ servers

Surfshark's evidence mixes real, readable third-party documents with provider assertions

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.714.64

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 32 · Independent sources: 5 · Scores updated Nov 2, 2026

Read review

How Much Does CyberGhost Cost?

CyberGhost

Plans & pricing

CyberGhost's privacy record rests on one kind of evidence done well and several kinds absent

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.234.23

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 23 · Independent sources: 6 · Scores updated Nov 2, 2026

Trust Score rank #3 / 22 9,600+ servers 100 countries 45-day money-back guarantee

Visit CyberGhost Read our review

CyberGhost costs $2.19/month on the long-term plan ($61.32 upfront for 28 months), $6.99/month on the 6-month plan ($41.94 upfront), or $12.99 on the monthly plan. All plans include the same features. Longer commitments save up to 84% off the monthly price. Every plan carries a 45-day money-back guarantee.

CyberGhost Plans at a Glance

CyberGhost sells three plan lengths. Features stay identical across all three. Only the billing cycle and per-month cost change.

The 1-month plan bills $12.99 every 30 days. The 6-month plan bills $41.94 every 6 months, dropping the effective rate to $6.99/month. The long-term plan bills $61.32 upfront for 28 months, landing at $2.19/month.

That long-term deal represents a 84% discount compared to paying monthly for the same period. The 6-month plan saves 46%. Monthly subscribers pay full retail with zero discount.

Intro Pricing vs Renewal Pricing

This is where CyberGhost pricing gets tricky. The $2.19/month rate only applies to your first billing cycle. Renewal rates jump significantly after that introductory period ends.

After the initial 28 months, the long-term plan typically renews at a higher annual rate. CyberGhost does not prominently display renewal pricing during checkout. Check your account dashboard for the exact renewal figure before auto-renewal hits.

The 6-month plan also renews at a rate closer to the standard monthly price. Monthly subscribers see no change since they already pay the base rate. Budget-conscious buyers should set a calendar reminder 30 days before renewal to reassess.

Which Plan Fits Which User Type

Casual Users: Monthly Plan at $12.99

You travel occasionally and need a VPN for 2-3 weeks per year. The monthly plan lets you subscribe, use the service, then cancel without commitment. At $12.99/month, two months of monthly billing costs far less than the $61.32 upfront for the long-term plan.

Power Users: 2-Year Plan at $2.19/Month

You run a VPN on your laptop, phone, and streaming devices daily. The long-term plan costs $61.32 total for 28 months of coverage. That works out to roughly $2.19/month, 84% less than paying monthly for the same 28 months.

CyberGhost allows 7 simultaneous device connections on every plan. Power users get the most value per device on the longest commitment.

Families: 2-Year Plan with 7 Connections

A household of 3-4 people can share one CyberGhost subscription across 7 devices. At $61.32 for 28 months, the cost splits across everyone in the household. No family plan exists separately because 7 connections already covers most households.

Payment Methods Available

CyberGhost accepts a wider range of payment options than many competitors. Credit cards include Visa, Mastercard, American Express, and Discover.

PayPal is available in most regions. Bitcoin payments provide an anonymous checkout option through BitPay. Google Pay and Amazon Pay round out the digital wallet choices. Some regions also support prepaid cards.

No free trial exists for desktop users. Android users sometimes get a 7-day trial through the Google Play Store. The 45-day guarantee effectively serves as the trial period for all other platforms.

Seasonal Discount Patterns

CyberGhost runs predictable sales throughout the year. The deepest discounts typically surface during these windows:

Black Friday and Cyber Monday usually bring the best deals. Discounts in previous years reached 83-85% off on 2-year plans. Summer sales in June and July often match or approach Black Friday pricing.

Holiday promotions around Christmas and New Year carry discounts of 79-84%. CyberGhost also runs flash sales during spring that last 48-72 hours.

The current 84% discount on the long-term plan already matches peak seasonal pricing. If you see that rate, waiting for a bigger sale rarely pays off.

CyberGhost vs Competitor Pricing

Here is how CyberGhost stacks up against 4 major competitors on their cheapest available plans:

On long-term plans CyberGhost’s $2.19/month sits below NordVPN’s and ExpressVPN’s, but above Surfshark’s $2.49/month and Private Internet Access’s $2.03/month. CyberGhost wins on guarantee length with 45 days versus the industry-standard 30 days.

Money-Back Guarantee Terms and Refund Process

CyberGhost offers a 45-day money-back guarantee on all plans of 6 months or longer. The 1-month plan only gets a 14-day refund window. No questions asked, no usage caps, no hidden conditions.

How to Request a Refund

Contact CyberGhost support through live chat or email. Live chat processes refunds faster, typically within 5-10 minutes. State that you want to cancel and receive a refund. No reason required.

Refunds process back to the original payment method within 5-10 business days. Bitcoin purchases may take slightly longer. Apple App Store or Google Play purchases must go through those platforms instead of CyberGhost directly.

What Disqualifies a Refund

Purchasing through third-party app stores adds complexity. Apple and Google control those refund processes separately. Chargebacks filed before contacting CyberGhost support may result in account termination. Always contact CyberGhost first.

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• CyberGhost Pricing: Plans, Costs & Best DealsPDF · 0.7 MB

Most Secure VPNsTrust Score

#1CyberGhost9,600+ servers

CyberGhost's privacy record rests on one kind of evidence done well and several kinds absent

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.234.23

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 23 · Independent sources: 6 · Scores updated Nov 2, 2026

Read review

#2NordVPN7,213 servers

NordVPN's privacy and security record is strong on process and mixed on proof

93 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score66/70

App store ratings, part of the score

4.664.59

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 31 · Independent sources: 11 · Scores updated Nov 2, 2026

Read review

#3ExpressVPN3,000+ servers

86 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.684.69

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 27 · Independent sources: 13 · Scores updated Nov 2, 2026

Read review

Is CyberGhost Safe? Encryption, Audits, and Logging Explained

CyberGhost

Security & privacy

CyberGhost's privacy record rests on one kind of evidence done well and several kinds absent

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.234.23

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 23 · Independent sources: 6 · Scores updated Nov 2, 2026

Trust Score rank #3 / 22 9,600+ servers 100 countries 45-day money-back guarantee

Visit CyberGhost Read our review

CyberGhost earns a trust score of 85/100. It uses AES-256 encryption, operates under Romanian jurisdiction outside 14 Eyes alliances, and publishes quarterly and yearly transparency reports[1]. CyberGhost says its no-logs configuration has been reviewed by Deloitte Romania. CyberGhost routes traffic through 9,600+ servers across 100 countries with built-in leak protection.

Jurisdiction: Why Romania Matters

CyberGhost is a Romanian company, CyberGhost S.A., headquartered in Bucharest. Romania’s Constitutional Court struck down the country’s first data retention law as unconstitutional in Decision 1258/2009[2], and struck down its replacement in Decision 440/2014[3], so Romania has no data retention law of that kind.

CyberGhost states that Romania is not part of any international surveillance alliance such as the 5 or 14 Eyes. Romania is, however, an EU member state, so this is not the same as being out of reach of cross-border legal cooperation. Romanian authorities need a valid court order to request information from a company.

Even with a court order, CyberGhost states it cannot provide what it does not store. The company’s parent organization is Kape Technologies, based in the UK, which also owns ExpressVPN and ZenMate[4].

CyberGhost Audit History

CyberGhost says it has commissioned three engagements from Deloitte Audit Romania on its VPN servers and no-logging controls: a first in 2022, a second announced in May 2024[5], and a third announced in February 2026[6]. The 2024 work was performed under the International Standard on Assurance Engagements 3000 (Revised), and the report is titled a limited assurance report[7]. Each is a point-in-time review, not continuous monitoring, and CyberGhost says it cannot share excerpts out of context and points customers to the full report in their account. These are CyberGhost’s own accounts of the engagements.

