Tools · Chapter 6
How to Judge a VPN
The seven factors that actually matter, each with its corresponding red flag.
| Factor | What to look for | Red flags |
|---|---|---|
| No-logs policy | Independently audited, verified by real legal incidents (warrant canaries, court cases) | Self-claimed only, no audit, based in Five Eyes without challenging requests |
| Jurisdiction | Outside 14 Eyes intelligence sharing agreement; countries with strong privacy law | USA, UK, Canada, Australia, New Zealand, most EU (varies) |
| Open source client | Auditable code you can verify | Closed source with no audit |
| Business model | Paid subscription — your money is the product | Free VPN — your data is the product |
| Protocol | WireGuard (fast, modern, audited) or OpenVPN | Proprietary protocols, PPTP (broken) |
| Track record | Has resisted law enforcement requests; has been audited | Has provided user data to authorities; data breaches |
| Ownership | Known entity with clear accountability | Opaque ownership, shell company structure |
Reproduced verbatim from The Privacy Diet, Chapter 6 — “Choosing a VPN: What Actually Matters”. The book explains the reasoning behind each verdict.