# Comparison scores

This page is the complete scoring record behind the [comparison map](/docs/comparison): every product's sub-scores on both axes, the anchor ladders they were assigned against, the reasoning behind each number, and the three disclosed rescores. Every coordinate recomputes from these integers and the weights on the [methodology page](/docs/comparison-methodology); nothing is rounded into place. It is an appendix, and it is long on purpose.

Sources are named the same way throughout. The **compare page** is the
published head-to-head (`/docs/compare-<product>`). The **dossier** is that
product's fact-check file in the documentation repository
(`review/misinfo/<PRODUCT>.md`), which records both what is verified and
which phrasings the evidence does not support. The **location study** is
`review/location-truth.md`, built on IPinfo's December 2025 measurement (roughly
150,000 exit IPs across 20 commercial providers) and on vendors' own
virtual-location disclosures. The **verified reports** are
`review/verified/`, a line-by-line check of URnetwork's claims against its
own source code, quoted here against URnetwork's interest where it cuts
that way. Scores the evidence does not settle are marked **judgement**;
those are the ones to challenge first.

Two blanket notes. Every L and T score is a structural class judgement,
because the corpus permits no invented latency or throughput figures for
any product. And every standard single-company tunnel scores E 3, the
bottom of the 3–4 band, since the band's top was reserved for single-party
designs with partial structural blinding, and none qualified.

## The disclosed rescores

No weight or anchor has changed since the rubric was frozen on 2026-08-07,
and no sub-score has changed except in the three records below. Each was
re-derived from the unchanged frozen ladders, not adjusted; the dated
ledger with each change's direction is on the
[methodology page](/docs/comparison-methodology), and the full reasoning
sits in each product's entry on this page.

1. **Apple Private Relay, rescored 2026-08-07 after independent peer
   review.** The evidence base had misdescribed Apple's architecture as a
   split "held by contract rather than encryption"; Apple's own overview
   describes the split of views as enforced by layered encryption, with
   only the operators' non-collusion contractual. E 5→7, S 6→7,
   X 4.25→5.10, which moves Apple from the Legacy quadrant to the X line
   itself. The error had run in URnetwork's favour.
2. **URnetwork, rescored 2026-08-07 when the product owner ruled its
   sealed session on by default at launch.** The ruling ended the opt-in
   premise three of its four X parts were scored against. E 7→8, PQ 5→7,
   S re-derived and unchanged at 8, V untouched at 6; X 6.85→7.30. This is
   the one rescore that moves URnetwork's own dot, and it is flagged as
   in URnetwork's favour.
3. **Obscura, scored and added 2026-08-07** as the twenty-first compared
   product, entering under selection bar (d) of the comparator rule as the
   closest architectural competitor. It lands at (6.60, 5.10); no other
   product's sub-score was touched, and every rank interval was recomputed
   over the 22-product field the same day on the
   [sensitivity page](/docs/comparison-sensitivity).

Two further corrections were processed the same day and moved nothing,
which is recorded because both cut in the scorer's favour: a stale
"sign-up IP retained raw 180 days" penalty was removed from URnetwork's S
reasoning after verification against current server source, and the
corpus's "URnetwork has no independent audit" claim was corrected when two
third-party assessments came to light. Both scores were re-derived from
the ladders and held (S 8, V 6); the re-derivations are in URnetwork's
entry below.

## The scale and the anchor ladders

Sub-scores are integers, 0–10, assigned against the ladders below. The
ladders were frozen on 2026-08-07, before any product was scored; the
frozen text sits in the repository at `review/index/METHOD.md`, and the
calibration that spans all nine parts is on the
[methodology page](/docs/comparison-methodology). An integer that falls
between two rungs means the product sits between those classes.

**E: end-to-end encryption through the service**

| Score | Meaning |
|---|---|
| 0–1 | Traffic readable by the operator, or an unaudited closed stack monetizing the free tier; the proxy class. |
| 3–4 | Standard single-party tunnel: strong on the wire, but the operator terminates it and can see destinations. |
| 5–6 | Two-party split held by contract (closed, unverifiable), or partial structural blinding. |
| 7–8 | Structural operator-blindness available, but conditional or opt-in. |
| 9–10 | Layered encryption through independent parties, on by default; the onion and mixnet class. |

**S: separation of identity from activity**

| Score | Meaning |
|---|---|
| 0–1 | One party sees identity and activity together, and collects or monetizes the identity data. |
| 2–3 | One party sees both; an identifying account is required. |
| 4–5 | One party still sees both, but strong anonymous-account and payment options minimize what identity exists. |
| 6–8 | Two-party separation with caveats (contractual only, or one leg conditional) plus anonymous accounts. |
| 9–10 | Multi-party separation by construction, on by default, no identifying account at all. |

**V: "no logs" verifiable rather than promised**

| Score | Meaning |
|---|---|
| 0–1 | Caught logging, or the policy itself admits collection; closed source, no audit. |
| 2–3 | A bare promise; closed source. |
| 4–5 | Point-in-time audits; closed source. |
| 6–7 | Open-source clients plus audits or court evidence, with real gaps. |
| 8–9 | Open source plus repeated audits plus court, raid, or measurement evidence. |
| 10 | Fully open, with decades of independent scrutiny. |

**PQ: post-quantum encryption**

| Score | Meaning |
|---|---|
| 0 | None found in the evidence base. |
| 2 | Upstream work in progress. |
| 4–5 | Opt-in, or shipped on part of the platform set. |
| 7–8 | On by default on the flagship protocol. |
| 9–10 | Default everywhere; first mover. |

**L: latency**

| Score | Meaning |
|---|---|
| 1–2 | Long relay chains or cover traffic by design. |
| 4–5 | Bounded multi-hop, or variable residential paths. |
| 6–7 | Single-hop datacenter. |
| 8–9 | Anycast/edge terminating near the user, or direct peer-to-peer. |

**T: speed / throughput**

| Score | Meaning |
|---|---|
| 1–2 | Chain and mixnet class. |
| 4–5 | Residential-bounded egress. |
| 6–8 | Datacenter 10 Gbps-class single hop. |
| 9 | Direct peer-to-peer at line rate. |

**Eg: egress quality**

| Score | Meaning |
|---|---|
| 1–2 | Exits widely blocklisted or CAPTCHA-walled, or no exit choice at all. |
| 3–4 | Around half of advertised locations measured virtual or unverifiable; hosting-flagged ranges. |
| 5–6 | Datacenter with zero measured location mismatch but hosting-flagged address space; or working egress you cannot choose. |
| 7–8 | Residential or own-IP egress, city-level choice, structurally harder to blanket-block. |
| 9–10 | Residential, presence-verified, city-level. |

**In: ingress options**

| Score | Meaning |
|---|---|
| 0–1 | None. |
| 3–4 | Single protocol, no obfuscation. |
| 5–6 | Obfuscated mode or modes. |
| 7–8 | Multiple transports including covert or volunteer entry. |
| 9–10 | A battle-tested pluggable-transport ecosystem. |