CyberGhost has published a yearly transparency report covering 2011 to 2022[1] and has issued quarterly reports since 2020. These reports detail the number of law enforcement requests and DMCA notices received. CyberGhost says it has never produced user data in response because none exists.

CyberGhost No-Logs Policy: What Gets Stored

CyberGhost’s privacy policy explicitly states it does not log browsing history, traffic destinations, or DNS queries. It also does not store connection timestamps, session durations, or assigned IP addresses. CyberGhost says the policy covers all of its servers.

What CyberGhost does NOT store:

• Browsing activity or visited websites
• Downloaded file names or torrent data
• Original IP addresses or assigned VPN IP addresses
• Connection timestamps or session length
• DNS queries or traffic volume per session

What CyberGhost does collect:

• Anonymous, aggregated connection attempts for troubleshooting (no user identification)
• Account email address and payment information for subscription management
• Approximate device type for app improvement analytics

CyberGhost uses anonymous tokens for authentication on its servers. This system breaks the link between your account credentials and your VPN session. The company cannot match a specific user to a specific server connection at any given time.

CyberGhost says its servers are built without persistent storage and run from RAM, so a reboot clears what was in memory. That limits what a physically seized server could reveal about past connections.

Encryption Standards and Protocols

CyberGhost uses AES-256-GCM encryption as its default cipher across all applications. AES-256 is also the symmetric cipher specified in the NSA’s CNSA 2.0 algorithm suite[8] for national security systems.

CyberGhost supports 4 VPN protocols across its apps:

• WireGuard: Default on most platforms. Uses ChaCha20 encryption.
• OpenVPN (UDP/TCP): Uses AES-256-GCM. UDP offers faster speeds. TCP works better on restricted networks.
• IKEv2/IPsec: Preferred on iOS and mobile devices. Handles network switching efficiently between Wi-Fi and cellular.
• L2TP/IPsec: Legacy option. Available but not recommended for primary use.

Perfect forward secrecy means session keys are generated fresh, so compromising one session key does not expose earlier sessions.

Kill Switch and DNS Leak Protection

CyberGhost includes a kill switch on Windows, macOS, iOS, Android, and Linux applications. The kill switch blocks all internet traffic if the VPN connection drops unexpectedly. It activates automatically with no user configuration required.

On Windows and macOS, the kill switch operates at the system level. It modifies firewall rules to prevent any packet from leaving outside the VPN tunnel. Testing with standard leak detection tools shows zero IPv4, IPv6, or WebRTC leaks during connection drops.

CyberGhost also runs its own private DNS servers. Every DNS query routes through encrypted tunnels to CyberGhost-operated resolvers. This prevents ISPs and third parties from seeing which domains you request. No third-party DNS services like Google or Cloudflare handle your queries.

IPv6 leak protection is enabled by default. CyberGhost blocks IPv6 traffic entirely rather than routing it through the tunnel. This approach eliminates a common vulnerability that cheaper VPNs often overlook.

Past Security Incidents

We found no confirmed breach of CyberGhost’s VPN servers reported by CyberGhost. A threat-intelligence vendor has claimed a 2023 database dump linked to CyberGhost, but we found no independent confirmation or CyberGhost disclosure of it, so we do not treat it as established.

Crossrider acquired CyberGhost in 2017 and later renamed itself Kape Technologies. Crossrider had past associations with adware distribution, which is why the ownership draws scrutiny. CyberGhost states that its operations, team, and infrastructure remain in Romania.

Unique Security Features

CyberGhost offers several features that set it apart from many competitors.

NoSpy Servers: CyberGhost operates a set of premium servers in its own data center in Romania. The company manages these servers exclusively without third-party involvement. NoSpy servers use dedicated uplinks and are physically accessible only to CyberGhost staff.

Content Blocker: Built into the apps, this feature blocks ads, trackers, and malicious domains at the DNS level. It processes blocking before traffic reaches your browser. This reduces data exposure without requiring a separate browser extension.

Dedicated IP Option: Users can purchase a static IP address that only they use. This token-based system assigns the IP without linking it to your account identity. It helps avoid CAPTCHAs and blocklists while maintaining privacy.

Automatic Wi-Fi Protection: CyberGhost detects new or unsecured Wi-Fi networks and connects the VPN automatically. Users can set rules for trusted and untrusted networks. This feature prevents accidental unprotected browsing on public hotspots.

Split Tunneling: Available on Android and Windows, split tunneling lets you route specific apps outside the VPN. You choose which apps use the encrypted tunnel and which use your regular connection.

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• Is CyberGhost Safe? Security, Privacy & Audit AnalysisPDF · 0.7 MB

Fastest VPNs ComparedTrust Score

#1CyberGhost9,600+ servers

CyberGhost's privacy record rests on one kind of evidence done well and several kinds absent

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.234.23

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 23 · Independent sources: 6 · Scores updated Nov 2, 2026

Read review

#2NordVPN7,213 servers

NordVPN's privacy and security record is strong on process and mixed on proof

93 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score66/70

App store ratings, part of the score

4.664.59

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 31 · Independent sources: 11 · Scores updated Nov 2, 2026

Read review

#3ExpressVPN3,000+ servers

86 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.684.69

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 27 · Independent sources: 13 · Scores updated Nov 2, 2026

Read review

Where CyberGhost Ranks

CyberGhost

Speed test results

CyberGhost's privacy record rests on one kind of evidence done well and several kinds absent

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.234.23

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 23 · Independent sources: 6 · Scores updated Nov 2, 2026

Trust Score rank #3 / 22 9,600+ servers 100 countries 45-day money-back guarantee

Visit CyberGhost Read our review

CyberGhost ranks #3 of 22 on our Trust Score. That rank is aggregated from published third-party tests, not from in-house testing. Read it as a position for comparing providers, not as a figure recorded on your own connection.

A rank of #10 tells you something useful and limited: CyberGhost is not among the providers that lead on throughput, and nothing in the aggregated data suggests it struggles with everyday browsing or streaming. Anyone whose priority is raw bandwidth should compare against the providers ranked above it.

Choosing a Protocol

Protocol choice affects your connection more than almost any other setting in the app. CyberGhost supports three.

WireGuard is the modern default and the one to use unless you have a specific reason not to. It is a smaller codebase than OpenVPN, negotiates connections quickly, and reconnects quickly after a dropped signal.

IKEv2 handles network changes gracefully, so it is worth selecting on a phone that moves between WiFi and cellular through the day.

OpenVPN is the oldest of the three and the most widely compatible. Choose it when you need to get through a restrictive firewall or when a device or router only supports OpenVPN configuration files.

Server distance matters next. A server in or near your own country will almost always beat a distant one, whatever the protocol.

Streaming and P2P Servers

CyberGhost groups servers by purpose in its app rather than presenting one undifferentiated list. Dedicated streaming servers are labelled per platform, and dedicated P2P servers are labelled separately.

Using the labelled server for the task is the right default. Port forwarding is not offered, which is worth knowing if you seed and care about upload ratios.

If Your Connection Feels Slow

Work through these in order before concluding the VPN is the problem.

1. Switch to WireGuard. If the app is on OpenVPN or set to “automatic”, change it manually.
2. Pick a closer server. Use Quick Connect, or choose a city in your own country instead of a distant one.
3. Try a different server in the same location. An individual busy server explains more slowdowns than the provider does.
4. Test on Ethernet. A wired connection removes WiFi as a variable and tells you whether the VPN is actually the bottleneck.
5. Measure your speed with the VPN off first. Compare against that number, not against what your ISP plan promises.

