Security + Privacy = 55% of the total.
Cipher strength, protocol suite, kill switch, DNS-leak & WebRTC protection, obfuscation capability
Privacy & Jurisdiction
25%
Country of registration, data-retention law, Eyes membership, no-logs policy, independent audit status
Download and upload throughput measured across 15+ server locations vs unprotected baseline
Connection drop rate, reconnect behaviour, kill-switch reliability under network transitions
Simultaneous connection limit, OS coverage, UI quality, feature parity across platforms
Long-term plan price, free tier availability, refund window, per-device cost