Comparison scores

This page is the complete scoring record behind the comparison map: every product's sub-scores on both axes, the anchor ladders they were assigned against, the reasoning behind each number, and the three disclosed rescores. Every coordinate recomputes from these integers and the weights on the methodology page; nothing is rounded into place. It is an appendix, and it is long on purpose.

Sources are named the same way throughout. The compare page is the published head-to-head (/docs/compare-). The dossier is that product's fact-check file in the documentation repository (review/misinfo/.md), which records both what is verified and which phrasings the evidence does not support. The location study is review/location-truth.md, built on IPinfo's December 2025 measurement (roughly 150,000 exit IPs across 20 commercial providers) and on vendors' own virtual-location disclosures. The verified reports are review/verified/, a line-by-line check of URnetwork's claims against its own source code, quoted here against URnetwork's interest where it cuts that way. Scores the evidence does not settle are marked judgement; those are the ones to challenge first.

Two blanket notes. Every L and T score is a structural class judgement, because the corpus permits no invented latency or throughput figures for any product. And every standard single-company tunnel scores E 3, the bottom of the 3–4 band, since the band's top was reserved for single-party designs with partial structural blinding, and none qualified.

The disclosed rescores

No weight or anchor has changed since the rubric was frozen on 2026-08-07, and no sub-score has changed except in the three records below. Each was re-derived from the unchanged frozen ladders, not adjusted; the dated ledger with each change's direction is on the methodology page, and the full reasoning sits in each product's entry on this page.

1. Apple Private Relay, rescored 2026-08-07 after independent peer review. The evidence base had misdescribed Apple's architecture as a split "held by contract rather than encryption"; Apple's own overview describes the split of views as enforced by layered encryption, with only the operators' non-collusion contractual. E 5→7, S 6→7, X 4.25→5.10, which moves Apple from the Legacy quadrant to the X line itself. The error had run in URnetwork's favour.
2. URnetwork, rescored 2026-08-07 when the product owner ruled its sealed session on by default at launch. The ruling ended the opt-in premise three of its four X parts were scored against. E 7→8, PQ 5→7, S re-derived and unchanged at 8, V untouched at 6; X 6.85→7.30. This is the one rescore that moves URnetwork's own dot, and it is flagged as in URnetwork's favour.
3. Obscura, scored and added 2026-08-07 as the twenty-first compared product, entering under selection bar (d) of the comparator rule as the closest architectural competitor. It lands at (6.60, 5.10); no other product's sub-score was touched, and every rank interval was recomputed over the 22-product field the same day on the sensitivity page.

Two further corrections were processed the same day and moved nothing, which is recorded because both cut in the scorer's favour: a stale "sign-up IP retained raw 180 days" penalty was removed from URnetwork's S reasoning after verification against current server source, and the corpus's "URnetwork has no independent audit" claim was corrected when two third-party assessments came to light. Both scores were re-derived from the ladders and held (S 8, V 6); the re-derivations are in URnetwork's entry below.

The scale and the anchor ladders

Sub-scores are integers, 0–10, assigned against the ladders below. The ladders were frozen on 2026-08-07, before any product was scored; the frozen text sits in the repository at review/index/METHOD.md, and the calibration that spans all nine parts is on the methodology page. An integer that falls between two rungs means the product sits between those classes.

E: end-to-end encryption through the service

S: separation of identity from activity

V: "no logs" verifiable rather than promised

PQ: post-quantum encryption

L: latency

T: speed / throughput

Eg: egress quality

In: ingress options

A: availability / anti-censorship

The full matrix

To recompute any row: multiply each sub-score by its part's weight and add. Worked examples:

• URnetwork X = 0.25×8 + 0.35×8 + 0.30×6 + 0.10×7 = 2.00 + 2.80 + 1.80 + 0.70 = 7.30
• Mullvad Y = 0.30×7 + 0.25×8 + 0.20×5 + 0.10×5 + 0.15×4 = 2.10 + 2.00 + 1.00 + 0.50 + 0.60 = 6.20

Totals are exact to two decimals; nothing is rounded into place. (The working record labels the parts X1–X4 and Y1–Y5 in the same order shown here.)

X: verifiable anonymization

Columns: E end-to-end through the service (0.25), S separation of identity from activity (0.35), V no-logs verifiability (0.30), PQ post-quantum (0.10).

Y: connection quality

Columns: L latency (0.30), T throughput (0.25), Eg egress quality (0.20), In ingress options (0.10), A availability / anti-censorship (0.15).

Coordinates and quadrants

Δ columns are distance from the axis lines at (5.00, 5.00). Anything within ±0.25 of a line is noise and is annotated as such; the derivation of that band is on the methodology page.

What drove each score

Products follow in the matrix's X order, URnetwork first. It is the one scored with a conflict of interest, so its entry comes first and gets the harshest reading.

URnetwork (7.30, 6.20), Verifiable Next Generation

Rescored 2026-08-07, the second disclosed post-scoring rescore and the one that moves our own dot, so it carries the fullest reasoning. The product owner ruled that the sealed client↔provider session is on by default at launch: the operator carries bytes it cannot read without anyone touching a setting. That ruling ends the opt-in premise three of the four X parts were scored against. E, S and PQ were re-derived from the unchanged frozen anchors (E 7→8, PQ 5→7, S unchanged at 8), and V is untouched at 6, because the audit gap this ruling does not close is exactly what V measures. Old X 6.85; new X 7.30.