On mobile, brief drops during tower handoffs are normal. WireGuard restores the tunnel faster than IKEv2 after one.

What CyberGhost Publishes About Its Service

These are CyberGhost’s own published figures, not ours:

The 45-day window is longer than the 30 days NordVPN and ExpressVPN offer, which gives you time to test the connection on your own hardware and network before committing.

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• CyberGhost Speed Test Rank: #10 of 22 on Our Trust Score ListPDF · 0.7 MB

VPNs with Free TrialsTrust Score

#1ExpressVPN3,000+ servers

86 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.684.69

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 27 · Independent sources: 13 · Scores updated Nov 2, 2026

Read review

#2NordVPN7,213 servers

NordVPN's privacy and security record is strong on process and mixed on proof

93 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score66/70

App store ratings, part of the score

4.664.59

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 31 · Independent sources: 11 · Scores updated Nov 2, 2026

Read review

#3CyberGhost9,600+ servers

CyberGhost's privacy record rests on one kind of evidence done well and several kinds absent

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.234.23

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 23 · Independent sources: 6 · Scores updated Nov 2, 2026

Read review

How to Try ExpressVPN for Free

ExpressVPN

Free trial & guarantee

86 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.684.69

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 27 · Independent sources: 13 · Scores updated Nov 2, 2026

Trust Score rank #2 / 22 3,000+ servers 113 countries 30-day money-back guarantee

Visit ExpressVPN Read our review

ExpressVPN does not offer a traditional free trial on desktop. Mobile users on Android and iOS may find a 7-day free trial, though availability varies by region. The primary risk-free option is the 30-day money-back guarantee, which gives full access across 8 devices. You pay upfront and request a complete refund before day 30.

ExpressVPN Free Trial Availability

ExpressVPN removed its widely available 7-day free trial for most platforms several years ago. Desktop and laptop users cannot access any free trial period today. The only way to test ExpressVPN on Windows, Mac, or Linux is through the money-back guarantee.

Mobile users sometimes see a 7-day free trial through the Apple App Store or Google Play Store. This trial appears inconsistently and depends on your region, device, and account history. Apple and Google manage the billing, not ExpressVPN directly.

If the 7-day mobile trial shows up, you must cancel before day 7 to avoid charges. Cancellation happens through your phone’s subscription settings, not through ExpressVPN’s website. Missing the deadline means your selected plan activates at full price.

ExpressVPN Money-Back Guarantee Explained

The 30-day money-back guarantee is the most reliable way to try ExpressVPN without long-term commitment. You get unrestricted access to every server, feature, and protocol during those 30 days. There are no bandwidth limits, speed caps, or feature restrictions of any kind.

This guarantee applies to all plan lengths: 1-month, 6-month, and 12-month subscriptions. You must purchase directly through ExpressVPN’s website to qualify. Purchases made through Apple or Google require refund requests through those platforms instead.

ExpressVPN states “no questions asked” in its refund policy. In practice, the support agent may ask why you want to cancel. A simple answer like “it’s not right for me” works every time.

How to Cancel ExpressVPN and Get a Refund

Follow these 5 steps to cancel ExpressVPN and receive your full refund within the 30-day window.

Step 1: Open the ExpressVPN website and log in to your account dashboard.

Step 2: Click the live chat icon in the bottom-right corner of the page. Live chat operates 24 hours a day, 7 days a week.

Step 3: Tell the support agent you want to cancel your subscription and request a refund. The agent may ask for a reason or offer troubleshooting help.

Step 4: Confirm you want the refund. The agent will process the cancellation and initiate the refund on the spot.

Step 5: Wait 5 to 7 business days for the refund to appear in your original payment method. Credit cards may take slightly longer depending on the issuing bank.

Keep your confirmation email as proof until the refund posts to your account. The entire live chat process typically takes under 10 minutes from start to finish.

What You Get During the Guarantee Period

The 30-day guarantee period provides the exact same product as a paying long-term subscriber receives. Nothing is locked, throttled, or hidden behind an upgrade wall.

You get access to servers in 113 countries with unlimited bandwidth and speed. All 8 simultaneous device connections are available from day one. Every protocol option works, including Lightway, OpenVPN, and IKEv2.

Split tunneling, the kill switch, and DNS leak protection all function during the guarantee period. Streaming accesses for Netflix, Disney+, BBC iPlayer, and other platforms work identically to paid accounts. You can test everything before deciding to keep the subscription.

ExpressVPN Trial vs. Competitor Free Trials

CyberGhost offers the longest money-back guarantee at 45 days on plans of 6 months or longer. Proton VPN stands alone with a permanent free tier, though it limits you to servers in 5 countries. NordVPN mirrors ExpressVPN’s structure with a mobile trial and 30-day guarantee.

ExpressVPN’s 30-day guarantee remains competitive, but it lacks a permanent free option. Users who want zero financial risk upfront should consider Proton VPN’s free tier first.

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• ExpressVPN Free Trial: 30-Day Money-Back GuaranteePDF · 0.7 MB

Compare VPN PricingTrust Score

#1ExpressVPN3,000+ servers

86 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.684.69

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 27 · Independent sources: 13 · Scores updated Nov 2, 2026

Read review

#2NordVPN7,213 servers

NordVPN's privacy and security record is strong on process and mixed on proof

93 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score66/70

App store ratings, part of the score

4.664.59

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 31 · Independent sources: 11 · Scores updated Nov 2, 2026

Read review

#3Surfshark4,500+ servers

Surfshark's evidence mixes real, readable third-party documents with provider assertions

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.714.64

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 32 · Independent sources: 5 · Scores updated Nov 2, 2026

Read review

How Much Does ExpressVPN Cost?

ExpressVPN

Plans & pricing

86 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.684.69

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 27 · Independent sources: 13 · Scores updated Nov 2, 2026

Trust Score rank #2 / 22 3,000+ servers 113 countries 30-day money-back guarantee

Visit ExpressVPN Read our review

ExpressVPN costs $12.99 to $19.99 per month on monthly billing. The 2-year plan drops costs to $2.99/month for Basic and $8.99/month for Pro. All three tiers (Basic, Advanced, Pro) include a 30-day money-back guarantee. Longer commitments access discounts up to 77%.

ExpressVPN Plans and Pricing Breakdown

ExpressVPN splits its service into three tiers: Basic, Advanced, and Pro. Each tier offers monthly, 1-year, and 2-year billing cycles.

Basic covers the core VPN with no extras. Monthly billing runs $12.99. The 1-year plan costs $59.88 total ($4.99/month), 62% less than paying monthly. The 2-year plan costs $83.72 total ($2.99/month), 77% less.

Advanced adds identity protection tools like a data breach monitor and password manager. Monthly billing costs $13.99. The 1-year plan runs $71.88 ($5.99/month), 57% less than monthly. The 2-year plan totals $125.72 ($4.49/month), 68% less.

Pro bundles the VPN with identity theft insurance and credit monitoring. Monthly billing hits $19.99. The 1-year plan costs $107.88 ($8.99/month), 55% less than monthly. The 2-year plan totals $134.85 ($8.99/month), 55% less.

Intro vs. Renewal Pricing: What You Actually Pay

The discounted rates shown above apply to your first billing cycle only. This is the detail most buyers miss. ExpressVPN renewal rates climb back toward standard pricing after year one or two.

Renewal pricing typically matches or sits close to monthly rates annualized. A Basic 1-year plan at $59.88 the first year could renew closer to the $12.99 monthly rate. ExpressVPN does not prominently advertise renewal rates on its pricing page.

Check your account settings 2 weeks before renewal to confirm exact charges. You can cancel auto-renewal and re-subscribe during a promotional period to recapture introductory pricing. This strategy saves 30% to 50% compared to passive renewal.

