Privacy & VPNs
Most "private" VPNs are mainstream ad-driven businesses with a privacy label. A few are actually built for it.
We researched ownership structure, independent audits, and real controversies for five well-known providers, plus two genuinely privacy-first alternatives. The split doesn't track affiliate payout — the providers most worth recommending on principle pay us the least, or nothing at all, and we think that's worth telling you rather than hiding.
No email required to sign up, cash/Monero accepted as first-class payment, and — tellingly — both refuse affiliate marketing on principle.
No email or identity required — you get a 16-digit account number instead. Accepts cash by mail, Bitcoin, Bitcoin Cash, and Monero. Repeatedly audited by Cure53 with no critical findings. Widely regarded as the industry's privacy benchmark.
Worth knowing: Sweden is a member of the "14 Eyes" surveillance-sharing alliance — the one real jurisdictional caveat here — though Mullvad's no-identity account system means there's structurally very little for authorities to compel disclosure of, even under legal order.
Visit Mullvad →Same no-email, account-number signup model as Mullvad. Cure53-audited annually since 2019, fully open-source clients. Accepts cash by mail, Bitcoin, and Monero.
Worth knowing: IVPN used to run an affiliate program and shut it down entirely in 2024 after finding under 5% of affiliates were complying with disclosure requirements — they'd rather have no affiliate revenue than tolerate undisclosed paid promotion. That's the kind of decision we think is worth rewarding with a recommendation, not penalizing for the lack of a commission.
Visit IVPN →Independently audited by Securitum four years running (2022–2025). Swiss jurisdiction, outside the major surveillance-sharing alliances. Accepts cash by mail alongside cards and Bitcoin — rare among mainstream providers.
Worth knowing: Proton Mail (a related product, not the VPN itself) has twice disclosed user-identifying metadata under legal compulsion — once to Swiss authorities in a 2021 criminal case, once assisting Spanish police in 2024. Neither incident involved the VPN's core connection logs, and Proton VPN's own no-logs claims remain independently audited and unchallenged — but it's relevant context about the parent organization.
Visit Proton VPN →Technically competent, heavily marketed, and the highest-paying affiliate programs in the category — which is worth being skeptical of on a site like this one.
| Provider | Jurisdiction | Ownership note | Last audit | |
|---|---|---|---|---|
| NordVPN | Panama | Same parent (Nord Security) as Surfshark despite marketing as competitors | Deloitte, Feb 2026 | Visit → |
| Surfshark | Netherlands (9 Eyes) | Same parent (Nord Security) as NordVPN since 2022 merger | Deloitte, 2025 | Visit → |
| ExpressVPN See note | British Virgin Islands | Owned by Kape Technologies (formerly Crossrider, an adware distributor); CIO previously built UAE state surveillance tools | KPMG, Feb 2025 | Visit → |
ExpressVPN's CIO, Daniel Gericke, previously worked on the UAE's "Project Raven" — a 2016–2019 state hacking program that built zero-click phone exploits used against journalists, activists, and dissidents. Gericke and two co-defendants reached a Justice Department deferred prosecution agreement and paid a combined $1.6 million fine. ExpressVPN has said it hired him knowing this history, which drew public criticism, including from Edward Snowden. This is a direct thematic conflict for a site built around freedom from surveillance to gloss over — ExpressVPN's technical audits are genuine, but that's a separate question from who's running the company.