• E 8 (was 7). The sealed client↔provider session (X25519MLKEM768 hybrid key exchange, AES-256-GCM, Ed25519-signed provider identity) makes the operator relay bytes it cannot read. It now engages out of the box on every native platform, with every current provider build answering it; only older builds still in the field fall back. That exceeds the 7–8 anchor's own wording, "available, but conditional or opt-in", so it takes the top of the band, the same between-rungs reading that placed Obscura's always-on entry blindness at 8. Not 9–10: that class is layered encryption through independent parties, the onion and mixnet designs, and a single sealed leg relayed by one operator is a two-party design. And the seal is not yet by-construction in Obscura's sense, which is why 8 is the ceiling of what this ruling could earn. A settings switch still exists ("Post Quantum Encryption", now default-on); the browser extension has no sealed session at all; and two integrity defects stand in current code, both being fixed before launch and documented in the threat model as they stand. The session fails open silently: a failed handshake or an omitted contract key field leaves traffic flowing in plaintext with no user-visible signal. And the operator can substitute a provider key: the out-of-band key cross-check logs a mismatch and continues, against a key service the same operator runs. The explicit ruling made here: within the frozen ladder, the band's higher rung requires the default, and full integrity (fail-closed engagement, an operator-independent key anchor) is what the 9–10 class prices, not the 8. The field already reads it that way, since Obscura holds its 8 with an operator-controlled key channel of the same class. A default-on seal that fails open silently is weaker than one that fails closed: the score is 8 with that printed beside it, and if the two fixes do not land for launch, this part gets re-derived again against whatever shipped.
• S 8. The provider carrying your traffic never sees your IP, unconditionally: the wire path is identifier-only by construction (verified architecture report). And the operator cannot read what it relays, by default, under the same ruling, with the integrity and extension caveats above. Browsing is spread across a rotating window of several providers with per-site affinity, and the account can be an email-free Instant Account, a wallet sign-in, or paid in USDC. Held out of 9–10 by what survives the default change: that rung requires multi-party separation by construction with no identifying account, and URnetwork's split is two relay parties; an account exists, a wallet used for sign-in stays linked to it, and a per-connection city/region geolocation is persisted; and the now-default content leg is not yet by-construction while its fail-open and key-substitution fixes are landing and the extension carries no seal. This part has now been re-derived twice without moving, each time on a correction in our favour, each priced at zero: first when a stale "sign-up IP retained raw for 180 days" penalty was removed after verification against current server source (the account-creation audit event stores only a keyed hash, "never the raw ip:port"; task records bind an empty address; a migration scrubbed historical rows), and again when the default-on ruling struck the "conditional leg" from the kept-off list. Both removed items were within-band caveats, not the binding constraint. The 9–10 conjunction fails without them, so the number holds at the band's top. Full reasoning in review/index/NOTES.md.
• V 6. The entire stack is open source including the operator's server code, continuous verifiability of design that nothing else in this set matches except the dVPN protocols, and storage minimization is enforced in code: connect IPs stored only as keyed one-way hashes of address blocks, no destination columns in stored records, a test-pinned no-log proxy path (verified privacy-enforcement report). Two third-party assessments exist, and neither is of the thing this axis measures. A third-party firm penetration-tested the web application and API over 25 April – 5 May 2025 (credentialed, manual, OWASP Top 10 with a review of ASVS controls), and Leviathan Security Group assessed the Android app under Google's App Defense Alliance MASA programme at assurance level AL2, completed 23 May 2025. It passed, and Leviathan itself scopes the assessment as "limited to the specific requirements of the Application Defense Alliance … and should not be read as a holistic security evaluation or comprehensive penetration test." Neither examined logging, retention, or the data path; neither touched the protocol, the connect engine or the operator's server code; and the penetration-test report is confidential, so it yields no evidence a reader can check, which is the currency this axis trades in. This page applies exactly that discount to others: Cloudflare WARP scores V 3 because its independent examinations cover the 1.1.1.1 resolver rather than WARP, and Surfshark scores V 4 with its pentest set aside for being silent on logging. There is still no audit of the protocol or the server, no court or raid test, and no outside measurement; nobody has run IPinfo's study on it. That keeps it out of the 8–9 band that Mullvad, IVPN and PIA occupy with less openness but real independent checks, since that band needs repeated audits and court, raid or measurement evidence. 6 is the bottom of the "open source plus gaps" band, and the gap is the layer the privacy claim actually rests on. Re-derived rather than nudged when the assessments came to light on 2026-08-07 (the methodology ledger carries the row): the correction is in our favour, so it was priced at zero. What it changed is the quality of the 6, not its value. The band reads "open-source clients plus audits or court evidence, with real gaps", and the first pass had put URnetwork at the band floor while it satisfied only the open-source half of that.
• PQ 7 (was 5). The hybrid post-quantum exchange is on by default on the client↔provider session on all five native platforms, and the provider fleet already answers it: the "on by default on the flagship protocol" anchor (7–8), no longer the opt-in 4–5 it was first scored in. Held at the band floor: the browser product has no sealed session and so no post-quantum at all, older provider builds still fall back, and until the fail-open fix lands a user cannot verify the default engaged. Not 9–10: not first (ExpressVPN's ML-KEM default predates it), not everywhere.
• L 5 (judgement). Four bounded legs, but two relay parties, which is what the anchor actually measures: more path than a single hop, deliberately bounded far below Tor-class chains, with a residential last mile. The extender leg does not move this: it forwards the encrypted session on to the operator without terminating it, so it buys reachability, not separation. The bounded-multi-hop anchor is 4–5; 5 for the explicit latency-bounding design goal. No measurements exist in either direction.
• T 5. Residential-bounded egress, varying with the providers carrying you. The only number the corpus permits is URnetwork's own attributed figure: 40 Mbps+ average streaming speed. Anchor 4–5.
• Eg 8. Residential exit addresses in consumer-ISP space, structurally harder to blanket-block than hosting ranges (location study), with city-searchable targeting, and locations derived by the operator from the observed connection rather than self-declared. Docked from 9–10 for two reasons, both printed: the engine drops BitTorrent-class traffic at the provider's egress, a real usage restriction; and the measurement asymmetry, since IPinfo measured Mullvad, IVPN and Windscribe from outside and nobody has measured URnetwork.
• In 8. Extenders anyone can run (hand-typed IP, plausible ports), DNS-shaped transports, parallel h1/h3 connection racing (verified architecture report). Below Tor's decades-hardened bridge ecosystem.
• A 7. Free daily allowance, one-tap email-free account, every platform including a browser extension and web app. Not 8–9: the free tier is capped where Proton's is unlimited, and the censorship tooling is new; "proven under censorship pressure" belongs to Tor.