Best Plan for Each User Type

Casual Users

Pick the Basic 2-year plan at $2.99/month. You get the full VPN with 3,000+ servers across 113 countries. Casual browsing, streaming, and public Wi-Fi protection require nothing beyond the core VPN.

Power Users

The Advanced 1-year plan at $5.99/month fits frequent travelers and security-conscious professionals. You get password management and breach alerts alongside the VPN. The 1-year commitment lets you reassess competitors annually without a 2-year lock-in.

Families and High-Risk Users

The Pro 2-year plan at $8.99/month makes sense for households needing identity theft insurance. Credit monitoring adds tangible value when multiple family members share the account. ExpressVPN allows up to 10 simultaneous device connections across all tiers.

Payment Methods Available

ExpressVPN accepts a wider range of payment methods than most competitors. Credit and debit cards include Visa, Mastercard, American Express, and Discover.

Digital wallets like PayPal are supported for recurring billing. Cryptocurrency payments through Bitcoin provide an anonymous option but limit refund flexibility. Regional options include UnionPay, iDeal, Sofort, and other localized processors depending on your country.

Prepaid gift cards from retailers can also fund your account in some cases. Choose PayPal or credit card if you want the simplest refund path through the 30-day guarantee.

Seasonal Discount Patterns

ExpressVPN runs its deepest promotions during 4 predictable windows each year. Black Friday and Cyber Monday in November consistently deliver the lowest published prices. Holiday sales in late December through early January offer similar markdowns.

Back-to-school promotions appear in August and September with moderate discounts. Occasional flash sales surface during spring, typically lasting 48 to 72 hours. The 2-year plan discounts during Black Friday have historically matched or beaten the standard 77% discount.

Set a price alert or bookmark the pricing page in October to catch the best window. Signing up mid-cycle on a monthly plan and switching during a sale wastes money.

ExpressVPN vs. Competitor Pricing

ExpressVPN sits at the premium end of the VPN market. Here is how its lowest effective rate compares to competitors on their cheapest long-term plans.

ExpressVPN costs 9% to 60% more than budget competitors at the lowest tier. The premium buys you consistently fast speeds, a KPMG-reviewed no-logs claim, and reliable streaming accessing. Users prioritizing raw cost savings should consider Surfshark or PIA instead.

Money-Back Guarantee and Refund Process

All ExpressVPN plans include a 30-day money-back guarantee with no usage restrictions. You can use the full service for 30 days and still receive a complete refund. There are no data caps or feature limitations during the trial window.

To request a refund, contact ExpressVPN support through 24/7 live chat. State that you want to cancel and receive your refund. Representatives process most requests within 5 to 10 minutes without aggressive retention tactics.

Refunds typically land back in your account within 5 to 7 business days for credit cards. PayPal refunds arrive within 3 days. Bitcoin payments cannot be refunded to the original wallet, so the company issues account credit or alternative payment.

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• ExpressVPN Pricing: Plans from $3.26/MonthPDF · 0.7 MB

Most Secure VPNsTrust Score

#1ExpressVPN3,000+ servers

86 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.684.69

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 27 · Independent sources: 13 · Scores updated Nov 2, 2026

Read review

#2NordVPN7,213 servers

NordVPN's privacy and security record is strong on process and mixed on proof

93 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score66/70

App store ratings, part of the score

4.664.59

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 31 · Independent sources: 11 · Scores updated Nov 2, 2026

Read review

#3ProtonVPN20,000+ servers

85 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score59/70

App store ratings, part of the score

4.614.70

How we score

Researched Oct 3, 2026 · Claims checked: 37 · Independent sources: 3 · Scores updated Nov 2, 2026

Read review

Is ExpressVPN Safe? A Security Deep-Dive

ExpressVPN

Security & privacy

86 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.684.69

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 27 · Independent sources: 13 · Scores updated Nov 2, 2026

Trust Score rank #2 / 22 3,000+ servers 113 countries 30-day money-back guarantee

Visit ExpressVPN Read our review

ExpressVPN earns an 86/100 trust score based on a published KPMG no-logs assurance report, AES-256 encryption, and RAM-only servers across 113 countries. It operates under British Virgin Islands jurisdiction, outside 14 Eyes surveillance alliances. A KPMG assurance report and repeated Cure53 security audits support its privacy and security claims, within the limits described below.

Jurisdiction: Why the British Virgin Islands Matter

ExpressVPN is incorporated in the British Virgin Islands, a self-governing British Overseas Territory, and the BVI sits outside the 5 Eyes, 9 Eyes, and 14 Eyes intelligence-sharing alliances. We found no primary source for a BVI VPN data retention rule, so we do not claim one. TorrentFreak reported[1] that ExpressVPN only responds to local court orders.

The practical test came in 2017. Turkish authorities seized an ExpressVPN server in an investigation. According to that report, the inspection yielded no useful information, and ExpressVPN said it had told the investigators it never possessed customer connection logs.

Independent Audit History

ExpressVPN has completed more third-party security audits than most competitors. Each audit examined different aspects of the service’s privacy and security claims.

KPMG No-Logs Assurance Report

KPMG LLP gave reasonable assurance, under ISAE (UK) 3000 Type 1, on ExpressVPN’s TrustedServer system and privacy policy claims as of 28 February 2025[2], and ExpressVPN says it identified no issues regarding technical safeguards against activity logging. It is a point-in-time report commissioned by ExpressVPN, not continuous monitoring, and it is readable after accepting KPMG’s terms. ExpressVPN describes it as its second KPMG assessment.

Cure53 Security Audits

Cure53, a German cybersecurity firm, lists many ExpressVPN pentest reports on its public reports list[3], including the Lightway protocol (2022 and October to November 2024), the Aircove router firmware (November 2024), browser extensions and the Android, iOS, Linux and macOS clients. In autumn 2024, Cure53 and Praetorian both audited ExpressVPN’s Rust rewrite of Lightway. We have not re-checked the individual severity counts in each report, so read the reports for findings.

Cure53 publishes its own reports for ExpressVPN publicly, which is a transparency signal in the VPN industry, though every engagement is commissioned by ExpressVPN.

Logging Policy: What Gets Stored and What Does Not

ExpressVPN’s privacy policy states clearly what data it collects. Understanding the specifics matters more than marketing claims.

Data ExpressVPN Does NOT Store

ExpressVPN does not log your browsing history, traffic destination, DNS queries, or IP address. It does not record connection timestamps, session duration, or assigned VPN IP addresses. No content of your communications passes through any logging system.

Data ExpressVPN DOES Collect

ExpressVPN collects aggregate connection data: which app version you use, which server location you chose (not specific server), and total bandwidth consumed per day. This data cannot identify individual users or link activity to specific accounts. It uses this information to maintain server capacity.

Your account email, payment information, and support ticket history are stored for billing purposes. Users who want maximum anonymity can pay with Bitcoin or use a disposable email address.

Encryption Standards and Protocols

ExpressVPN uses AES-256-GCM encryption as its default standard. AES-256 is also the symmetric cipher specified in the NSA’s CNSA 2.0 algorithm suite[4] for national security systems.

Available Protocols

ExpressVPN offers 4 VPN protocols across its apps. Lightway is its proprietary protocol, built on wolfSSL and using ChaCha20 or AES-256 encryption. OpenVPN runs over both UDP and TCP with AES-256-GCM. IKEv2/IPSec is available on select platforms for fast mobile connections.

Lightway deserves special attention. ExpressVPN has said its codebase is much smaller than OpenVPN’s, and a smaller codebase offers less surface to audit. Cure53 and Praetorian audited the 2024 Rust rewrite of Lightway, and ExpressVPN published the code as open source.