**A: availability / anti-censorship**

| Score | Meaning |
|---|---|
| 1–2 | Unavailable in censored regions, hardware-locked, or paid-only with no trial. |
| 4–5 | Paid-only but broadly available. |
| 6–7 | Free tier, or wide availability. |
| 8–9 | Free, and proven under censorship pressure. |
| 10 | Free, universal, censorship resistance as mission. |

## The full matrix

To recompute any row: multiply each sub-score by its part's weight and
add. Worked examples:

- URnetwork X = 0.25×8 + 0.35×8 + 0.30×6 + 0.10×7
  = 2.00 + 2.80 + 1.80 + 0.70 = **7.30**
- Mullvad Y = 0.30×7 + 0.25×8 + 0.20×5 + 0.10×5 + 0.15×4
  = 2.10 + 2.00 + 1.00 + 0.50 + 0.60 = **6.20**

Totals are exact to two decimals; nothing is rounded into place. (The
working record labels the parts X1–X4 and Y1–Y5 in the same order shown
here.)

### X: verifiable anonymization

Columns: **E** end-to-end through the service (0.25), **S** separation of
identity from activity (0.35), **V** no-logs verifiability (0.30),
**PQ** post-quantum (0.10).

| Product | E | S | V | PQ | **X** |
|---|---|---|---|---|---|
| Tor | 10 | 10 | 10 | 4 | **9.40** |
| NymVPN | 9 | 9 | 7 | 0 | **7.50** |
| URnetwork | 8 | 8 | 6 | 7 | **7.30** |
| Obscura | 8 | 8 | 6 | 0 | **6.60** |
| Mullvad | 3 | 5 | 9 | 8 | **6.00** |
| IVPN | 3 | 5 | 8 | 8 | **5.70** |
| Apple Private Relay | 7 | 7 | 3 | 0 | **5.10** |
| Windscribe | 3 | 5 | 7 | 0 | **4.60** |
| PIA | 3 | 3 | 8 | 0 | **4.20** |
| ExpressVPN | 3 | 3 | 5 | 9 | **4.20** |
| Proton VPN | 3 | 3 | 7 | 0 | **3.90** |
| NordVPN | 3 | 3 | 5 | 6 | **3.90** |
| Tailscale | 6 | 2 | 5 | 0 | **3.70** |
| Cloudflare WARP | 3 | 4 | 3 | 5 | **3.55** |
| Surfshark | 3 | 3 | 4 | 5 | **3.50** |
| Orchid | 3 | 5 | 3 | 0 | **3.40** |
| Mysterium | 3 | 3 | 3 | 0 | **2.70** |
| TunnelBear | 3 | 2 | 4 | 0 | **2.65** |
| Sentinel | 3 | 3 | 2 | 0 | **2.40** |
| IPVanish | 3 | 2 | 3 | 0 | **2.35** |
| Hotspot Shield | 3 | 1 | 2 | 0 | **1.70** |
| Hola | 1 | 0 | 0 | 0 | **0.25** |

### Y: connection quality

Columns: **L** latency (0.30), **T** throughput (0.25), **Eg** egress
quality (0.20), **In** ingress options (0.10), **A** availability /
anti-censorship (0.15).

| Product | L | T | Eg | In | A | **Y** |
|---|---|---|---|---|---|---|
| Tailscale | 9 | 9 | 5 | 4 | 6 | **7.25** |
| Windscribe | 7 | 7 | 6 | 7 | 7 | **6.80** |
| Proton VPN | 7 | 8 | 4 | 6 | 8 | **6.70** |
| Cloudflare WARP | 9 | 8 | 2 | 4 | 8 | **6.70** |
| URnetwork | 5 | 5 | 8 | 8 | 7 | **6.20** |
| Mullvad | 7 | 8 | 5 | 5 | 4 | **6.20** |
| ExpressVPN | 7 | 8 | 4 | 6 | 4 | **6.10** |
| NordVPN | 7 | 8 | 4 | 6 | 4 | **6.10** |
| Surfshark | 7 | 8 | 4 | 5 | 4 | **6.00** |
| IVPN | 7 | 7 | 5 | 4 | 4 | **5.85** |
| PIA | 7 | 7 | 4 | 5 | 4 | **5.75** |
| Hotspot Shield | 7 | 7 | 2 | 5 | 5 | **5.50** |
| TunnelBear | 7 | 6 | 3 | 5 | 5 | **5.45** |
| IPVanish | 7 | 7 | 3 | 4 | 4 | **5.45** |
| Obscura | 5 | 6 | 5 | 5 | 4 | **5.10** |
| Apple Private Relay | 8 | 7 | 2 | 1 | 2 | **4.95** |
| Mysterium | 6 | 4 | 6 | 3 | 4 | **4.90** |
| Hola | 5 | 4 | 5 | 3 | 7 | **4.85** |
| Sentinel | 6 | 4 | 4 | 6 | 4 | **4.80** |
| NymVPN | 5 | 4 | 2 | 5 | 4 | **4.00** |
| Orchid | 6 | 3 | 3 | 3 | 3 | **3.90** |
| Tor | 2 | 1 | 1 | 9 | 9 | **3.30** |

### Coordinates and quadrants

Δ columns are distance from the axis lines at (5.00, 5.00). Anything
within ±0.25 of a line is noise and is annotated as such; the derivation
of that band is on the [methodology page](/docs/comparison-methodology).

| Product | X | Y | ΔX | ΔY | Quadrant |
|---|---|---|---|---|---|
| Tor | 9.40 | 3.30 | +4.40 | −1.70 | Academic / Research |
| NymVPN | 7.50 | 4.00 | +2.50 | −1.00 | Academic / Research |
| URnetwork | 7.30 | 6.20 | +2.30 | +1.20 | Verifiable Next Generation |
| Obscura | 6.60 | 5.10 | +1.60 | +0.10 | Verifiable Next Generation, on the Y line |
| Mullvad | 6.00 | 6.20 | +1.00 | +1.20 | Verifiable Next Generation |
| IVPN | 5.70 | 5.85 | +0.70 | +0.85 | Verifiable Next Generation |
| Apple Private Relay | 5.10 | 4.95 | +0.10 | −0.05 | On both lines, nominally Academic / Research |
| Windscribe | 4.60 | 6.80 | −0.40 | +1.80 | Trust-Based Current Generation |
| PIA | 4.20 | 5.75 | −0.80 | +0.75 | Trust-Based Current Generation |
| ExpressVPN | 4.20 | 6.10 | −0.80 | +1.10 | Trust-Based Current Generation |
| Proton VPN | 3.90 | 6.70 | −1.10 | +1.70 | Trust-Based Current Generation |
| NordVPN | 3.90 | 6.10 | −1.10 | +1.10 | Trust-Based Current Generation |
| Tailscale | 3.70 | 7.25 | −1.30 | +2.25 | Trust-Based Current Generation |
| Cloudflare WARP | 3.55 | 6.70 | −1.45 | +1.70 | Trust-Based Current Generation |
| Surfshark | 3.50 | 6.00 | −1.50 | +1.00 | Trust-Based Current Generation |
| Orchid | 3.40 | 3.90 | −1.60 | −1.10 | Legacy |
| Mysterium | 2.70 | 4.90 | −2.30 | −0.10 | Legacy, near the Y line |
| TunnelBear | 2.65 | 5.45 | −2.35 | +0.45 | Trust-Based Current Generation |
| Sentinel | 2.40 | 4.80 | −2.60 | −0.20 | Legacy, near the Y line |
| IPVanish | 2.35 | 5.45 | −2.65 | +0.45 | Trust-Based Current Generation |
| Hotspot Shield | 1.70 | 5.50 | −3.30 | +0.50 | Trust-Based Current Generation |
| Hola | 0.25 | 4.85 | −4.75 | −0.15 | Legacy, near the Y line |