Tor (9.40, 3.30), Academic / Research

• E 10, S 10. Three-relay onion routing, no operator anywhere, the guard/exit split, and no account system at all (compare page). The reference standard both parts are anchored against.
• V 10. Fully open, reproducible browser builds, and decades of published attacks met with shipped defenses (dossier). The only 10 on the axis.
• PQ 4. A hybrid post-quantum exchange is rolling out at the relay TLS layer; the circuit-layer onion handshake is still a proposal (compare page).
• L 2, T 1. Three volunteer relays plus circuit churn; the latency and throughput cost is the one Tor's own community documents. The criticism keeps its scope: painful for video and calls, fine for browsing.
• Eg 1. The exit list is published, so exits are trivially blockable and widely blocked or CAPTCHA-challenged; choosing a location is not a product feature (compare page).
• In 9. Snowflake, WebTunnel, obfs4: the most battle-tested entry ecosystem in this set.
• A 9. Free forever, censorship resistance as mission; not 10 because entry is actively fought in the hardest regimes and whole-device use takes extra tooling.

NymVPN (7.50, 4.00), Academic / Research

Scored on its shipping default (the 2-hop Fast mode), with the mixnet credited as an opt-in capability, the same rule that scored URnetwork's sealed session while it was opt-in.

• E 9. Even Fast mode is a genuine split-knowledge design through independently operated gateways, and the 5-hop Sphinx mixnet with cover traffic, the strongest anonymity design in commercial VPN, sits opt-in on top (dossier). Not 10: the default carries no cover traffic, and the Cure53 audit flagged centralized gateway-list fetching.
• S 9. No company relay sits in the path, and zk-nym anonymous credentials cryptographically unlink payment from usage, shipped and in production, with cash, Taler and Monero at checkout (dossier). Not 10: node bonding and rewarded-set selection concentrate some structure.
• V 7. Full-stack open source (GPL-3.0) plus one published independent audit: Cure53 2024, 105 pages, 43 findings, criticals reported fixed and re-reviewed (dossier). One more audit than URnetwork has; a young record next to Mullvad's or IVPN's.
• PQ 0. No post-quantum claim found in the evidence base.
• L 5. The default 2-hop tunnel is the same structural class as URnetwork's bounded path. The mixnet mode's deliberate delays would score 1; Nym's own docs say to switch modes to stream.
• T 4 (judgement). Young network; Nym's own positioning states the anonymity/latency trade; no benchmark exists in the corpus.
• Eg 2. Gateway egress on identifiable infrastructure, a small young fleet, no residential story, no city targeting (compare page).
• In 5 (judgement). AmneziaWG obfuscated transport; nothing like Tor's or URnetwork's entry diversity in evidence.
• A 4. Paid only (trial on long plans), five platforms, no browser extension; launched March 2025.

Obscura (6.60, 5.10), Verifiable Next Generation, on the Y line

Added 2026-08-07, the twenty-first compared product, under selection bar (d): a two-party relay in which Obscura runs the entry hop and Mullvad runs the exit, with the user's WireGuard session negotiated end-to-end against the exit's key. The closest architectural competitor to URnetwork on this map, and the product whose omission peer review used to prove the old ad-hoc selection had failed.

