Speed tests are easy to game. Security and privacy properties are structural: they derive from where a company is registered, what protocols it supports, and whether an independent auditor has verified the claims.
We weight encryption and jurisdiction at 55% because those factors are the hardest to fake and the most consequential if wrong.
Cipher strength, protocol suite, kill switch, DNS-leak & WebRTC protection, obfuscation capability
Privacy & Jurisdiction
25%
Country of registration, data-retention law, Eyes membership, no-logs policy, independent audit status
Download and upload throughput measured across 15+ server locations vs unprotected baseline
Connection drop rate, reconnect behaviour, kill-switch reliability under network transitions
Simultaneous connection limit, OS coverage, UI quality, feature parity across platforms
Long-term plan price, free tier availability, refund window, per-device cost