## What drove each score

Products follow in the matrix's X order, URnetwork first. It is the one
scored with a conflict of interest, so its entry comes first and gets the
harshest reading.

### URnetwork (7.30, 6.20), Verifiable Next Generation

Rescored 2026-08-07, the second disclosed post-scoring rescore and the
one that moves our own dot, so it carries the fullest reasoning. The
product owner ruled that the sealed client↔provider session is **on by
default at launch**: the operator carries bytes it cannot read without
anyone touching a setting. That ruling ends the opt-in premise three of
the four X parts were scored against. E, S and PQ were re-derived from
the unchanged frozen anchors (E 7→8, PQ 5→7, S unchanged at 8), and V is
untouched at 6, because the audit gap this ruling does not close is
exactly what V measures. Old X 6.85; new X 7.30.

- **E 8** (was 7). The sealed client↔provider session (X25519MLKEM768
  hybrid key exchange, AES-256-GCM, Ed25519-signed provider identity)
  makes the operator relay bytes it cannot read. It now engages out of
  the box on every native platform, with every current provider build
  answering it; only older builds still in the field fall back. That
  exceeds the 7–8 anchor's own wording, "available, but conditional or
  opt-in", so it takes the top of the band, the same between-rungs
  reading that placed Obscura's always-on entry blindness at 8. Not
  9–10: that class is layered encryption through independent parties,
  the onion and mixnet designs, and a single sealed leg relayed by one
  operator is a two-party design. And the seal is not yet
  by-construction in Obscura's sense, which is why 8 is the ceiling of
  what this ruling could earn. A settings switch still exists ("Post
  Quantum Encryption", now default-on); the browser extension has no
  sealed session at all; and two integrity defects stand in current
  code, both being fixed before launch and documented in the threat
  model as they stand. The session fails open silently: a failed
  handshake or an omitted contract key field leaves traffic flowing in
  plaintext with no user-visible signal. And the operator can substitute
  a provider key: the out-of-band key cross-check logs a mismatch and
  continues, against a key service the same operator runs. The explicit
  ruling made here: within the frozen ladder, the band's higher rung
  requires the default, and full integrity (fail-closed engagement, an
  operator-independent key anchor) is what the 9–10 class prices, not
  the 8. The field already reads it that way, since Obscura holds its 8
  with an operator-controlled key channel of the same class. A
  default-on seal that fails open silently is weaker than one that fails
  closed: the score is 8 with that printed beside it, and if the two
  fixes do not land for launch, this part gets re-derived again against
  whatever shipped.
- **S 8.** The provider carrying your traffic never sees your IP,
  unconditionally: the wire path is identifier-only by construction
  (verified architecture report). And the operator cannot read what it
  relays, by default, under the same ruling, with the integrity and
  extension caveats above. Browsing is spread across a rotating window
  of several providers with per-site affinity, and the account can be an
  email-free Instant Account, a wallet sign-in, or paid in USDC. Held
  out of 9–10 by what survives the default change: that rung requires
  multi-party separation by construction with no identifying account,
  and URnetwork's split is two relay parties; an account exists, a
  wallet used for sign-in stays linked to it, and a per-connection
  city/region geolocation is persisted; and the now-default content leg
  is not yet by-construction while its fail-open and key-substitution
  fixes are landing and the extension carries no seal. This part has now
  been re-derived twice without moving, each time on a correction in our
  favour, each priced at zero: first when a stale "sign-up IP retained
  raw for 180 days" penalty was removed after verification against
  current server source (the account-creation audit event stores only a
  keyed hash, "never the raw ip:port"; task records bind an empty
  address; a migration scrubbed historical rows), and again when the
  default-on ruling struck the "conditional leg" from the kept-off list.
  Both removed items were within-band caveats, not the binding
  constraint. The 9–10 conjunction fails without them, so the number
  holds at the band's top. Full reasoning in `review/index/NOTES.md`.
- **V 6.** The entire stack is open source *including the operator's
  server code*, continuous verifiability of design that nothing else in
  this set matches except the dVPN protocols, and storage minimization
  is enforced in code: connect IPs stored only as keyed one-way hashes
  of address blocks, no destination columns in stored records, a
  test-pinned no-log proxy path (verified privacy-enforcement report).
  Two third-party assessments exist, and neither is of the thing this
  axis measures. A third-party firm penetration-tested the web
  application and API over 25 April – 5 May 2025 (credentialed, manual,
  OWASP Top 10 with a review of ASVS controls), and Leviathan Security
  Group assessed the Android app under Google's App Defense Alliance
  MASA programme at assurance level AL2, completed 23 May 2025. It
  passed, and Leviathan itself scopes the assessment as "limited to the
  specific requirements of the Application Defense Alliance … and should
  not be read as a holistic security evaluation or comprehensive
  penetration test." Neither examined logging, retention, or the data
  path; neither touched the protocol, the connect engine or the
  operator's server code; and the penetration-test report is
  confidential, so it yields no evidence a reader can check, which is
  the currency this axis trades in. This page applies exactly that
  discount to others: Cloudflare WARP scores V 3 because its independent
  examinations cover the 1.1.1.1 resolver rather than WARP, and
  Surfshark scores V 4 with its pentest set aside for being silent on
  logging. There is still **no audit of the protocol or the server, no
  court or raid test, and no outside measurement**; nobody has run
  IPinfo's study on it. That keeps it out of the 8–9 band that Mullvad,
  IVPN and PIA occupy with less openness but real independent checks,
  since that band needs repeated audits *and* court, raid or measurement
  evidence. 6 is the bottom of the "open source plus gaps" band, and the
  gap is the layer the privacy claim actually rests on. Re-derived
  rather than nudged when the assessments came to light on 2026-08-07
  (the methodology ledger carries the row): the correction is in our
  favour, so it was priced at zero. What it changed is the quality of
  the 6, not its value. The band reads "open-source clients plus audits
  or court evidence, with real gaps", and the first pass had put
  URnetwork at the band floor while it satisfied only the open-source
  half of that.
- **PQ 7** (was 5). The hybrid post-quantum exchange is on by default on
  the client↔provider session on all five native platforms, and the
  provider fleet already answers it: the "on by default on the flagship
  protocol" anchor (7–8), no longer the opt-in 4–5 it was first scored
  in. Held at the band floor: the browser product has no sealed session
  and so no post-quantum at all, older provider builds still fall back,
  and until the fail-open fix lands a user cannot verify the default
  engaged. Not 9–10: not first (ExpressVPN's ML-KEM default predates
  it), not everywhere.
- **L 5** (judgement). Four bounded legs, but two relay parties, which
  is what the anchor actually measures: more path than a single hop,
  deliberately bounded far below Tor-class chains, with a residential
  last mile. The extender leg does not move this: it forwards the
  encrypted session on to the operator without terminating it, so it
  buys reachability, not separation. The bounded-multi-hop anchor is
  4–5; 5 for the explicit latency-bounding design goal. No measurements
  exist in either direction.
- **T 5.** Residential-bounded egress, varying with the providers
  carrying you. The only number the corpus permits is URnetwork's own
  attributed figure: 40 Mbps+ average streaming speed. Anchor 4–5.
- **Eg 8.** Residential exit addresses in consumer-ISP space,
  structurally harder to blanket-block than hosting ranges (location
  study), with city-searchable targeting, and locations derived by the
  operator from the observed connection rather than self-declared.
  Docked from 9–10 for two reasons, both printed: the engine drops
  BitTorrent-class traffic at the provider's egress, a real usage
  restriction; and the measurement asymmetry, since IPinfo measured
  Mullvad, IVPN and Windscribe from outside and nobody has measured
  URnetwork.
- **In 8.** Extenders anyone can run (hand-typed IP, plausible ports),
  DNS-shaped transports, parallel h1/h3 connection racing (verified
  architecture report). Below Tor's decades-hardened bridge ecosystem.
- **A 7.** Free daily allowance, one-tap email-free account, every
  platform including a browser extension and web app. Not 8–9: the free
  tier is capped where Proton's is unlimited, and the censorship tooling
  is new; "proven under censorship pressure" belongs to Tor.