• E 8. Entry-hop blindness is structural and always on: the client builds its WireGuard session against the exit's public key (the client source has exactly one tunnel-construction call site) and relays the encrypted datagrams inside QUIC, with no setting, no default, and no code path that terminates WireGuard at the relay, on every platform in both transport modes (dossier, verified in the published source). That is stronger than the 7–8 anchor's "conditional or opt-in" wording, so it takes the top of that band: an 8 it held alone above URnetwork's then-opt-in 7 until the 2026-08-07 default-on rescore, and now shares with it. Within the shared integer Obscura's seal remains the stronger in kind, since no switch exists, no code path can carry plaintext, and the exit key is checkable against an independently published list, where URnetwork's default keeps a settings switch, a silent fail-open until its pre-launch fix lands, and no extension coverage. Held out of the 9–10 onion and mixnet class: exactly two parties with one commercial exit partner; the exit key is whatever Obscura's own API hands the client, checked against Mullvad's published list only by the user, manually (the dossier bars "the app verifies it" outright); and the shared-landlord finding below. Cure53's own conclusion names the boundary: the protocol "prioritizes low latency over maximum protection against global attackers".
• S 8. Two-party separation by construction, on by default: the entry company sees your connecting IP but holds no key to your traffic; Mullvad sees destinations but only a NAT'd relay address. Neither holds identity and activity together, and the relay authenticates a per-tunnel token rather than your account. Anonymous accounts are genuine: a random 19-digit number, no email or phone, proof-of-work instead of identity for anti-abuse, Lightning and Monero rails. Kept at the two-party band's top rather than 9–10: two parties are not multi-party; an account exists, and a Stripe card leaves identity with the processor; the API necessarily sees account and IP together at tunnel creation (their own copy concedes it); and 35 of 38 entry relays, plus every preferred Mullvad exit for 29 of 38 locations, sit on ASNs registered to Datacamp Limited, one hosting company under both legs, so the two-party independence is legal and cryptographic rather than infrastructural. Same integer as URnetwork's 8, earned differently: both Obscura legs are unconditional by construction where URnetwork's content leg is default-on with its integrity fixes still landing (and absent in the browser extension), but a single exit partner sees a whole session's destinations where URnetwork spreads them across a provider window.
• V 6. Scored on the facts rather than the labels, in both directions. The client's entire source is published and readable on GitHub (the dossier verified the key schedule in it), but under PolyForm Noncommercial 1.0.0: source-available, not open source, with external contributions refused. The relay daemon and API backend are unpublished, and Obscura itself never claims "open source", a wording this page matches. One real external audit exists and is published in full: Cure53, executed May 2025, published December 2025, six findings with one Medium, scoped to the macOS app, its network extension and the protocol design, with iOS, Android, Windows, Linux, the relay fleet and the API backend all outside it. So the structural half of the no-logs story is double-checked (readable source plus an independent auditor agreeing), while the connecting-IP half is a policy promise no evidence covers, and there is no court or raid test of Obscura itself, no warrant canary, no transparency report, and reproducible builds still promised rather than shipped eighteen months on. The floor of the 6–7 band: the band's conjunction is met in thinner form than NymVPN's full-stack GPL plus larger audit at 7. Mullvad's raid record belongs to the exit partner and is credited there, not here.
• PQ 0. None at all, and none claimed: the client passes None in the WireGuard pre-shared-key slot, the exact slot Mullvad's own quantum-resistant scheme uses, so Obscura users get Mullvad exits without Mullvad's post-quantum protection. A gap, not a misrepresentation.
• L 5 (judgement). A bounded two-hop chain, both hops datacenter: the same bounded-multi-hop class as NymVPN's default two-hop and URnetwork's four-leg path, at the class anchor's top for the explicit low-latency priority its own auditor named. No measurements exist in either direction.
• T 6 (judgement). The exits are Mullvad's 10 Gbps-class fleet, every one of the 254 verified as a live, diskless Mullvad relay, reached through one added relay hop on CDN-grade hosting, with QUIC datagram transport avoiding TCP-over-TCP collapse. Docked below the single-hop datacenter peers for the chain and the young, unmeasured 38-relay entry fleet; above the residential-bounded class. Obscura publishes no speed claims of its own.
• Eg 5. The zero-mismatch datacenter ceiling, inherited from the best possible source: all 254 exits matched Mullvad's public relay list, the most cleanly verifiable coverage claim in the compared set, via public unauthenticated APIs, and Mullvad's fleet measured 0% location mismatch, of which Obscura offers roughly a 45% subset. Obscura itself is not in the IPinfo study; stated, never inferred. Same score and reasoning as Mullvad and IVPN: hosting-flagged, published, widely blocked ranges with city-level choice, on the smallest map of the three (24 countries and 38 cities by its own API, against a pricing-page "33+ countries" that is its one clean numeric overclaim). DAITA is absent from every exit it offers.
• In 5. A genuine purpose-built obfuscated transport: WireGuard datagrams inside QUIC on ports 53, 443 and 50000, blending with HTTP/3, plus a TCP+TLS fallback, framed without overclaim (no "undetectable" and no "works in China" claim). At the obfuscated-modes band floor: the generic-WireGuard mode loses the obfuscation entirely, packet padding ships off by default (the Cure53 finding), all 38 entry IPs are enumerable from a public API, there is no IPv6 ingress, and nothing like extenders, bridges or volunteer entry.
• A 4. Paid only: $8.00 a month flat, no free tier, no trial, and payment nonrefundable. The paid-only anchor, alongside Mullvad, IVPN and NymVPN. Three shipping apps (macOS, iOS, Android) plus generic WireGuard configs for everything else, with Windows and Linux genuinely under construction; broadly purchasable, including Lightning and Monero, with the site also reachable over a Tor onion service.

