How to Compare VPN Providers: A Privacy and Transparency Scorecard

Search for a VPN and you will find endless "best of" lists and head-to-head comparisons. Most of them rank providers by criteria the author chose, often with links that pay a commission. That does not make them useless, but it does mean the ranking reflects someone else's priorities, not yours. A better approach is a short scorecard that you fill in yourself, using the same questions for every provider.

This article gives you that scorecard, focused on privacy and transparency, the two areas where marketing pages are loudest and evidence is hardest to find. It names no brands, because the method works for any provider, including one that does not exist yet. Pair it with how to test a VPN, which covers the technical checks you run on your own device.

Why a scorecard beats a ranking

A ranking collapses many questions into one number, and you cannot see what was traded off. A scorecard keeps the questions visible. Two providers might tie on total points while one is strong on transparency and weak on apps, and the other is the opposite. Which is better depends on what you need.

The scorecard also protects you from persuasive wording. If a page says "military-grade" or "total privacy", you have nothing to score. If a page publishes the company name, the registered country, the data it collects and a dated audit report, you can score every one of those. Evidence is scorable; adjectives are not.

Set up the scorecard

Keep it simple so you actually finish it.

1. Pick two or three providers to compare. More than that and you will stop checking carefully.
2. Use the same categories for each one (listed in the sections below).
3. Score each item 0, 1 or 2. Zero means no evidence or a bad answer. One means a partial answer. Two means a clear, checkable answer.
4. Give each category a weight from 1 to 3 based on how much it matters to you. A traveller using public Wi-Fi might weight security basics and apps highest; someone worried about records might weight policy and ownership highest.
5. Record the source for each score: the page, the document and the date you read it. Policies change, and you will want to know what you saw.

Total the weighted scores at the end, but read the individual rows first. A zero in a category you care about matters more than a high total.

Ownership and transparency

Start with who is behind the service. A VPN provider sees your connection metadata, so you are trusting a company.

• Is the company named? Look for a legal entity name, a registered address and a way to contact a real department.
• Is the country of operation stated? Different countries have different laws about data requests and retention. You do not need to be an expert, but a provider that hides where it is based gives you nothing to evaluate.
• Are the people identifiable? Named leadership or a published team is a small positive. Anonymous operation is not automatically bad, but it removes accountability.
• Is there a transparency report? Some providers publish how many legal requests they receive and how they respond. A report is evidence; its absence is neutral; a refusal to say anything about requests is worth noting.
• Is the business model clear? If the service is cheap or free, ask how it earns money. If the answer is "advertising" or "data", that matters.

Score each of these 0 to 2, and write the source next to the score.

Privacy policy: read what is actually collected

Few people read privacy policies, which is exactly why reading one gives you an advantage. Look for plain answers to these questions:

• What data is collected when you create an account (email, payment details, device identifiers)?
• What is collected while you use the service (connection times, amount of data, IP address used to connect)?
• How long is each kind of data kept?
• Who receives it: payment processors, analytics companies, advertising partners?
• What happens to the data after your account ends?
• What does the provider say about responding to legal requests?

Be careful with strong claims. Phrases like "we keep no records" are marketing unless the policy defines what is and is not recorded, for how long, and what is stored for billing or abuse prevention. A precise policy that admits to keeping something, with reasons and time limits, can be more trustworthy than a sweeping promise. Score precision and plain language higher than confident slogans.

Also check how the policy handles the website and the apps separately. Many companies describe the website tracking (cookies, analytics) in one document and the service itself in another. Read both.

Audits and open source: what they do and do not prove

Two terms appear often on provider websites. Both are useful, and both are easy to misread.

Independent audits. A security or privacy audit is an outside review of defined systems or claims at a specific time. When you see a mention of audits, ask:

• Is the full report public, or only a summary?
• Who performed it, and is that organisation independent of the provider?
• What was the scope: the apps, the servers, the policy, the infrastructure?
• When was it done, and has the provider acted on the findings?

A recent public report with a clear scope is strong evidence. An old audit of one component, or a press release with no report, is weak. Audits never guarantee future behaviour.

Open source. If a provider publishes the code of its apps, outside experts can read it and report problems. That is a real transparency benefit. Check whether the code is current, whether the repository is actively maintained, and whether builds are reproducible. Remember that open source does not prove the app in the store matches the published code, and it says nothing about the servers. The protocol projects themselves, such as WireGuard and OpenVPN, are open and widely reviewed, which is good to know but is not the same as the provider's own code being open.