### Tor (9.40, 3.30), Academic / Research

- **E 10, S 10.** Three-relay onion routing, no operator anywhere, the
  guard/exit split, and no account system at all (compare page). The
  reference standard both parts are anchored against.
- **V 10.** Fully open, reproducible browser builds, and decades of
  published attacks met with shipped defenses (dossier). The only 10 on
  the axis.
- **PQ 4.** A hybrid post-quantum exchange is rolling out at the relay
  TLS layer; the circuit-layer onion handshake is still a proposal
  (compare page).
- **L 2, T 1.** Three volunteer relays plus circuit churn; the latency
  and throughput cost is the one Tor's own community documents. The
  criticism keeps its scope: painful for video and calls, fine for
  browsing.
- **Eg 1.** The exit list is published, so exits are trivially blockable
  and widely blocked or CAPTCHA-challenged; choosing a location is not a
  product feature (compare page).
- **In 9.** Snowflake, WebTunnel, obfs4: the most battle-tested entry
  ecosystem in this set.
- **A 9.** Free forever, censorship resistance as mission; not 10
  because entry is actively fought in the hardest regimes and
  whole-device use takes extra tooling.

### NymVPN (7.50, 4.00), Academic / Research

Scored on its shipping default (the 2-hop Fast mode), with the mixnet
credited as an opt-in capability, the same rule that scored URnetwork's
sealed session while it was opt-in.

- **E 9.** Even Fast mode is a genuine split-knowledge design through
  independently operated gateways, and the 5-hop Sphinx mixnet with
  cover traffic, the strongest anonymity design in commercial VPN, sits
  opt-in on top (dossier). Not 10: the default carries no cover traffic,
  and the Cure53 audit flagged centralized gateway-list fetching.
- **S 9.** No company relay sits in the path, and zk-nym anonymous
  credentials cryptographically unlink payment from usage, shipped and
  in production, with cash, Taler and Monero at checkout (dossier). Not
  10: node bonding and rewarded-set selection concentrate some
  structure.
- **V 7.** Full-stack open source (GPL-3.0) plus one published
  independent audit: Cure53 2024, 105 pages, 43 findings, criticals
  reported fixed and re-reviewed (dossier). One more audit than
  URnetwork has; a young record next to Mullvad's or IVPN's.
- **PQ 0.** No post-quantum claim found in the evidence base.
- **L 5.** The default 2-hop tunnel is the same structural class as
  URnetwork's bounded path. The mixnet mode's deliberate delays would
  score 1; Nym's own docs say to switch modes to stream.
- **T 4** (judgement). Young network; Nym's own positioning states the
  anonymity/latency trade; no benchmark exists in the corpus.
- **Eg 2.** Gateway egress on identifiable infrastructure, a small young
  fleet, no residential story, no city targeting (compare page).
- **In 5** (judgement). AmneziaWG obfuscated transport; nothing like
  Tor's or URnetwork's entry diversity in evidence.
- **A 4.** Paid only (trial on long plans), five platforms, no browser
  extension; launched March 2025.

### Obscura (6.60, 5.10), Verifiable Next Generation, on the Y line

Added 2026-08-07, the twenty-first compared product, under selection bar
(d): a two-party relay in which Obscura runs the entry hop and Mullvad
runs the exit, with the user's WireGuard session negotiated end-to-end
against the exit's key. The closest architectural competitor to URnetwork
on this map, and the product whose omission peer review used to prove the
old ad-hoc selection had failed.