Placement note: X 6.60 sits in clear water, +1.60 right of the X line, fourth on the axis, 0.70 behind URnetwork since the default-on rescore (0.25 before it). Y 5.10 sits on the Y line at +0.10, inside the ±0.25 noise band, so its above-the-line membership is not a confident call. The two products tie 16–16 on the structure parts and tie at 6 on V, so URnetwork's whole margin is the post-quantum part. The uncertainty statistics behind both readings, including the single judgement part that moves Obscura either side of the quality line, are on the sensitivity page.

Mullvad (6.00, 6.20), Verifiable Next Generation

• E 3. One party terminates the tunnel. Mullvad's own multihop chains two Mullvad servers, cover against a network observer rather than against Mullvad, and DAITA is traffic-shape defense, not operator blindness (compare page).
• S 5. Identity starved to a number: numbered accounts, no email, cash by post, Monero. The top of the single-party band: one company still sees both ends, but holds almost no identity to pair with them (the dossier records what card and PayPal payments still leave).
• V 9. The best-evidenced conduct record in the industry: the April 2023 police raid that left with nothing, a published-audit record running 2018 through 2026, open-source apps with reproducible Android builds, and 0% measured location mismatch (location study). Not 10: the server side is not published, and audits are point-in-time.
• PQ 8. Quantum-resistant tunnels on by default on desktop since 2025.2; a setting on mobile (dossier).
• L 7, T 8. Single-hop, WireGuard-only, 10 Gbps-class datacenter fleet; "consistent" is the compare page's word.
• Eg 5. The zero-mismatch datacenter ceiling: no virtual locations and 0% measured mismatch, but well-known hosting ranges that many streaming and retail sites simply block (compare page; location study on one-rule ASN blocking).
• In 5. Bridges and Shadowsocks plus DAITA; a principled refusal to play obfuscation cat-and-mouse (compare page).
• A 4. Paid only, flat price, no free tier.

IVPN (5.70, 5.85), Verifiable Next Generation

• E 3. Single-party termination; multi-hop chains two IVPN servers (all plans since May 2026, dossier).
• S 5. Random account IDs with no email, cash by post, Monero (compare page). Same band and reasoning as Mullvad.
• V 8. Eight Cure53 audits since 2019 spanning no-logs claims, infrastructure, apps and gateways; open-source apps; a published transparency report (34 requests since 2016, 3 valid, zero data provided) plus a monthly signed warrant canary; 0% measured mismatch (dossier; location study). Below Mullvad only on the adversarial raid test.
• PQ 8. Quantum-resistant key exchange on by default in its apps (WireGuard, not manual configs; dossier).
• L 7. Single-hop datacenter class. This is the normalized score recorded in the methodology ledger: the 58-gateway fleet first argued for a 6, and this single point is what holds IVPN above rather than below the Y line's neighborhood. With L 6 its Y would be 5.55, still above 5.00.
• T 7 (judgement). "Predictable speed and a fixed server list" (compare page); the smaller fleet keeps it off 8.
• Eg 5. The zero-mismatch datacenter ceiling, same reasoning as Mullvad; 41 countries per its own API (dossier).
• In 4 (judgement). A modest obfuscation story; no equivalent of extenders or bridges in evidence.
• A 4. Paid only ($2 one-week trial). Its iOS kill-switch coverage gap is a product-finish note on the compare page, not a scored input.

Apple Private Relay (5.10, 4.95), on both axis lines

Rescored 2026-08-07 after independent peer review (the third row of the methodology ledger): the evidence base had described the two-hop split as "held by contract rather than encryption", which Apple's own architecture overview contradicts. E and S were rescored against the unchanged frozen anchors; V, PQ and all five quality parts stand.

• E 7 (was 5). The split of views is enforced by layered encryption, by Apple's own account: destination names are encrypted past the first hop ("cannot be seen by either party", the ingress or the access network), the second hop "has no knowledge of the user's original IP address", the device validates each proxy's public key under TLS 1.3, and DNS travels as Oblivious DoH, default-on within its scope. That is the structural-operator-blindness band (7–8), not the split-by-contract band (5–6) it was first scored in. Held at the band floor: the implementation is closed; the two parties are not independent, since Apple writes the client, operates the ingress software, and selects and pays the egress partners; and the 2022 TUM measurement (APNIC write-up) found Akamai infrastructure on both layers, a single entity observed able to watch both sides at the network level. Not scored above URnetwork's open, code-verified 7 while that measured crack stands. (URnetwork's E later moved to 8 in its own same-day rescore; this sentence records the comparison as it stood when Apple was rescored.)
• S 7 (was 6). The first pass held it at the two-party band's floor for three caveats, "contractual-only, unverifiable, and bound to a fully identified Apple ID", and the first of the three was wrong: the separation is by construction and on by default, with blind-signature tokens confirming a subscription "without actually identifying the user". The remaining caveats are real and keep it at 7, below URnetwork's 8: a mandatory, identity-rich Apple ID with no anonymous option at all (the band expects anonymous accounts), the closed implementation, and the TUM party-overlap finding.
• V 3 (unchanged). Closed source, no independent audit of the running service; a published architecture paper, a public egress-IP list, and a minimal-logging policy whose own overview enumerates what is logged (dossier). The correction changes what the mechanism is, not what an outsider can verify, which is still nothing.
• PQ 0 (unchanged). None found in evidence for Private Relay.
• L 8, T 7. QUIC/MASQUE to a nearby CDN egress; battery- and performance-friendly by design (compare page).
• Eg 2. No location choice at all, by design ("does not provide any methods to spoof location"), and the scope is Safari, DNS, and insecure HTTP (compare page).
• In 1. No obfuscation, no alternate entry.
• A 2. Requires Apple hardware plus paid iCloud+; not offered in China mainland, Russia, and several other countries.