Perfect Forward Secrecy

ExpressVPN says it negotiates a new encryption key for every connection session, so compromising one session key does not expose earlier sessions.

Kill Switch and DNS Leak Protection

ExpressVPN calls its kill switch “Network Lock.” It activates by default on Windows, Mac, Linux, and routers. Network Lock blocks all internet traffic if the VPN connection drops unexpectedly.

Network Lock works at the firewall level, not the application level. This approach prevents leaks during brief reconnection windows that application-level kill switches often miss. It allows traffic only through the VPN tunnel and to ExpressVPN’s DNS servers.

ExpressVPN runs its own private, encrypted DNS on every server. Your DNS queries never touch third-party DNS providers like Google or Cloudflare. This eliminates DNS leak risk at the infrastructure level rather than relying on software patches.

Independent testing tools consistently show zero DNS leaks, zero WebRTC leaks, and zero IPv6 leaks across ExpressVPN’s major apps. The router firmware extends this protection to every device on your network.

Past Security Incidents

No security product exists without scrutiny. ExpressVPN has faced two notable incidents worth examining.

The Turkey Server Seizure (2017)

Turkish authorities investigating the assassination of Russian Ambassador Andrei Karlov seized an ExpressVPN server in January 2017, reportedly[1] because the assassin’s Gmail and Facebook accounts had been deleted remotely over an ExpressVPN connection. The report says the inspection yielded no useful information. The story became public in December 2017.

The Kape Technologies Acquisition (2021)

Kape Technologies acquired ExpressVPN[5] for approximately $936 million in 2021. Kape previously operated as Crossrider, a company associated with adware distribution before rebranding, and the acquisition raised concerns among privacy advocates.

ExpressVPN has since commissioned further assurance work, including the KPMG assessment as of February 2025, though that is a point-in-time review. Users should monitor future audits to verify the controls still hold.

Unique Security Features

ExpressVPN offers several security features that distinguish it from competitors with similar encryption standards.

TrustedServer Technology

Every ExpressVPN server runs entirely on volatile RAM, not hard drives. Servers load a read-only image at every boot. All data is wiped completely with each server reboot. This architecture makes persistent data storage physically impossible on VPN servers.

Threat Manager

Threat Manager blocks apps and websites from communicating with known trackers and malicious servers. It operates at the DNS level across all connected devices. ExpressVPN updates its blocklists regularly based on threat intelligence data.

Express Keys (Password Manager)

ExpressVPN bundles a built-in password manager called Keys with all subscriptions. Keys uses zero-knowledge encryption, meaning ExpressVPN cannot access your stored passwords. This integration adds practical security value beyond the VPN tunnel itself.

Post-Quantum Protection

ExpressVPN says it implemented post-quantum cryptography support in its Lightway protocol, aimed at future quantum computers that could break today’s key-exchange methods. We have not independently tested it.

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• Is ExpressVPN Safe? Security, Privacy & Audit AnalysisPDF · 0.7 MB

Fastest VPNs ComparedTrust Score

#1ExpressVPN3,000+ servers

86 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.684.69

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 27 · Independent sources: 13 · Scores updated Nov 2, 2026

Read review

#2NordVPN7,213 servers

NordVPN's privacy and security record is strong on process and mixed on proof

93 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score66/70

App store ratings, part of the score

4.664.59

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 31 · Independent sources: 11 · Scores updated Nov 2, 2026

Read review

#3Surfshark4,500+ servers

Surfshark's evidence mixes real, readable third-party documents with provider assertions

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.714.64

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 32 · Independent sources: 5 · Scores updated Nov 2, 2026

Read review

How Fast Is ExpressVPN?

ExpressVPN ranks #2 of 22 on our Trust Score.

That rank is an editorial index, not a measurement we take ourselves. We don’t run our own speed tests. The Trust Score aggregates published results from third-party tests, and every source and the scoring formula are listed in our methodology.

So read 630 Mbps as a comparative position against the other 21 providers we track, not as a number your connection will reproduce. What you actually get depends on your base line speed, how far away the server is, and which protocol you use.

ExpressVPN

Speed test results

86 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.684.69

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 27 · Independent sources: 13 · Scores updated Nov 2, 2026

Trust Score rank #2 / 22 3,000+ servers 113 countries 30-day money-back guarantee

Visit ExpressVPN Read our review

Which Protocol to Use

ExpressVPN ships three protocols: Lightway, OpenVPN, and IKEv2. Protocol choice affects throughput more than any other setting in the app.

Lightway (UDP) is ExpressVPN’s own protocol, built along the same lines as WireGuard. It is the app default. UDP skips the handshake and error-correction steps that hold other options back, and it reconnects quickly after a drop.

Lightway (TCP) trades speed for guaranteed delivery. TCP adds handshake and retransmission overhead, so it is slower by design. Switch to it only when a restrictive network blocks UDP traffic outright.

OpenVPN is the older open-source standard. It is heavily audited and supported almost everywhere, but heavier than Lightway. Use it when you need that compatibility, on a router or an unusual client.

IKEv2 re-establishes a connection fast after the network underneath it changes. That suits phones moving between Wi-Fi and cellular.

What Affects Your Speed More Than the Provider

Your base connection. A VPN can only ever hand back a share of the line you already have. On a slower line, the tunnel’s overhead is a smaller absolute bite.

Distance to the server. Every extra mile adds latency, and latency drags throughput down with it. A server on another continent costs you more than any protocol setting will.

Server load. A busy server at peak hours is slower than a quiet one in the same city. Trying a second server nearby is often the whole fix.

Your local Wi-Fi. A shared or distant access point adds latency the VPN usually gets blamed for. Test wired before you blame the app.

Streaming and Gaming

Netflix asks for roughly 25 Mbps sustained for 4K, and competitive games care about latency rather than raw throughput. Both thresholds sit well below the bandwidth of a typical fiber or cable line.

That makes the practical question your own retained speed, not a provider’s position in a ranking. Run a speed test with the VPN off, then again connected to a nearby server, and compare. If the gap is large, the fixes below are worth working through before you switch provider.

If ExpressVPN Feels Slow

1. Set the protocol to Lightway (UDP) in the app settings.
2. Connect to a server close to you rather than a distant one.
3. Try a different server in the same region to rule out a loaded one.
4. Test on Ethernet to separate a Wi-Fi problem from a VPN problem.
5. Measure a no-VPN baseline first, so you know what share you’re actually losing.

ExpressVPN carries a 30-day money-back guarantee, which gives you a window to test it on your own connection and request a refund if it doesn’t hold up.

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• ExpressVPN Speed Test: Where It Ranks on Our Trust Score ListPDF · 0.7 MB

VPNs with Free TrialsTrust Score

#1Mullvad VPN550+ servers

83 out of 100, built from two weighted parts

Trust & Value30% of the score23/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.144.06

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 29 · Independent sources: 9 · Scores updated Nov 2, 2026

Read review

#2NordVPN7,213 servers

NordVPN's privacy and security record is strong on process and mixed on proof

93 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score66/70

App store ratings, part of the score

4.664.59

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 31 · Independent sources: 11 · Scores updated Nov 2, 2026

Read review

#3Surfshark4,500+ servers

Surfshark's evidence mixes real, readable third-party documents with provider assertions

85 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score58/70

App store ratings, part of the score

4.714.64

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 32 · Independent sources: 5 · Scores updated Nov 2, 2026

Read review

Can You Get a Mullvad Free Trial?

Mullvad VPN

Free trial & guarantee

83 out of 100, built from two weighted parts

Trust & Value30% of the score23/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.144.06

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 29 · Independent sources: 9 · Scores updated Nov 2, 2026

Trust Score rank #7 / 22 550+ servers 50+ countries 14-day money-back guarantee

Visit Mullvad VPN Read our review

Mullvad does not offer a free trial on any platform. There is no 7-day mobile trial and no money-back guarantee. Mullvad charges a flat €5.00/month with no long-term contracts. You pay for one month at a time and stop whenever you want. The only way to test Mullvad risk-free is to pay for a single month.