- **E 8.** Entry-hop blindness is structural and always on: the client
  builds its WireGuard session against the *exit's* public key (the
  client source has exactly one tunnel-construction call site) and
  relays the encrypted datagrams inside QUIC, with no setting, no
  default, and no code path that terminates WireGuard at the relay, on
  every platform in both transport modes (dossier, verified in the
  published source). That is *stronger* than the 7–8 anchor's
  "conditional or opt-in" wording, so it takes the top of that band: an
  8 it held alone above URnetwork's then-opt-in 7 until the 2026-08-07
  default-on rescore, and now shares with it. Within the shared integer
  Obscura's seal remains the stronger in kind, since no switch exists,
  no code path can carry plaintext, and the exit key is checkable
  against an independently published list, where URnetwork's default
  keeps a settings switch, a silent fail-open until its pre-launch fix
  lands, and no extension coverage. Held out of the 9–10 onion and
  mixnet class: exactly two parties with one commercial exit partner;
  the exit key is whatever Obscura's own API hands the client, checked
  against Mullvad's published list only by the user, manually (the
  dossier bars "the app verifies it" outright); and the shared-landlord
  finding below. Cure53's own conclusion names the boundary: the
  protocol "prioritizes low latency over maximum protection against
  global attackers".
- **S 8.** Two-party separation by construction, on by default: the
  entry company sees your connecting IP but holds no key to your
  traffic; Mullvad sees destinations but only a NAT'd relay address.
  Neither holds identity and activity together, and the relay
  authenticates a per-tunnel token rather than your account. Anonymous
  accounts are genuine: a random 19-digit number, no email or phone,
  proof-of-work instead of identity for anti-abuse, Lightning and
  Monero rails. Kept at the two-party band's top rather than 9–10: two
  parties are not multi-party; an account exists, and a Stripe card
  leaves identity with the processor; the API necessarily sees account
  and IP together at tunnel creation (their own copy concedes it); and
  35 of 38 entry relays, plus every preferred Mullvad exit for 29 of 38
  locations, sit on ASNs registered to Datacamp Limited, one hosting
  company under both legs, so the two-party independence is legal and
  cryptographic rather than infrastructural. Same integer as
  URnetwork's 8, earned differently: both Obscura legs are
  unconditional by construction where URnetwork's content leg is
  default-on with its integrity fixes still landing (and absent in the
  browser extension), but a single exit partner sees a whole session's
  destinations where URnetwork spreads them across a provider window.
- **V 6.** Scored on the facts rather than the labels, in both
  directions. The client's entire source is published and readable on
  GitHub (the dossier verified the key schedule in it), but under
  PolyForm Noncommercial 1.0.0: source-available, not open source, with
  external contributions refused. The relay daemon and API backend are
  unpublished, and Obscura itself never claims "open source", a wording
  this page matches. One real external audit exists and is published in
  full: Cure53, executed May 2025, published December 2025, six
  findings with one Medium, scoped to the macOS app, its network
  extension and the protocol design, with iOS, Android, Windows, Linux,
  the relay fleet and the API backend all outside it. So the structural
  half of the no-logs story is double-checked (readable source plus an
  independent auditor agreeing), while the connecting-IP half is a
  policy promise no evidence covers, and there is no court or raid test
  of Obscura itself, no warrant canary, no transparency report, and
  reproducible builds still promised rather than shipped eighteen
  months on. The floor of the 6–7 band: the band's conjunction is met
  in thinner form than NymVPN's full-stack GPL plus larger audit at 7.
  Mullvad's raid record belongs to the exit partner and is credited
  there, not here.
- **PQ 0.** None at all, and none claimed: the client passes `None` in
  the WireGuard pre-shared-key slot, the exact slot Mullvad's own
  quantum-resistant scheme uses, so Obscura users get Mullvad exits
  without Mullvad's post-quantum protection. A gap, not a
  misrepresentation.
- **L 5** (judgement). A bounded two-hop chain, both hops datacenter:
  the same bounded-multi-hop class as NymVPN's default two-hop and
  URnetwork's four-leg path, at the class anchor's top for the explicit
  low-latency priority its own auditor named. No measurements exist in
  either direction.
- **T 6** (judgement). The exits are Mullvad's 10 Gbps-class fleet,
  every one of the 254 verified as a live, diskless Mullvad relay,
  reached through one added relay hop on CDN-grade hosting, with QUIC
  datagram transport avoiding TCP-over-TCP collapse. Docked below the
  single-hop datacenter peers for the chain and the young, unmeasured
  38-relay entry fleet; above the residential-bounded class. Obscura
  publishes no speed claims of its own.
- **Eg 5.** The zero-mismatch datacenter ceiling, inherited from the
  best possible source: all 254 exits matched Mullvad's public relay
  list, the most cleanly verifiable coverage claim in the compared set,
  via public unauthenticated APIs, and Mullvad's fleet measured 0%
  location mismatch, of which Obscura offers roughly a 45% subset.
  Obscura itself is not in the IPinfo study; stated, never inferred.
  Same score and reasoning as Mullvad and IVPN: hosting-flagged,
  published, widely blocked ranges with city-level choice, on the
  smallest map of the three (24 countries and 38 cities by its own API,
  against a pricing-page "33+ countries" that is its one clean numeric
  overclaim). DAITA is absent from every exit it offers.
- **In 5.** A genuine purpose-built obfuscated transport: WireGuard
  datagrams inside QUIC on ports 53, 443 and 50000, blending with
  HTTP/3, plus a TCP+TLS fallback, framed without overclaim (no
  "undetectable" and no "works in China" claim). At the obfuscated-modes
  band floor: the generic-WireGuard mode loses the obfuscation
  entirely, packet padding ships off by default (the Cure53 finding),
  all 38 entry IPs are enumerable from a public API, there is no IPv6
  ingress, and nothing like extenders, bridges or volunteer entry.
- **A 4.** Paid only: $8.00 a month flat, no free tier, no trial, and
  payment nonrefundable. The paid-only anchor, alongside Mullvad, IVPN
  and NymVPN. Three shipping apps (macOS, iOS, Android) plus generic
  WireGuard configs for everything else, with Windows and Linux
  genuinely under construction; broadly purchasable, including
  Lightning and Monero, with the site also reachable over a Tor onion
  service.

Placement note: X 6.60 sits in clear water, +1.60 right of the X line,
fourth on the axis, 0.70 behind URnetwork since the default-on rescore
(0.25 before it). Y 5.10 sits on the Y line at +0.10, inside the ±0.25
noise band, so its above-the-line membership is not a confident call. The
two products tie 16–16 on the structure parts and tie at 6 on V, so
URnetwork's whole margin is the post-quantum part. The uncertainty
statistics behind both readings, including the single judgement part that
moves Obscura either side of the quality line, are on the
[sensitivity page](/docs/comparison-sensitivity).

### Mullvad (6.00, 6.20), Verifiable Next Generation

- **E 3.** One party terminates the tunnel. Mullvad's own multihop
  chains two Mullvad servers, cover against a network observer rather
  than against Mullvad, and DAITA is traffic-shape defense, not operator
  blindness (compare page).
- **S 5.** Identity starved to a number: numbered accounts, no email,
  cash by post, Monero. The top of the single-party band: one company
  still sees both ends, but holds almost no identity to pair with them
  (the dossier records what card and PayPal payments still leave).
- **V 9.** The best-evidenced conduct record in the industry: the April
  2023 police raid that left with nothing, a published-audit record
  running 2018 through 2026, open-source apps with reproducible Android
  builds, and 0% measured location mismatch (location study). Not 10:
  the server side is not published, and audits are point-in-time.
- **PQ 8.** Quantum-resistant tunnels on by default on desktop since
  2025.2; a setting on mobile (dossier).
- **L 7, T 8.** Single-hop, WireGuard-only, 10 Gbps-class datacenter
  fleet; "consistent" is the compare page's word.
- **Eg 5.** The zero-mismatch datacenter ceiling: no virtual locations
  and 0% measured mismatch, but well-known hosting ranges that many
  streaming and retail sites simply block (compare page; location study
  on one-rule ASN blocking).
- **In 5.** Bridges and Shadowsocks plus DAITA; a principled refusal to
  play obfuscation cat-and-mouse (compare page).
- **A 4.** Paid only, flat price, no free tier.