Placement note: X 5.10 and Y 4.95 put Apple within noise (±0.25) of both axis lines at once, the only product on the map for which no quadrant membership is a confident reading. By strict sign it falls in Academic / Research. The confident facts are that it has left Legacy and that its E/S judgement calls move it either side of the X line; the single-point arithmetic is on the sensitivity page, which is why the map annotates it as sitting on the lines rather than claiming it for a quadrant.

Windscribe (4.60, 6.80), Trust-Based Current Generation

• E 3. Single-party termination.
• S 5. 2 GB/month free with no email at all, account-optional access, plus crypto payment.
• V 7. Open-source apps; three published third-party audits, which are security audits, not no-logs attestations (its own distinction, kept by the dossier); an Athens court dismissal in April 2025 with nothing to hand over; a 2026 server seizure that found machines running in RAM alone; and disclosed retention of 30-day bandwidth totals plus a last-activity timestamp.
• PQ 0. None found in evidence.
• L 7, T 7. Single-hop datacenter; "server-grade speeds" (compare page).
• Eg 6. An all-physical map (one self-labeled joke exception) with 0% measured mismatch (location study), one notch above Mullvad and IVPN for its wider city coverage (69 countries and 112 cities by its own count), still in hosting-flagged address space.
• In 7. Years of battle-tested obfuscation, WStunnel among it (compare page).
• A 7. Free 10 GB/month (2 GB with no email), à-la-carte pricing.

PIA (4.20, 5.75), Trust-Based Current Generation

• E 3, S 3. Single-party; an email-identified account is required; crypto accepted.
• V 8. The strongest policy-evidence file in the classic VPN business: court-tested twice (2016 and 2018, both under the pre-Kape owner) with nothing to produce, Deloitte engagements in 2022, 2024 and 2025 (account-gated, point-in-time; dossier), and all apps open source. The server side is closed; Kape ownership is a trust note on the compare page, not a scored input.
• PQ 0. None found in evidence.
• L 7, T 7. Single-hop datacenter, large stable fleet.
• Eg 4. 52% of advertised locations measured virtual or unverifiable (location study), and the "all 50 states" claim is IP registration served from about eight physical hubs, per PIA's own virtual-location list. Dedicated IP and port forwarding are real egress features and keep this at the band's top.
• In 5. A Shadowsocks proxy hop and multi-protocol support.
• A 4. Paid only.

ExpressVPN (4.20, 6.10), Trust-Based Current Generation

• E 3, S 3. Single-party; email required; Bitcoin accepted.
• V 5. The industry's largest third-party testing program (four privacy attestations plus scoped component pen-tests, and one favorable real-world server seizure), but the apps are proprietary, with only the Lightway protocol open, which caps it below the open-client tier by the frozen anchors.
• PQ 9. ML-KEM post-quantum on by default on Lightway across platforms: the first major and the strongest post-quantum default in the set (OpenVPN and IKEv2 sessions carry no PQ; dossier).
• L 7, T 8. Single-hop, all-RAM datacenter fleet; "consistent speed" (compare page). Its "fastest VPN" marketing is excluded by the dossier.
• Eg 4. 57% of advertised locations measured virtual or unverifiable, tied for the highest share among the measured majors (location study); its own knowledge base lists about 100 virtual locations.
• In 6. Lightway obfuscation and protocol maturity.
• A 4. Paid only, at a premium price.

Proton VPN (3.90, 6.70), Trust-Based Current Generation

• E 3. Single-party. Secure Core chains two Proton-owned hops, better against a compromised exit, but one organization still connects both ends (compare page).
• S 3. Email-based account; as its compare page puts it, cash-by-mail anonymizes the payment, not the account.
• V 7. Open-source clients with annual Securitum audits, and Swiss institutional accountability, scoped by the dossier's note on the Mail case.
• PQ 0. Status unverified in the evidence base.
• L 7, T 8. Big single-hop datacenter fleet, 10 Gbps-capable hardware (dossier wording).
• Eg 4. 51% of locations measured virtual or unverifiable (location study); by its own Smart Routing list, 86 of 148 advertised countries have no Proton hardware. Smart Routing is disclosed and framed for censorship access; credited in prose, not in the score.
• In 6. Stealth protocol; WireGuard, OpenVPN, IKEv2.
• A 8. The only unlimited free tier among the majors. The free tier has no country choice.

