VPN Atlas evaluates VPNs on verifiable facts, not opinion or untested benchmarks. We score four trust criteria — independent no-logs/infrastructure audit status (with the report linked), jurisdiction, ownership group, and open-source posture — then apply a per-use-case decision framework. We have not run our own speed tests, so we publish no speed, ping or unblocking numbers; we say so plainly rather than invent figures.
Why a methodology page, and why this one is different
Most VPN "best of" lists rank providers on speed scores and unblocking claims that readers cannot reproduce and that change weekly. We take the opposite approach: we publish the exact criteria we use, restrict ourselves to facts a reader can independently verify, and refuse to fabricate the numbers we have not measured. This page is the standard every VPN Atlas review, comparison and use-case guide is held to.
The reason is honesty and durability. A speed figure from an untested lab is stale the day after it is published; a jurisdiction, an ownership group, or a linked audit report is checkable today and still checkable next year. By grounding every assessment in those facts — and disclosing what we have not done — we make our conclusions auditable. If you can check our sources, you do not have to trust us.
The four trust criteria we score
Every provider on VPN Atlas is assessed against four verifiable criteria, each tied to a source the reader can open. We weight these over marketing claims because they are the facts a provider cannot quietly restate.
- Independent audit status — has the no-logs policy and/or infrastructure been audited by a named third party, and can you read the report? Examples we have verified: NordVPN (six assurance engagements, most recently Deloitte, December 2025), ExpressVPN (KPMG, Cure53, PwC), Surfshark (no-logs 2023/2025 plus a SecuRing infrastructure audit, January 2026), Proton VPN (consecutive annual audits), Mullvad (repeated open-source audits). An audit is point-in-time, so we record its date and scope.
- Jurisdiction — where the operating company is based, and whether that jurisdiction has mandatory data retention or sits inside the 5/9/14 Eyes alliances. Panama, Switzerland and the BVI sit outside retention regimes; the US (PIA), the Netherlands (Surfshark) and EU states warrant more thought.
- Ownership — who ultimately owns the brand, because several major VPNs share a parent. Kape Technologies owns ExpressVPN, CyberGhost and Private Internet Access; NordVPN and Surfshark share the Nord Security group; Proton VPN's majority owner is the non-profit Proton Foundation; Mullvad is founder-owned (Amagicom AB).
- Open-source posture — whether the apps are open-source so independent researchers can inspect what the client actually does. Proton VPN and Mullvad ship open-source apps; PIA's clients are open-source.
The per-use-case decision framework
The "best VPN" question has no single answer because the right choice depends on the job. Rather than crown one winner, we apply use-case-specific criteria on top of the four trust facts. This is where broad listicles are too generic to help and where we aim to be most useful.
- Streaming — no VPN can guarantee access to any platform; the deciding criteria are server breadth, app support on your viewing device, and a money-back window to test the exact service. We publish no unblocking claims.
- Gaming — a VPN adds a hop and usually does not lower ping; we judge it on server coverage in your regions and DDoS-masking, not speed.
- Privacy — we weight audited no-logs, no-retention jurisdiction, open-source code and clean ownership most heavily here, and we include Mullvad despite earning nothing from it.
- Torrenting — permitted P2P, audited no-logs, a kill switch, and (for some) port forwarding; legality is the reader's responsibility.
- Travel — security on untrusted Wi-Fi, broad app support across devices, and awareness that VPN legality varies by country.
- Business — we distinguish consumer VPNs (individual protection) from business/zero-trust products, and say plainly when a consumer VPN is the wrong tool.
What we have NOT tested — stated plainly
We have not run our own hands-on speed, latency or streaming-unblocking tests. That is a deliberate, disclosed limitation: rather than publish lab numbers we cannot stand behind, we leave those fields blank and point you to test within the provider's money-back window on your own connection and devices. Anyone claiming a precise speed for your location and time of day is guessing — real speed depends on distance to server, protocol and network conditions.
We also leave pricing, money-back windows and "best for" framing null until verified against the vendor's current public page, because they change constantly. And we do not run an affiliate program yet, so nothing on this site is monetised today; where a listing would later be monetised, we disclose it. A provider is never ranked higher for paying us — Mullvad, which pays nothing, sits among our top privacy references for exactly that reason.
Frequently asked questions
How does VPN Atlas rank VPNs?
We score four verifiable trust criteria — independent audit status (with the report linked), jurisdiction, ownership group, and open-source posture — then apply a per-use-case decision framework (streaming, gaming, privacy, torrenting, travel, business). We do not rank on speed scores or unblocking claims we have not tested, and we never rank a provider higher for paying a commission.
Why don't you publish VPN speed test results?
Because we have not run our own speed tests, and we will not publish numbers we cannot stand behind. Real-world speed depends on your distance to the server, the protocol and network conditions, so a single lab figure is not reproducible for your situation. We tell you to test within the provider's money-back window instead — and we say plainly that this is something we have not done.
Do you earn commission, and does it affect your assessments?
We have not joined any affiliate program yet, so nothing on the site is monetised today; if that changes, we will disclose it on every page. A provider is never ranked higher for paying us. The clearest proof is Mullvad, which runs no affiliate program and earns us nothing, yet sits among our top privacy references because the facts put it there.
How do you keep the facts current?
We tie every audit, jurisdiction and ownership claim to a source you can open, record the date and scope of each audit (since audits are point-in-time), and re-check on each dated content-review pass. Pricing and feature fields are left null until verified against the vendor's current page, because they change constantly.
Sources & further reading
An independent publisher comparing VPN services. Our editorial desk verifies every claim against primary sources — the provider's own documentation and the actual audit report — and never accepts payment for a better assessment.