### IVPN (5.70, 5.85), Verifiable Next Generation

- **E 3.** Single-party termination; multi-hop chains two IVPN servers
  (all plans since May 2026, dossier).
- **S 5.** Random account IDs with no email, cash by post, Monero
  (compare page). Same band and reasoning as Mullvad.
- **V 8.** Eight Cure53 audits since 2019 spanning no-logs claims,
  infrastructure, apps and gateways; open-source apps; a published
  transparency report (34 requests since 2016, 3 valid, zero data
  provided) plus a monthly signed warrant canary; 0% measured mismatch
  (dossier; location study). Below Mullvad only on the adversarial raid
  test.
- **PQ 8.** Quantum-resistant key exchange on by default in its apps
  (WireGuard, not manual configs; dossier).
- **L 7.** Single-hop datacenter class. This is the normalized score
  recorded in the methodology ledger: the 58-gateway fleet first argued
  for a 6, and this single point is what holds IVPN above rather than
  below the Y line's neighborhood. With L 6 its Y would be 5.55, still
  above 5.00.
- **T 7** (judgement). "Predictable speed and a fixed server list"
  (compare page); the smaller fleet keeps it off 8.
- **Eg 5.** The zero-mismatch datacenter ceiling, same reasoning as
  Mullvad; 41 countries per its own API (dossier).
- **In 4** (judgement). A modest obfuscation story; no equivalent of
  extenders or bridges in evidence.
- **A 4.** Paid only ($2 one-week trial). Its iOS kill-switch coverage
  gap is a product-finish note on the compare page, not a scored input.

### Apple Private Relay (5.10, 4.95), on both axis lines

Rescored 2026-08-07 after independent peer review (the third row of the
methodology ledger): the evidence base had described the two-hop split as
"held by contract rather than encryption", which Apple's own architecture
overview contradicts. E and S were rescored against the unchanged frozen
anchors; V, PQ and all five quality parts stand.

- **E 7** (was 5). The split of views is enforced by layered encryption,
  by Apple's own account: destination names are encrypted past the first
  hop ("cannot be seen by either party", the ingress or the access
  network), the second hop "has no knowledge of the user's original IP
  address", the device validates each proxy's public key under TLS 1.3,
  and DNS travels as Oblivious DoH, default-on within its scope. That is
  the structural-operator-blindness band (7–8), not the
  split-by-contract band (5–6) it was first scored in. Held at the band
  floor: the implementation is closed; the two parties are not
  independent, since Apple writes the client, operates the ingress
  software, and selects and pays the egress partners; and the 2022 TUM
  measurement (APNIC write-up) found Akamai infrastructure on both
  layers, a single entity observed able to watch both sides at the
  network level. Not scored above URnetwork's open, code-verified 7
  while that measured crack stands. (URnetwork's E later moved to 8 in
  its own same-day rescore; this sentence records the comparison as it
  stood when Apple was rescored.)
- **S 7** (was 6). The first pass held it at the two-party band's floor
  for three caveats, "contractual-only, unverifiable, and bound to a
  fully identified Apple ID", and the first of the three was wrong: the
  separation is by construction and on by default, with blind-signature
  tokens confirming a subscription "without actually identifying the
  user". The remaining caveats are real and keep it at 7, below
  URnetwork's 8: a mandatory, identity-rich Apple ID with no anonymous
  option at all (the band expects anonymous accounts), the closed
  implementation, and the TUM party-overlap finding.
- **V 3** (unchanged). Closed source, no independent audit of the
  running service; a published architecture paper, a public egress-IP
  list, and a minimal-logging policy whose own overview enumerates what
  is logged (dossier). The correction changes what the mechanism is, not
  what an outsider can verify, which is still nothing.
- **PQ 0** (unchanged). None found in evidence for Private Relay.
- **L 8, T 7.** QUIC/MASQUE to a nearby CDN egress; battery- and
  performance-friendly by design (compare page).
- **Eg 2.** No location choice at all, by design ("does not provide any
  methods to spoof location"), and the scope is Safari, DNS, and
  insecure HTTP (compare page).
- **In 1.** No obfuscation, no alternate entry.
- **A 2.** Requires Apple hardware plus paid iCloud+; not offered in
  China mainland, Russia, and several other countries.

Placement note: X 5.10 and Y 4.95 put Apple within noise (±0.25) of both
axis lines at once, the only product on the map for which no quadrant
membership is a confident reading. By strict sign it falls in Academic /
Research. The confident facts are that it has left Legacy and that its
E/S judgement calls move it either side of the X line; the single-point
arithmetic is on the [sensitivity page](/docs/comparison-sensitivity),
which is why the map annotates it as sitting on the lines rather than
claiming it for a quadrant.

### Windscribe (4.60, 6.80), Trust-Based Current Generation

- **E 3.** Single-party termination.
- **S 5.** 2 GB/month free with no email at all, account-optional
  access, plus crypto payment.
- **V 7.** Open-source apps; three published third-party audits, which
  are security audits, not no-logs attestations (its own distinction,
  kept by the dossier); an Athens court dismissal in April 2025 with
  nothing to hand over; a 2026 server seizure that found machines
  running in RAM alone; and disclosed retention of 30-day bandwidth
  totals plus a last-activity timestamp.
- **PQ 0.** None found in evidence.
- **L 7, T 7.** Single-hop datacenter; "server-grade speeds" (compare
  page).
- **Eg 6.** An all-physical map (one self-labeled joke exception) with
  0% measured mismatch (location study), one notch above Mullvad and
  IVPN for its wider city coverage (69 countries and 112 cities by its
  own count), still in hosting-flagged address space.
- **In 7.** Years of battle-tested obfuscation, WStunnel among it
  (compare page).
- **A 7.** Free 10 GB/month (2 GB with no email), à-la-carte pricing.

### PIA (4.20, 5.75), Trust-Based Current Generation

- **E 3, S 3.** Single-party; an email-identified account is required;
  crypto accepted.
- **V 8.** The strongest policy-evidence file in the classic VPN
  business: court-tested twice (2016 and 2018, both under the pre-Kape
  owner) with nothing to produce, Deloitte engagements in 2022, 2024 and
  2025 (account-gated, point-in-time; dossier), and all apps open
  source. The server side is closed; Kape ownership is a trust note on
  the compare page, not a scored input.
- **PQ 0.** None found in evidence.
- **L 7, T 7.** Single-hop datacenter, large stable fleet.
- **Eg 4.** 52% of advertised locations measured virtual or unverifiable
  (location study), and the "all 50 states" claim is IP registration
  served from about eight physical hubs, per PIA's own virtual-location
  list. Dedicated IP and port forwarding are real egress features and
  keep this at the band's top.
- **In 5.** A Shadowsocks proxy hop and multi-protocol support.
- **A 4.** Paid only.