NordVPN (3.90, 6.10), Trust-Based Current Generation

• E 3, S 3. Single-party; an email is required to have an account at all; crypto via a processor.
• V 5. Six no-logs assurance engagements (PwC and Deloitte) plus app security tests, decomposed by the dossier; apps closed except the GPL Linux client; never court-tested; and the 2018 rented-server breach carried a disclosure delay.
• PQ 6. Post-quantum rolled out across platforms in 2025; default status not established in the evidence, so scored between the opt-in and default-on anchors.
• L 7, T 8. Single-hop datacenter, big fleet; "consistently fast" is the reviewer-consensus form the dossier permits.
• Eg 4. 53% of locations measured virtual or unverifiable (location study); 79 virtual locations by its own blog's count; dedicated IP available.
• In 6. NordWhisper obfuscation (2025) plus protocol breadth.
• A 4. Paid only.

Tailscale (3.70, 7.25), Trust-Based Current Generation

Scored on its own job, a private mesh between your machines, for the quality axis, while its egress-privacy story is an add-on. Both facts are flagged because they cut in opposite directions.

• E 6. WireGuard end-to-end between your own endpoints, real end-to-end through the service for mesh traffic, capped by the key-distribution trust: the coordination server distributes the keys that decide who your peers are, and tailnet lock ships off by default (dossier).
• S 2. Identity-bound by design: accounts ride an SSO identity provider, and Tailscale holds public IPs, a node-to-node connection graph and byte statistics with no published retention period. With the Mullvad add-on, Tailscale keeps the record of who you are and which exit you used.
• V 5. Open clients, closed control plane; SOC 2 Type II with reports on request; public security bulletins (dossier, which cites the 2025 advisory neutrally).
• PQ 0. None found in evidence.
• L 9, T 9. Direct peer-to-peer WireGuard with DERP relay fallback: the best latency and throughput class in the set, for the traffic it carries.
• Eg 5. Egress via your own nodes (your own IP: perfect compatibility, zero privacy) or via the Mullvad add-on (datacenter ranges, widely blocked).
• In 4. DERP is NAT traversal, not censorship tooling.
• A 6. A genuinely useful free personal tier; not an egress product for most of the jobs this map scores.

Cloudflare WARP (3.55, 6.70), Trust-Based Current Generation

• E 3. Cloudflare terminates the tunnel, and says outright that WARP is not an anonymity product, which the compare page credits as candor.
• S 4. One party sees both ends, but the free tier needs no account at all: real identity minimization.
• V 3. The published independent privacy examinations cover the 1.1.1.1 resolver, not WARP, a distinction the dossier does not allow to blur. BoringTun is open; WARP's no-logging pledges are policy, untested.
• PQ 5. Post-quantum shipped for WARP per Cloudflare's fact sheet, with scope hedged in the evidence; scored mid-band on the hedge.
• L 9, T 8. Anycast to a nearby edge on one of the internet's largest networks.
• Eg 2. No exit choice at all; you surface from a Cloudflare address near your real location.
• In 4. MASQUE by default since late 2024; Cloudflare's ranges are well known and are blocked where states block them.
• A 8. Free, unlimited, no account, effectively zero setup.

Surfshark (3.50, 6.00), Trust-Based Current Generation

• E 3, S 3. Single-party (Dynamic MultiHop chains two Surfshark servers, hiding nothing from the company), and an email is required.
• V 4. A Deloitte assurance engagement plus a SecuRing pentest, decomposed by the dossier (the pentest is silent on logging); closed source; the assurance report sits behind a customer login.
• PQ 5. Live on macOS, Linux and Android; iOS and Windows planned.
• L 7, T 8. Single-hop, all-RAM datacenter fleet.
• Eg 4. 41% of locations measured virtual or unverifiable, the best share among the virtual-heavy majors (location study). IP Rotator changes what websites see, not what Surfshark sees (dossier).
• In 5. Camouflage and NoBorders modes.
• A 4. Paid only (device-level trial).

Orchid (3.40, 3.90), Legacy

The label describes the shipped state, apps years stale, not the protocol ideas, which the compare page treats with respect.

• E 3. The default circuit is a single hop to a provider that sees both ends; user-configured multi-hop exists but is use-at-your-own-risk advanced configuration (dossier).
• S 5. The dApp path is true no-account usage (keys you generate, pay-per-packet), but the shipped default is a $1 in-app purchase tied to a store account and card, and the single-hop path hands one provider both ends.
• V 3. No protocol-enforced no-logging: each provider's own policy governs, which Orchid itself states, candor the compare page credits. The named audits cover the smart contracts, not the VPN service. Open-source client.
• PQ 0. Unverified.
• L 6. Single direct hop, provider-dependent.
• T 3 (judgement). A tiny curated default provider set, no published usage statistics at all, and stale mobile apps (iOS last updated May 2023).
• Eg 3. A curated allowlist by default, provider mix unverified, no city targeting in evidence.
• In 3, A 3. No obfuscation story; the meaningful path requires crypto fluency; the project's blog has been silent since 2022.

Mysterium (2.70, 4.90), Legacy, near the Y line

Young rather than outdated: it lands bottom-left on thin verification, not on age.

