Start with the business model
A free VPN may be funded by a premium version, an organisation, donations, advertising or other activities. Clearly identify which applies. A vague policy on data monetisation is a signal to investigate, not automatic proof of misconduct.
For a paid VPN, review the total amount, duration, renewal, refund and any preselected options. A large advertised discount without a clear renewal price makes comparison difficult.
Sources and references
Read what data is actually processed
Distinguish activity logs, such as sites and DNS queries, from operational data needed for the account, payments, devices and abuse prevention. Look for retention periods and service providers.
A “no-log” claim does not carry the same weight as an independent audit whose scope, date and report are accessible. The absence of an audit does not prove there is a problem, but it should be described honestly.
Check scope and protocols
A product may offer a system app on one platform and only an extension on another. Check DNS, IPv6, the kill switch, updates and exceptions.
Be wary of feature lists without documentation. Names such as AES-256, WireGuard or “military-grade” do not by themselves explain authentication, key management or behaviour during a failure.
Compare the service with your needs
The number of locations only matters if their inventory, availability and nature fit your use case. Streaming, P2P, gaming and remote work have different constraints.
Also check the systems you actually use, the device limit and the availability of the official link. Do not pay for an advertised platform that you cannot install in your situation.
A straightforward decision checklist
- Identifiable company and verifiable contact details.
- Precise, dated data policy.
- Apps suited to your platforms.
- Documented protocols and leak behaviour.
- Visible total price, duration and renewal terms.
- Support with a real contact method.
- Audits presented with their exact scope, where they exist.