### ExpressVPN (4.20, 6.10), Trust-Based Current Generation

- **E 3, S 3.** Single-party; email required; Bitcoin accepted.
- **V 5.** The industry's largest third-party testing program (four
  privacy attestations plus scoped component pen-tests, and one
  favorable real-world server seizure), but the apps are proprietary,
  with only the Lightway protocol open, which caps it below the
  open-client tier by the frozen anchors.
- **PQ 9.** ML-KEM post-quantum on by default on Lightway across
  platforms: the first major and the strongest post-quantum default in
  the set (OpenVPN and IKEv2 sessions carry no PQ; dossier).
- **L 7, T 8.** Single-hop, all-RAM datacenter fleet; "consistent speed"
  (compare page). Its "fastest VPN" marketing is excluded by the
  dossier.
- **Eg 4.** 57% of advertised locations measured virtual or
  unverifiable, tied for the highest share among the measured majors
  (location study); its own knowledge base lists about 100 virtual
  locations.
- **In 6.** Lightway obfuscation and protocol maturity.
- **A 4.** Paid only, at a premium price.

### Proton VPN (3.90, 6.70), Trust-Based Current Generation

- **E 3.** Single-party. Secure Core chains two Proton-owned hops,
  better against a compromised exit, but one organization still connects
  both ends (compare page).
- **S 3.** Email-based account; as its compare page puts it, cash-by-mail
  anonymizes the payment, not the account.
- **V 7.** Open-source clients with annual Securitum audits, and Swiss
  institutional accountability, scoped by the dossier's note on the Mail
  case.
- **PQ 0.** Status unverified in the evidence base.
- **L 7, T 8.** Big single-hop datacenter fleet, 10 Gbps-capable
  hardware (dossier wording).
- **Eg 4.** 51% of locations measured virtual or unverifiable (location
  study); by its own Smart Routing list, 86 of 148 advertised countries
  have no Proton hardware. Smart Routing is disclosed and framed for
  censorship access; credited in prose, not in the score.
- **In 6.** Stealth protocol; WireGuard, OpenVPN, IKEv2.
- **A 8.** The only unlimited free tier among the majors. The free tier
  has no country choice.

### NordVPN (3.90, 6.10), Trust-Based Current Generation

- **E 3, S 3.** Single-party; an email is required to have an account at
  all; crypto via a processor.
- **V 5.** Six no-logs assurance engagements (PwC and Deloitte) plus app
  security tests, decomposed by the dossier; apps closed except the GPL
  Linux client; never court-tested; and the 2018 rented-server breach
  carried a disclosure delay.
- **PQ 6.** Post-quantum rolled out across platforms in 2025; default
  status not established in the evidence, so scored between the opt-in
  and default-on anchors.
- **L 7, T 8.** Single-hop datacenter, big fleet; "consistently fast" is
  the reviewer-consensus form the dossier permits.
- **Eg 4.** 53% of locations measured virtual or unverifiable (location
  study); 79 virtual locations by its own blog's count; dedicated IP
  available.
- **In 6.** NordWhisper obfuscation (2025) plus protocol breadth.
- **A 4.** Paid only.

### Tailscale (3.70, 7.25), Trust-Based Current Generation

Scored on its own job, a private mesh between your machines, for the
quality axis, while its egress-privacy story is an add-on. Both facts are
flagged because they cut in opposite directions.

- **E 6.** WireGuard end-to-end between your own endpoints, real
  end-to-end through the service for mesh traffic, capped by the
  key-distribution trust: the coordination server distributes the keys
  that decide who your peers are, and tailnet lock ships off by default
  (dossier).
- **S 2.** Identity-bound by design: accounts ride an SSO identity
  provider, and Tailscale holds public IPs, a node-to-node connection
  graph and byte statistics with no published retention period. With the
  Mullvad add-on, Tailscale keeps the record of who you are and which
  exit you used.
- **V 5.** Open clients, closed control plane; SOC 2 Type II with
  reports on request; public security bulletins (dossier, which cites
  the 2025 advisory neutrally).
- **PQ 0.** None found in evidence.
- **L 9, T 9.** Direct peer-to-peer WireGuard with DERP relay fallback:
  the best latency and throughput class in the set, for the traffic it
  carries.
- **Eg 5.** Egress via your own nodes (your own IP: perfect
  compatibility, zero privacy) or via the Mullvad add-on (datacenter
  ranges, widely blocked).
- **In 4.** DERP is NAT traversal, not censorship tooling.
- **A 6.** A genuinely useful free personal tier; not an egress product
  for most of the jobs this map scores.

### Cloudflare WARP (3.55, 6.70), Trust-Based Current Generation

- **E 3.** Cloudflare terminates the tunnel, and says outright that WARP
  is not an anonymity product, which the compare page credits as candor.
- **S 4.** One party sees both ends, but the free tier needs no account
  at all: real identity minimization.
- **V 3.** The published independent privacy examinations cover the
  1.1.1.1 resolver, not WARP, a distinction the dossier does not allow
  to blur. BoringTun is open; WARP's no-logging pledges are policy,
  untested.
- **PQ 5.** Post-quantum shipped for WARP per Cloudflare's fact sheet,
  with scope hedged in the evidence; scored mid-band on the hedge.
- **L 9, T 8.** Anycast to a nearby edge on one of the internet's
  largest networks.
- **Eg 2.** No exit choice at all; you surface from a Cloudflare address
  near your real location.
- **In 4.** MASQUE by default since late 2024; Cloudflare's ranges are
  well known and are blocked where states block them.
- **A 8.** Free, unlimited, no account, effectively zero setup.

### Surfshark (3.50, 6.00), Trust-Based Current Generation

- **E 3, S 3.** Single-party (Dynamic MultiHop chains two Surfshark
  servers, hiding nothing from the company), and an email is required.
- **V 4.** A Deloitte assurance engagement plus a SecuRing pentest,
  decomposed by the dossier (the pentest is silent on logging); closed
  source; the assurance report sits behind a customer login.
- **PQ 5.** Live on macOS, Linux and Android; iOS and Windows planned.
- **L 7, T 8.** Single-hop, all-RAM datacenter fleet.
- **Eg 4.** 41% of locations measured virtual or unverifiable, the best
  share among the virtual-heavy majors (location study). IP Rotator
  changes what websites see, not what Surfshark sees (dossier).
- **In 5.** Camouflage and NoBorders modes.
- **A 4.** Paid only (device-level trial).

### Orchid (3.40, 3.90), Legacy

The label describes the shipped state, apps years stale, not the protocol
ideas, which the compare page treats with respect.