• E 3. A direct client-to-node tunnel; the node sees your IP and your destinations together.
• S 3. The same single party sees both; consumer subscriptions, with a per-GB MYST crypto path.
• V 3. Open-source node and client, but no named independent audit, and a critical node vulnerability (CVSS 9.8) carried roughly two and a half years before the patch, flaw and fix public (dossier). "No logs" is per-app.
• PQ 0. Unverified.
• L 6. Single direct hop; node uplinks vary.
• T 4. Residential-bounded and variable.
• Eg 6. The most established paid-residential fleet, credited, but 31.9% of live nodes sit on hosting or CDN space by Mysterium's own classification, and the same fleet's default customers are B2B proxy buyers, stated in its own help centre (dossier). City-level exits claimed.
• In 3. Standard WireGuard.
• A 4. Real apps and a hardware ecosystem; the low headline price requires a two-year prepayment.

Sentinel (2.40, 4.80), Legacy, near the Y line

The same caveat as Mysterium: the label describes field position, not age.

• E 3. Direct client-to-node; the node sees both ends.
• S 3. Payment and identity handling varies by each ecosystem app's vendor.
• V 2. No audit anchors any of the ecosystem's apps, nodes have no logging policy at all, and registration is permissionless and unvetted. The chain and protocol being open makes the coordination readable, which is not the same as node operator behavior being verifiable (dossier).
• PQ 0. None found in evidence.
• L 6. Single direct hop.
• T 4. Node-dependent, on a hosting-clustered fleet.
• Eg 4. Not residential; the dossier bars that emphasis: the observed fleet clusters in the same hosting countries commercial VPNs rent from.
• In 6. Genuine V2Ray support: a real tool where national firewalls are the adversary, and the compare page credits it.
• A 4. Consumer apps of varying provenance; fiat accepted.

TunnelBear (2.65, 5.45), Trust-Based Current Generation

• E 3, S 2. Single-party, and the thinnest identity options in the commercial set: email plus payment cards only, no crypto.
• V 4. Published Cure53 reports 2020–2023 were a real habit, but the streak stalled: the 2024 audit surfaced only as a blog summary and 2025 is unpublished. The audits are pentests, not no-logs attestations (dossier). Closed source; a well-drafted non-collection policy, credited.
• PQ 0. None found in evidence.
• L 7, T 6. Single-hop datacenter; consistent, not top-tier.
• Eg 3. No physical-versus-virtual disclosure at all (location study); free users lost country choice in January 2026; city choice exists only for the US and Canada on paid plans.
• In 5. GhostBear obfuscation.
• A 5. Free 2 GB/month.

IPVanish (2.35, 5.45), Trust-Based Current Generation

• E 3, S 2. Single-party; email-identified accounts and card payments.
• V 3. The canonical cautionary: the 2016 handover of customer data to US Homeland Security under a no-logs policy, in court records and under a prior owner, set against current-owner point-in-time validations in 2022 and 2025 (scoped by the dossier). Closed source; the RAM-only conversion is incomplete.
• PQ 0. None found in evidence.
• L 7, T 7. Single-hop datacenter; unlimited devices.
• Eg 3. 51% of locations measured virtual or unverifiable with near-zero disclosure, one of the most opaque majors (location study).
• In 4. Scramble-class obfuscation.
• A 4. Paid only.

Hotspot Shield (1.70, 5.50), Trust-Based Current Generation

• E 3. The proprietary Hydra transport is real, licensed by others, and uninspectable.
• S 1. The free tier is ad-supported with eight ad and attribution partners named in its own privacy policy: identity flows to ad partners by design on free.
• V 2. Audited exactly once and narrowly: the 2023 Aon engagement is real (the dossier bars claiming it has no audit) and textbook-narrow, vendor-scoped to two sentences of its own policy at a point in time. Closed source; a transparency report exists.
• PQ 0. None found in evidence.
• L 7, T 7. A speed-engineered proprietary transport, industry-validated by licensing (compare page).
• Eg 2. Independent infrastructure observation finds exit IPs in about 27 countries against "80+ countries / 115+ virtual locations" marketed, the widest claim-to-observation gap in the set (location study). The dossier's caveat that observed-versus-claimed is not by itself proof of deceit is why this is 2 and not 1.
• In 5. Hydra's hostile-network heritage.
• A 5. The free tier is capped at 500 MB/day at 2 Mbps, one US location, with ads.

Hola (0.25, 4.85), Legacy, near the Y line

• E 1. A closed, unaudited stack whose encryption you take on faith (compare page).
• S 0. From its own documents: the privacy policy states collection of browsing history and access times and dates, with log data kept up to 12 months, and free users' device capacity is enrolled into Bright Data's commercial proxy network, stated in the policy and FAQ, not on the marketing pages.
• V 0. No audit, closed source, and the policy affirmatively documents collection: the no-logs promise is not even made.
• PQ 0. None.
• L 5, T 4. A datacenter-proxy front end with peer-to-peer as one of three paths; free-tier quality variable.
• Eg 5. Casual one-click geo-shifting at enormous scale is the product's real, working use case, which the compare page credits, through mixed datacenter and peer egress.
• In 3. Browser-first, no obfuscation story.
• A 7. Free, no sign-in, nothing more established at its particular job.

If a number fails to recompute

Every total on this page recomputes from its parts and the published weights, and this page is kept in agreement with the working record in review/index/SCORES.md and review/index/NOTES.md. If either check fails, one of them has a bug; report it the way the methodology page asks, as issues on the repositories (github.com/urnetwork) or feedback in the apps.