How Mullvad Pricing Actually Works

Mullvad uses a unique account system with no email, no username, and no password. You generate a random 16-digit account number and add time to it. Every month costs exactly €5.00, regardless of how long you subscribe.

This pay-as-you-go model replaces the need for a Mullvad money back guarantee. You never commit to a 12-month or 24-month plan. You add 1 month, use it, and decide whether to continue.

Mullvad accepts credit cards, PayPal, Bitcoin, cash in an envelope, and other cryptocurrencies. Cash and crypto payments make the service nearly anonymous from the start.

Does Mullvad Offer Refunds?

Mullvad does process refunds, but the terms are restrictive and not heavily advertised. You can request a refund for unused time on your account through their support page.

The refund only covers unused time, not partially used months. Mullvad processes refunds to the original payment method when possible. Crypto and cash payments cannot be refunded the same way.

To request a refund, email support@mullvad.net with your account number and payment details. Response times typically fall within 1-3 business days. Do not expect an automatic or instant process.

Step-by-Step: How to Cancel Mullvad

Canceling Mullvad requires zero effort because there is no recurring subscription to cancel. Follow these steps:

1. Stop adding time to your 16-digit account number.
2. Let your existing paid time expire naturally.
3. Uninstall the Mullvad app from your devices.
4. Optionally, email support to request a refund for any unused time remaining.

There are no cancellation fees, no hidden charges, and no retention tactics. Your account simply stops working when paid time runs out. Mullvad deletes account data 6 months after expiration.

What You Get During Your First Month

Your €5.00 covers the full Mullvad experience with no feature restrictions. Every paying user gets identical access to all servers and protocols.

Mullvad operates 550+ servers across 50+ countries. You can connect up to 5 devices simultaneously. The service supports WireGuard and OpenVPN protocols on Windows, macOS, Linux, Android, and iOS.

Features included from day one: DNS leak protection, kill switch, split tunneling, multihop connections, and DAITA (defense against AI-guided traffic analysis). Mullvad runs RAM-only servers and publishes regular infrastructure audits.

Mullvad vs Competitors: Trial and Guarantee Comparison

NordVPN and Surfshark offer 7-day free trials on Android and iOS. CyberGhost gives 45 days to test and return. Proton VPN provides a genuinely free tier with servers in 3 countries.

Mullvad’s approach trades risk-free testing for simplicity and privacy. You spend €5.00 once with no commitment. Competitors require long-term plans to access their lowest prices, then rely on guarantee windows.

Who Should Pay for Mullvad Without a Trial?

Mullvad suits privacy-focused users who value transparency over marketing gimmicks. The €5.00 flat rate means you never feel locked into a bad deal.

Users who need to test features extensively before committing should consider Proton VPN’s free tier instead. Streaming-focused users wanting a longer evaluation window should look at CyberGhost’s 45-day guarantee.

If you already know you want strong privacy defaults, audited infrastructure, and anonymous payment options, €5.00 is a low barrier to entry. Most users decide within a week whether Mullvad fits their workflow.

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• Mullvad Free Trial: Does It Exist?PDF · 0.7 MB

Compare VPN PricingTrust Score

#1Mullvad VPN550+ servers

83 out of 100, built from two weighted parts

Trust & Value30% of the score23/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.144.06

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 29 · Independent sources: 9 · Scores updated Nov 2, 2026

Read review

#2NordVPN7,213 servers

NordVPN's privacy and security record is strong on process and mixed on proof

93 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score66/70

App store ratings, part of the score

4.664.59

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 31 · Independent sources: 11 · Scores updated Nov 2, 2026

Read review

#3ProtonVPN20,000+ servers

85 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score59/70

App store ratings, part of the score

4.614.70

How we score

Researched Oct 3, 2026 · Claims checked: 37 · Independent sources: 3 · Scores updated Nov 2, 2026

Read review

How Much Does Mullvad Cost?

Mullvad VPN

Plans & pricing

83 out of 100, built from two weighted parts

Trust & Value30% of the score23/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.144.06

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 29 · Independent sources: 9 · Scores updated Nov 2, 2026

Trust Score rank #7 / 22 550+ servers 50+ countries 14-day money-back guarantee

Visit Mullvad VPN Read our review

Mullvad charges a flat €5.00 per month with no annual or multi-year plans. Every user pays the same price regardless of subscription length. There are no introductory discounts, no renewal price hikes, and no tiered plans. You get one product at one price.

Mullvad’s Single-Plan Structure Explained

Mullvad offers exactly one plan. That plan costs €5.00 per month, billed monthly. There are zero alternatives, zero upgrades, and zero add-ons.

This is unusual in the VPN industry. Most providers push 2-year or 3-year commitments to lock in lower monthly rates. Mullvad rejected that model entirely and keeps pricing transparent.

Your account gets a random 16-digit number instead of an email address. You load time onto that number in 30-day increments. Each 30-day block costs €5.00.

Intro vs. Renewal Pricing: No Surprises

Most VPN providers advertise low monthly rates that require multi-year prepayments. When those plans expire, renewal prices jump sharply. NordVPN’s $3.49/month plan renews toward its $14.99/month standard rate. Surfshark’s $2.49/month plan renews toward its $18.95/month standard rate.

Mullvad charges €5.00 in month 1 and €5.00 in month 37. The price never changes. There is no contract, no auto-renewal trap, and no hidden fee schedule.

This flat structure means Mullvad costs more than competitors’ promotional rates in the first term, but it does not climb at renewal the way those rates do.

Which User Type Gets the Best Value?

Casual Users (1-3 Months per Year)

Mullvad is ideal for short-term use. You pay €5.00 only for months you need. No commitment locks you into 24 months of payments for occasional airport WiFi protection.

A casual user pays only for the months they use. The same user on NordVPN’s cheapest plan prepays $94.23 upfront for the whole 27-month term.

Power Users (Always-On VPN)

Power users who run a VPN all year pay €5.00 for each of the 12 months. That is more than the effective monthly rate on a competitor’s long-term plan but less than monthly rates from most competitors.

Mullvad supports WireGuard natively and runs 5 simultaneous connections. Power users get full-speed servers in 50+ countries without paying extra for premium tiers.

Families and Multi-Device Households

Mullvad allows 5 simultaneous connections per account. Families needing more must buy a second account at another €5.00/month.

Surfshark offers unlimited devices on one account for ~$2.49/month (2-year prepay). Families with 6+ devices save more on Surfshark during the initial term.

Payment Methods Available

Mullvad accepts more anonymous payment options than nearly any competitor. Here is the full list:

• Credit/debit card processed through Stripe
• PayPal linked to your existing PayPal account
• Bitcoin sent directly to a generated address
• Bitcoin Cash for lower transaction fees
• Monero for maximum transaction privacy
• Cash by mail in EUR, USD, GBP, SEK, DKK, NOK, CHF, or CAD
• Bank wire for EU-based SEPA transfers
• Swish for Swedish users
• Voucher codes purchased from resellers

Cash by mail is Mullvad’s most private option. You stuff bills into an envelope with your account number and mail it to their Swedish office. They credit your account upon receipt.

Seasonal Discount Patterns

Mullvad does not run seasonal discounts. There are no Black Friday deals, no holiday promotions, and no coupon codes. The price has been €5.00/month since 2009.

This is confirmed on their official website and verified across 15 years of pricing history. If you see a “Mullvad discount code” advertised elsewhere, it is not legitimate.