- **E 3.** The default circuit is a single hop to a provider that sees
  both ends; user-configured multi-hop exists but is
  use-at-your-own-risk advanced configuration (dossier).
- **S 5.** The dApp path is true no-account usage (keys you generate,
  pay-per-packet), but the shipped default is a $1 in-app purchase tied
  to a store account and card, and the single-hop path hands one
  provider both ends.
- **V 3.** No protocol-enforced no-logging: each provider's own policy
  governs, which Orchid itself states, candor the compare page credits.
  The named audits cover the smart contracts, not the VPN service.
  Open-source client.
- **PQ 0.** Unverified.
- **L 6.** Single direct hop, provider-dependent.
- **T 3** (judgement). A tiny curated default provider set, no published
  usage statistics at all, and stale mobile apps (iOS last updated May
  2023).
- **Eg 3.** A curated allowlist by default, provider mix unverified, no
  city targeting in evidence.
- **In 3, A 3.** No obfuscation story; the meaningful path requires
  crypto fluency; the project's blog has been silent since 2022.

### Mysterium (2.70, 4.90), Legacy, near the Y line

Young rather than outdated: it lands bottom-left on thin verification,
not on age.

- **E 3.** A direct client-to-node tunnel; the node sees your IP and
  your destinations together.
- **S 3.** The same single party sees both; consumer subscriptions, with
  a per-GB MYST crypto path.
- **V 3.** Open-source node and client, but no named independent audit,
  and a critical node vulnerability (CVSS 9.8) carried roughly two and a
  half years before the patch, flaw and fix public (dossier). "No logs"
  is per-app.
- **PQ 0.** Unverified.
- **L 6.** Single direct hop; node uplinks vary.
- **T 4.** Residential-bounded and variable.
- **Eg 6.** The most established paid-residential fleet, credited, but
  31.9% of live nodes sit on hosting or CDN space by Mysterium's own
  classification, and the same fleet's default customers are B2B proxy
  buyers, stated in its own help centre (dossier). City-level exits
  claimed.
- **In 3.** Standard WireGuard.
- **A 4.** Real apps and a hardware ecosystem; the low headline price
  requires a two-year prepayment.

### Sentinel (2.40, 4.80), Legacy, near the Y line

The same caveat as Mysterium: the label describes field position, not
age.

- **E 3.** Direct client-to-node; the node sees both ends.
- **S 3.** Payment and identity handling varies by each ecosystem app's
  vendor.
- **V 2.** No audit anchors any of the ecosystem's apps, nodes have no
  logging policy at all, and registration is permissionless and
  unvetted. The chain and protocol being open makes the *coordination*
  readable, which is not the same as node operator behavior being
  verifiable (dossier).
- **PQ 0.** None found in evidence.
- **L 6.** Single direct hop.
- **T 4.** Node-dependent, on a hosting-clustered fleet.
- **Eg 4.** Not residential; the dossier bars that emphasis: the
  observed fleet clusters in the same hosting countries commercial VPNs
  rent from.
- **In 6.** Genuine V2Ray support: a real tool where national firewalls
  are the adversary, and the compare page credits it.
- **A 4.** Consumer apps of varying provenance; fiat accepted.

### TunnelBear (2.65, 5.45), Trust-Based Current Generation

- **E 3, S 2.** Single-party, and the thinnest identity options in the
  commercial set: email plus payment cards only, no crypto.
- **V 4.** Published Cure53 reports 2020–2023 were a real habit, but the
  streak stalled: the 2024 audit surfaced only as a blog summary and
  2025 is unpublished. The audits are pentests, not no-logs attestations
  (dossier). Closed source; a well-drafted non-collection policy,
  credited.
- **PQ 0.** None found in evidence.
- **L 7, T 6.** Single-hop datacenter; consistent, not top-tier.
- **Eg 3.** No physical-versus-virtual disclosure at all (location
  study); free users lost country choice in January 2026; city choice
  exists only for the US and Canada on paid plans.
- **In 5.** GhostBear obfuscation.
- **A 5.** Free 2 GB/month.

### IPVanish (2.35, 5.45), Trust-Based Current Generation

- **E 3, S 2.** Single-party; email-identified accounts and card
  payments.
- **V 3.** The canonical cautionary: the 2016 handover of customer data
  to US Homeland Security under a no-logs policy, in court records and
  under a prior owner, set against current-owner point-in-time
  validations in 2022 and 2025 (scoped by the dossier). Closed source;
  the RAM-only conversion is incomplete.
- **PQ 0.** None found in evidence.
- **L 7, T 7.** Single-hop datacenter; unlimited devices.
- **Eg 3.** 51% of locations measured virtual or unverifiable with
  near-zero disclosure, one of the most opaque majors (location study).
- **In 4.** Scramble-class obfuscation.
- **A 4.** Paid only.

### Hotspot Shield (1.70, 5.50), Trust-Based Current Generation

- **E 3.** The proprietary Hydra transport is real, licensed by others,
  and uninspectable.
- **S 1.** The free tier is ad-supported with eight ad and attribution
  partners named in its own privacy policy: identity flows to ad
  partners by design on free.
- **V 2.** Audited exactly once and narrowly: the 2023 Aon engagement is
  real (the dossier bars claiming it has no audit) and textbook-narrow,
  vendor-scoped to two sentences of its own policy at a point in time.
  Closed source; a transparency report exists.
- **PQ 0.** None found in evidence.
- **L 7, T 7.** A speed-engineered proprietary transport,
  industry-validated by licensing (compare page).
- **Eg 2.** Independent infrastructure observation finds exit IPs in
  about 27 countries against "80+ countries / 115+ virtual locations"
  marketed, the widest claim-to-observation gap in the set (location
  study). The dossier's caveat that observed-versus-claimed is not by
  itself proof of deceit is why this is 2 and not 1.
- **In 5.** Hydra's hostile-network heritage.
- **A 5.** The free tier is capped at 500 MB/day at 2 Mbps, one US
  location, with ads.

### Hola (0.25, 4.85), Legacy, near the Y line

- **E 1.** A closed, unaudited stack whose encryption you take on faith
  (compare page).
- **S 0.** From its own documents: the privacy policy states collection
  of browsing history and access times and dates, with log data kept up
  to 12 months, and free users' device capacity is enrolled into Bright
  Data's commercial proxy network, stated in the policy and FAQ, not on
  the marketing pages.
- **V 0.** No audit, closed source, and the policy affirmatively
  documents collection: the no-logs promise is not even made.
- **PQ 0.** None.
- **L 5, T 4.** A datacenter-proxy front end with peer-to-peer as one of
  three paths; free-tier quality variable.
- **Eg 5.** Casual one-click geo-shifting at enormous scale is the
  product's real, working use case, which the compare page credits,
  through mixed datacenter and peer egress.
- **In 3.** Browser-first, no obfuscation story.
- **A 7.** Free, no sign-in, nothing more established at its particular
  job.

## If a number fails to recompute

Every total on this page recomputes from its parts and the published
weights, and this page is kept in agreement with the working record in
`review/index/SCORES.md` and `review/index/NOTES.md`. If either check
fails, one of them has a bug; report it the way the
[methodology page](/docs/comparison-methodology) asks, as issues on the
repositories (github.com/urnetwork) or feedback in the apps.