Should you trust your VPN?

The best way to determine if a VPN is worthy of your trust is how transparent it is about how it handles your data. Look for blogs that explain their practices and third-party audit reports that verify the reliability of the provider.

VPNs love to claim that they keep users’ data private and their browsing anonymous. However, because of the way VPNs work, you’re taking them at their word on most of this, which means you’re trusting them to keep you safe. Should you, however?

It is not an easy question to answer. There are VPNs that should not be trusted for various reasons, and there are also some that are probably safe to use. After all, we have a selection of the best VPNs that we recommend to our readers; we wouldn’t do that if we felt there were no reliable VPNs.

Why do you need to trust your VPN?

Let’s take a look at why the question is important, first. We use virtual private networks to hide what we do online and fake our location. The reason we hide our online activity may simply be to avoid scrutiny from vendors, or because we are torrenting files or trying to avoid surveillance by authoritarian governments.

However, while you may be hiding from Big Brother, the VPN also has the potential to hold a lot of information about you. For example, most of them will have your email address, and if you paid with a credit card, they will likely have your name and home address as well; that’s why we recommend registering anonymously.

On top of that, VPN providers could also know what you were doing online the entire time you were connected, negating much of the VPN’s usefulness altogether. To prevent this from happening, VPNs promise that they are no-log VPNs, services that destroy any records of your online activity. After all, if there is no registration, there is nothing to sell to sellers or give to the authorities.

However, it is very difficult to prove that logs are destroyed, which means that the claims VPNs make to protect your anonymity are taken on faith. Fortunately, there are a few things you can do to make sure a VPN is worth trusting.

history matters

Just like with people, an important way to predict the future behavior of a VPN provider is to look at their past actions. After all, if he loaned his friend Bob $20 two months ago and never paid it back, he probably wouldn’t lend him another $20 if he asked for it again.

So, if you like a certain provider, but aren’t sure, we recommend doing some research to examine their past. For example, if you were thinking of signing up for Hola VPN, but searched for the term first, you’d quickly come face to face with a litany of reports about the company’s past woes; the CNET report is the most comprehensive.

In short, Hola VPN works by allowing users to use each other’s bandwidth, allowing you to use someone else’s computer to access the Internet from your location. However, due to its poor security, it was easy for botnet operators to run amok, hijack users’ Internet connections, and even enslave users’ computers in their botnets.

Another example is PureVPN, which a few years ago helped the FBI catch a cyber stalker. There’s no question that the person in question was deeply unpleasant, but it still worried many PureVPN customers that the company would have so readily cooperated with law enforcement, or had any information to hand over in the first place.

PureVPN defended its actions by noting that it has an anti-cyberbullying policy as well as a no-logs policy. Also, PureVPN threads the needle a bit by saying that the logs it shared with the police were not browsing logs, but connection logs. It seems like a very fine distinction, and we gave PureVPN a rather bad review in our review.

Does the location of your VPN matter?

Another factor you can consider is where your VPN is based. If VPN marketing materials are to be believed, being based in Switzerland, the British Virgin Islands, Panama, or anywhere else is almost a guarantee that your data will be safe.

In practice, however, it is not so clear. Naturally, a China-based VPN is likely not to be too reliable, as the internet is restricted there. Other than that though, the location doesn’t matter too much. As long as your VPN destroys your data, you should be safe. So the question is, how do you know that your VPN actually does that?

A look into the kitchen

However, probably the most important factor to consider when choosing a VPN is whether or not it is open about its operations. To that end, many VPNs will now allow auditors to be released from their operations for a while, after which a report will be released providing a recommendation for consumers.

It’s a pretty good system, although it does come with a few problems. Some auditors have stellar reputations (for example, Cure53, a nonprofit foundation), while others, like major accounting firms, don’t. Allegations of corruption surrounding the Big Four accounting firms abound, and as such, it is important to know who conducted the audit and draw your own conclusions from there.

Better yet are VPNs that will tell you how your system works. A good example here is ExpressVPN, which in a detailed blog post explained how its TrustedServer technology worked; we say “it worked” because the original post has been removed, although you can still read our discussion of TrustedServer.

VPN transparency

The best solution of all is if a service is completely transparent. This is the sales pitch for decentralized VPNs, which promise to use blockchain technology to give users insight into how their VPNs work. That being said, so far none of them have made it, and there’s no indication when they will.

Interestingly, there are also VPNs that are very honest about what they can and cannot do. A good example is IVPN, which on its website explains what VPNs are designed for and when it is not necessary to hire one. Although it can hurt the company’s bottom line, his honesty is refreshing and inspires confidence.

The most promising development of all, however, may be what is called a user-audited VPN. The service that coined the phrase is Mullvad, a Sweden-based VPN with a strong reputation and track record for privacy. Read our Mullvad review to find out more.

According to a blog post, the goal is to eventually set up Mullvad on a system where any user at any time can see how it works. Of course, you won’t be able to see what anyone else using the VPN is doing, but you could track what happens to your data.

Should you trust your VPN?

If trust is the goal, it is likely that Mullvad’s transparency effort will soon become the gold standard. It would mean that we no longer have to take VPNs at their word, we wouldn’t even need to trust the auditors and the credibility issues some of them have. In this way, you could take trust out of the equation altogether: you could verify for yourself whether a service is treating your data with the respect it deserves.

That kind of transparency makes it easier to trust a VPN and should make choosing the right one a lot easier.