Give points for evidence you can follow, not for the words "audited" or "open source" alone.

Security basics you can check

You do not need to be an engineer to check the basics. Cloudflare's explanation of a VPN helps with the vocabulary. Look for:

• Named, current connection methods. Does the provider say which protocols it supports, in plain language, and does it use well-reviewed ones?
• Leak protection. Does the documentation describe how DNS and IPv6 traffic are handled?
• A kill switch or equivalent, and a clear description of when it applies.
• Account security. Can you use a strong, unique password and two-step sign-in where offered?
• A security contact or disclosure policy. A way to report problems responsibly shows maturity.
• Update history. Apps that are updated regularly are a better sign than apps left alone for years.

Then confirm the claims yourself with the leak and kill switch tests in the testing guide. A provider's documentation tells you what it intends; your test tells you what happens.

Apps, permissions and platform support

The app is the part of the service you install, so inspect it:

• Which platforms are supported, and are all of them maintained to the same standard?
• What permissions does each app request? A VPN app needs network access and permission to set up a VPN connection. Requests for contacts, microphone or precise location are red flags.
• Does the app contain advertising or third-party analytics? Check the store's data-safety information.
• Are there clear instructions for setting it up, and is there a manual option for devices without a native app?
• Is there a way to remove your account and data?

Score each item from what you can observe, not what the page promises.

Billing, terms and cancellation

Privacy includes how the company treats you as a customer.

• Is the price clear? Look for the full cost, the length of the term and any extra fees, before you enter payment details.
• How does renewal work? Some plans renew automatically at a different price. Others are prepaid for a fixed period and simply end. Why choose a VPN without auto-renewal explains the trade-off.
• Is the refund policy written and specific? Look for the time window, the conditions and how to request it.
• What payment methods and data are required? The less personal information needed to buy, the lower the exposure, though a payment processor will still hold some details.
• Are the terms of service readable? Terms that allow broad changes without notice, or restrict your rights heavily, deserve a lower score.

For broader pre-purchase checks, what to check before paying for a VPN is a useful companion, and common VPN buying mistakes shows what trips people up.

A worked example with two imaginary providers

Suppose you compare Provider A and Provider B, both fictional. You weight ownership 3, policy 3, audits and open source 2, security basics 2, apps 2 and billing 1.

Category	Weight	Provider A (0-2)	Provider B (0-2)
Ownership and transparency	3	2	1
Privacy policy detail	3	1	2
Audits and open source	2	0	2
Security basics	2	2	1
Apps and permissions	2	2	1
Billing and terms	1	2	1

Weighted totals: Provider A scores 3x2 + 3x1 + 2x0 + 2x2 + 2x2 + 1x2 = 19. Provider B scores 3x1 + 3x2 + 2x2 + 2x1 + 2x1 + 1x1 = 18. They are almost level, but the rows tell a story. Provider A is well run and names its company, but has no audit and a vague policy. Provider B has a detailed policy and a public audit, but less clear ownership. If your priority is documented privacy practice, B may suit you better despite the lower total. If you want clear accountability and good apps, A may suit you. The point is that you can see why, and you can change the weights.

Add your own test results: how each one performed in your leak and speed checks, on your actual networks.

Red flags and the limits of any scorecard

Some patterns should lower a score quickly:

• Guarantees such as "100% anonymous", "unhackable" or "works everywhere".
• No named company, address or contact.
• A privacy policy that is missing, copied, or impossible to find.
• A free service with no explanation of how it pays for itself.
• Pressure tactics: countdown timers, "last chance" banners, pricing that changes on every visit.
• Reviews on the provider's own site that cannot be verified.
• Apps that ask for permissions unrelated to a VPN.

And remember what the exercise cannot do:

• A scorecard measures evidence you can see. It cannot see inside the company or guarantee future behaviour.
• A VPN does not make you anonymous, whichever provider you choose. Can you be tracked with a VPN explains what still follows you.
• Policies and prices change. Re-check before you renew and keep your notes.

Summary

Compare VPN providers with a scorecard you control: ownership and transparency, privacy policy detail, audits and open source, security basics, apps and permissions, and billing terms. Score evidence rather than slogans, weight the categories that matter to you, record your sources and add your own leak and speed tests. A transparent provider with documented limits is a better sign than a confident promise.

If a short, prepaid period with no automatic renewal suits how you want to use a VPN, a prepaid XPASS pass is one way to try it.