The company has publicly stated they will not adopt discount pricing. Their philosophy ties flat pricing to user trust and transparency.

Mullvad vs. Competitor Pricing Comparison

Mullvad looks expensive at first glance. But the lowest rates in the right-hand column are first-term promotional prices. Competitors spike at renewal, and Mullvad stays flat.

Mullvad also includes no upsells. Higher NordVPN and Surfshark tiers add paid extras on top of the base VPN. Mullvad bundles ad blocking and tracker blocking at no additional cost.

Money-Back Guarantee and Refund Process

Mullvad does not offer a traditional money-back guarantee or free trial. Instead, it operates a pay-as-you-go refund system. Unused account time is refundable upon request.

If you load 30 days and use 5 days, you can request a refund for the remaining 25 days. Refunds are processed to the original payment method when possible. Cash payments are refunded via bank transfer.

To request a refund, email support@mullvad.net with your account number. Mullvad typically processes refunds within 3-5 business days. There is no refund form or automated system.

This model gives more flexibility than a 30-day money-back guarantee. You can test the service for 2 days and get 28 days back. Most competitors require you to cancel within the guarantee window or lose everything.

Hidden Costs and Gotchas

Mullvad has no hidden costs. There are no data caps, no bandwidth throttling, no premium server tiers, and no feature gates behind higher-priced plans.

The only potential extra cost is currency conversion. Mullvad prices in euros, so USD, GBP, or other currency users may pay 1-3% in conversion fees depending on their bank or payment processor.

Bitcoin and Monero payments carry network transaction fees. These typically range from $0.50-$3.00 depending on network congestion at the time of payment.

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• Mullvad Pricing: One Plan, One Flat Monthly CostPDF · 0.7 MB

Most Secure VPNsTrust Score

#1Mullvad VPN550+ servers

83 out of 100, built from two weighted parts

Trust & Value30% of the score23/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.144.06

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 29 · Independent sources: 9 · Scores updated Nov 2, 2026

Read review

#2ProtonVPN20,000+ servers

85 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score59/70

App store ratings, part of the score

4.614.70

How we score

Researched Oct 3, 2026 · Claims checked: 37 · Independent sources: 3 · Scores updated Nov 2, 2026

Read review

#3NordVPN7,213 servers

NordVPN's privacy and security record is strong on process and mixed on proof

93 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score66/70

App store ratings, part of the score

4.664.59

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 31 · Independent sources: 11 · Scores updated Nov 2, 2026

Read review

Is Mullvad Safe? A Direct Assessment

Mullvad VPN

Security & privacy

83 out of 100, built from two weighted parts

Trust & Value30% of the score23/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.144.06

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 29 · Independent sources: 9 · Scores updated Nov 2, 2026

Trust Score rank #7 / 22 550+ servers 50+ countries 14-day money-back guarantee

Visit Mullvad VPN Read our review

Mullvad scores 83/100 on our trust index. It operates under Swedish jurisdiction, charges a flat €5/month with no accounts, and publishes a no-logs policy. Outside audits by Cure53, Assured AB and others found no customer-activity logging on the servers they were given, according to Mullvad’s published audit summaries[1]. Mullvad says it stores zero connection logs, traffic data, or personally identifiable information on its servers.

Swedish Jurisdiction and Legal Data Requests

Sweden belongs to the 14 Eyes intelligence-sharing alliance. That sounds alarming at first glance. In practice, the legal framework tells a more nuanced story for VPN providers.

Mullvad says that Sweden’s Electronic Communications Act, which governs how internet service providers must log traffic, does not apply to VPN services[2], so Swedish law does not require VPN companies to retain user data. This means authorities can issue requests, but Mullvad has nothing stored to hand over.

On April 18, 2023, at least six Swedish police officers visited Mullvad’s office in Gothenburg with a search warrant[3]. They intended to seize computers containing customer data. Mullvad says it argued the officers had no reason to expect to find any, demonstrated how the service works, and that the officers left without taking anything after consulting the prosecutor. This is Mullvad’s own account, but it is a real-world test of a no-logs design under legal pressure.

Independent Audit History

Mullvad has published reports from several outside security firms. Each examined different parts of the infrastructure or apps, and Mullvad commissioned all of them.

Cure53 Infrastructure Audit (2020)

Cure53, a Berlin-based penetration testing firm, audited Mullvad’s infrastructure in November and December 2020. It identified six vulnerabilities and six miscellaneous issues, each ranging from informative to high severity, and was unable to discover any personally identifiable information attached to end users. Mullvad said it had resolutions for all of the vulnerabilities[4], and the report is public on Cure53’s website.

Assured AB Relay Server Audit (2022)

Assured AB audited three Mullvad relay servers (two WireGuard, one OpenVPN), concluding in May 2022, and wrote that the configuration is sound and did not display signs of any direct customer information[5]. It identified 21 issues rated low to medium and none rated high or critical. Mullvad’s own account says the audited servers were freshly installed machines that no customers were using.

Radically Open Security Audit (2023)

Radically Open Security tested two RAM-only Mullvad servers, finishing in mid-June 2023, and wrote that it found no logging of user activity data[6]. It also flagged that administrators with SSH access can technically tap production VPN traffic. Mullvad said it was implementing command auditing and investigating removing SSH.

Cure53 Staging Server Audit (2024)

Cure53 audited one OpenVPN and one WireGuard staging server between June 3 and June 14, 2024, and found two issues (one low, one medium)[7]. Mullvad marked both resolved in production after a debrief. Cure53 called the security posture of the assessed items “very positive”.

X41 D-Sec App Audit (2024)

X41 D-Sec audited the Mullvad apps on all supported platforms between October 23 and November 28, 2024. It found six vulnerabilities (none critical, three high, two medium, one low)[8], concluded the apps have a high security level, and verified Mullvad’s fixes.

Mullvad publishes these reports, which is uncommon in the VPN industry. Every audit was commissioned by Mullvad, covers a point in time, and none examined production servers, so the reports show what auditors found on the machines they were given, not continuous verification.

Logging Policy: What Mullvad Stores and Doesn’t Store

Data Mullvad Does Not Collect

Mullvad does not log traffic data, connection timestamps, session durations, or IP addresses. It stores no DNS queries, bandwidth usage records, or VPN server assignments. Account activity remains completely unlinked to browsing behavior or connection metadata.

Data Mullvad Does Process

Mullvad processes the total number of simultaneous connections per account (capped at 5). This counter exists in real time and is not written to any persistent storage. The moment you disconnect, that counter decrements. No historical record persists.

Mullvad also processes short-term aggregate server load data for performance optimization. This data contains zero user-identifiable information and rotates automatically.

The Account System

Mullvad generates a random 16-digit account number. No email, no name, no password required. You can pay with cash mailed in an envelope, Bitcoin, or Monero. This design eliminates personally identifiable information from the signup process entirely.

Encryption Standards and Protocols

Mullvad supports two protocols: WireGuard and OpenVPN. Both implementations use strong, well-reviewed cryptographic standards.

WireGuard Implementation

WireGuard uses ChaCha20 for symmetric encryption, Curve25519 for key exchange, and BLAKE2s for hashing. Mullvad defaults to WireGuard on all platforms. Connection handshakes complete in under 100 milliseconds on most networks.

OpenVPN Implementation

OpenVPN connections use AES-256-GCM for data channel encryption. Key exchange relies on RSA-4096 certificates with SHA-512 authentication. Mullvad configures OpenVPN with tls-auth to prevent fingerprinting and DDoS attacks on the VPN tunnel.

Quantum-Resistant Tunnels

Mullvad made post-quantum key exchange available in its desktop app in April 2023[9], layering Classic McEliece and Kyber key encapsulation on top of standard WireGuard cryptography. In January 2025 it made quantum-resistant tunnels the default on desktop[10] and moved from Kyber to NIST’s ML-KEM.

Kill Switch and DNS Leak Protection

Kill Switch Behavior

Mullvad’s kill switch activates by default on all platforms. It blocks all internet traffic when the VPN tunnel drops unexpectedly. The implementation operates at the firewall level, not the application level. This prevents leaks even if the Mullvad app crashes entirely.

On Linux, Mullvad uses nftables rules to enforce traffic blocking. On Windows, it modifies the Windows Filtering Platform. On macOS, it uses packet filter rules. Each implementation prevents both IPv4 and IPv6 leaks simultaneously.

DNS Leak Protection

Mullvad routes all DNS queries through its own encrypted DNS servers. The app blocks system DNS requests that attempt to bypass the tunnel. Mullvad operates DNS servers on every VPN server location, resolving queries locally without forwarding to third parties.

Users can also configure custom DNS within the app. Even with custom DNS, queries still travel inside the encrypted tunnel. Independent leak tests consistently show zero DNS, WebRTC, or IPv6 leaks across all Mullvad clients.

Past Security Incidents

Police Raid (April 2023)

At least six officers from the National Operations Department of the Swedish Police visited Mullvad’s Gothenburg office with a search warrant seeking computers with customer data. Mullvad says it stores no such data and argued any seizure would be illegal under Swedish law. After a demonstration and a consultation with the prosecutor, the officers left without taking anything. A follow-up post[11] says the Swedish Prosecution Authority described the warrant as a decision made in international legal cooperation with Germany.

No Known Data Breaches

We found no data breach reported by Mullvad. Because accounts use a random 16-digit number rather than an email address and password, there are no email and password pairs to leak or credential-stuff. That design limits the attack surface, although it cannot rule out a breach in the future.

Vulnerability Disclosures

Mullvad accepts vulnerability reports and writes up audit findings and its fixes on its blog[1].

Unique Security Features

DAITA (Defense Against AI-Guided Traffic Analysis)

Mullvad developed DAITA to counter traffic analysis attacks. This feature pads packets to uniform sizes and injects decoy traffic patterns. It prevents adversaries from identifying which websites users visit based on traffic fingerprints.

Encrypted DNS Over HTTPS (DoH)

Mullvad offers a public DoH service at dns.mullvad.net. Users can encrypt DNS queries even without the VPN running. The service includes optional ad-blocking and tracker-blocking DNS profiles.

Diskless RAM-Only Servers

Mullvad says it has completed its migration to RAM-only VPN infrastructure[12], so its VPN servers run without persistent storage and a reboot wipes what was in memory. Mullvad has said WireGuard keys are the exception: they are kept across controlled reboots. Even so, a seized server holds far less than a disk-based one would.

Multihop Routing

Users can route traffic through 2 separate VPN servers in different countries. This adds a second encryption layer and separates the entry point from the exit point. Multihop is configurable directly within the app without manual setup.

The Bottom Line on Mullvad’s Security

Mullvad earns its 83/100 trust score through architecture, not promises. RAM-only servers, account anonymity, published audit reports, and a no-logs design that Mullvad says held up when police visited set it apart. The €5/month flat rate with no trials or discounts reflects a company focused on service rather than subscriber volume. For users who prioritize privacy verification over feature count, Mullvad remains one of the strongest options available across its server network.

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• Is Mullvad Safe? Security, Privacy & Audit AnalysisPDF · 0.7 MB

Fastest VPNs ComparedTrust Score

#1Mullvad VPN550+ servers

83 out of 100, built from two weighted parts

Trust & Value30% of the score23/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.144.06

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 29 · Independent sources: 9 · Scores updated Nov 2, 2026

Read review

#2NordVPN7,213 servers

NordVPN's privacy and security record is strong on process and mixed on proof

93 out of 100, built from two weighted parts

Trust & Value30% of the score27/30

VPN Performance70% of the score66/70

App store ratings, part of the score

4.664.59

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 31 · Independent sources: 11 · Scores updated Nov 2, 2026

Read review

#3ExpressVPN3,000+ servers

86 out of 100, built from two weighted parts

Trust & Value30% of the score26/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.684.69

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 27 · Independent sources: 13 · Scores updated Nov 2, 2026

Read review

How Mullvad Ranks for Speed

Mullvad VPN

Speed test results

83 out of 100, built from two weighted parts

Trust & Value30% of the score23/30

VPN Performance70% of the score60/70

App store ratings, part of the score

4.144.06

How we scoreRead the research

Researched Oct 3, 2026 · Claims checked: 29 · Independent sources: 9 · Scores updated Nov 2, 2026

Trust Score rank #7 / 22 550+ servers 50+ countries 14-day money-back guarantee

Visit Mullvad VPN Read our review

Mullvad ranks #7 of 22 on our Trust Score, which aggregates published results from third-party tests rather than our own bench. That places it below the top five and above most of the field.

We do not run speed tests ourselves. Any throughput number you see attached to a VPN on this site comes from a published third-party test, and none of them publish figures for your specific line, your ISP, or the server you happen to pick. Treat a rank as a sorting signal, not a promise about your connection.

Protocol Choice Matters More Than the Rank

Mullvad supports WireGuard and OpenVPN in both UDP and TCP modes. There is no native IKEv2.

WireGuard is the default and the one to stay on. It uses a smaller codebase, less CPU per encrypted packet, and reconnects faster after a network change.

OpenVPN (UDP) is the fallback. It carries more per-packet overhead than WireGuard and works harder on the same hardware, so it will generally feel slower on a fast line.

OpenVPN (TCP) is the last resort. TCP inside a TCP tunnel handles retransmissions twice, which makes it the slowest and the most sensitive to a lossy network. Use it only when UDP is blocked.

If a page loads slowly on Mullvad, check the protocol before anything else. That one setting explains most complaints.

What Actually Shapes Your Speed

Server distance. Encryption costs the same everywhere, but distance costs latency you cannot get back. A nearby server will beat a cross-continent one on every connection type.

Your baseline. A VPN cannot exceed the line underneath it. On a slower cable or DSL connection, the overhead is a smaller share of what you already had, so the difference between a #1-ranked provider and a #7 one narrows.

Shared networks. Public WiFi and congested cellular are variable by nature. Encrypted tunnels do not cause that variance, but they do inherit it.

Streaming, Gaming, and Torrenting

For streaming, the number that matters is the sustained rate your service needs, not peak throughput. 4K generally wants around 25 Mbps held steady. Mullvad runs no dedicated streaming servers, so if a service gives you trouble, switching servers within the same country is the lever you have.

For gaming, latency and jitter decide how the game feels, not download speed. Pick the closest server to the game region and stay on WireGuard, since OpenVPN adds handshake and per-packet overhead that shows up as inconsistency.

For torrenting, Mullvad allows P2P across its servers with no speed caps or bandwidth limits on any plan. Check the current port forwarding position in Mullvad’s own documentation before you commit, since that has changed over time and it matters for seeding.

Why Your Mullvad Connection Might Be Slow

Wrong protocol. Switch to WireGuard in the app settings. This fixes most “Mullvad is slow” reports.

Distant server. Pick the nearest location unless you need a specific country.

ISP throttling. Some networks throttle or block common VPN ports. Mullvad’s bridge mode, or moving to port 443, gets around basic filtering. Measure your line without the VPN first so you know what you are comparing against.

Outdated app. Mullvad ships performance and protocol fixes regularly. Update from the official site rather than an app store mirror.

Congestion. Popular servers slow down in local evening hours. Try another server in the same country.

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• Mullvad Speed Test Results, Aggregated From Published Third-Party TestsPDF · 0.7 MB