STEALTHVPN GUIDE

Beyond the Eyes: ten VPN privacy questions

Understand the logs, legal requests, software and identity details behind a VPN privacy claim.

Begin with your threat model: who you want protection from, what they can see, and what would link activity back to you. Then use these questions to compare evidence rather than marketing labels. Start with Eyes groups and jurisdiction .

Activity logs & connection metadata

Activity logs describe what you do online. Connection metadata can describe when you connect, your source IP, session length or bandwidth without listing the websites you visit.

A no-browsing-history claim can coexist with retained connection records. Retention periods and whether records can be linked to an account matter.

Look for: Separate statements for browsing/DNS history, source IPs, timestamps, bandwidth, temporary memory and deletion schedules.

Surfshark privacy policy (opens in a new tab)

Account, payment & support records

A VPN may use an email login, a username or a generated account number. Payment processors and support conversations create a separate trail.

A provider can keep no activity history while still holding personal account or payment information. Cryptocurrency is not automatically anonymous.

Look for: Required signup fields, payment-provider records, support retention, deletion rules and what is still kept after cancellation.

Proton VPN privacy policy (opens in a new tab) · ExpressVPN privacy policy (opens in a new tab)

Legal requests & transparency

A transparency report describes categories of legal requests and the provider’s reported responses over a stated period. A warrant canary is a published statement about specific orders or events.

Request counts alone do not show what information was disclosed. An unchanged canary does not independently establish that no requests occurred; its wording and legal context matter.

Look for: Covered legal entities, date range, request types, disclosed data categories, notification practices and any published case documents.

Proton VPN: legal-request transparency report (opens in a new tab)

Audit scope, dates & follow-up

An audit can cover an app, VPN servers, a no-logs claim, billing or a software updater. Those are different assessments.

A narrow or older audit does not establish the current privacy of the entire service. Read the report, findings and remediation scope.

Look for: The auditor’s original report, assessment dates, exact versions and systems, limitations, findings, remediation and any retest.

Securitum: Proton VPN no-logs assessment, August–September 2025 (opens in a new tab)

Leaks, kill switches & split tunneling

A kill switch aims to block traffic when the VPN tunnel drops. DNS, IPv6 and WebRTC handling can expose information through paths users did not intend. Split tunneling deliberately excludes selected traffic.

Behavior can differ between operating systems, app versions and settings. A feature checkbox does not establish that a particular setup has been tested.

Look for: Platform-specific tests during normal use, disconnects, app crashes, Wi-Fi changes and sleep/wake; document intentionally excluded apps.

Proton VPN: kill switch behavior and platform limitations (opens in a new tab) · IETF RFC 8828: WebRTC IP address handling (opens in a new tab)

Physical servers, virtual locations & hosts

The country advertised for a VPN IP address can differ from the server’s physical location. Hosting and account infrastructure can also sit outside the service operator’s country.

A country flag is not a complete jurisdiction map. Diskless or RAM-only design addresses some storage questions, but does not establish that no data can be observed or sent elsewhere.

Look for: Physical versus advertised country, host and operator, own versus rented infrastructure, authentication/account systems and the scope of infrastructure audits.

ExpressVPN: physical and virtual server locations (opens in a new tab) · Proton VPN privacy policy (opens in a new tab)

App telemetry, SDKs & permissions

Diagnostics, crash reporting, analytics libraries and app permissions are separate from the handling of traffic inside the VPN tunnel.

Telemetry and identifiers can create an additional data trail even where a service says it does not store browsing activity.

Look for: Defaults, opt-outs, transmitted fields, recipients, retention, platform permission explanations and app-level audit evidence.

Proton VPN privacy policy (opens in a new tab) · ExpressVPN privacy policy (opens in a new tab)

Open source, updates & reproducible builds

Open source makes the covered code available for inspection. A reproducible build lets others recreate specified binaries from a defined source and build environment.

Published client code does not reveal every server practice or prove absence of bugs. Updates and verification of the distributed software remain important.

Look for: Exact repositories and licenses, maintained release channels, signed packages, security notices, reproducibility instructions and independent code review.

Reproducible Builds: what a reproducible build establishes (opens in a new tab) · Securitum: Proton VPN no-logs assessment, August–September 2025 (opens in a new tab)

Ownership & cross-border control

The VPN’s operator, parent company and related brands can be different legal entities with different countries and roles.

Different brand names do not necessarily diversify corporate control. A parent link is context, not proof that it receives a subsidiary’s customer data.

Look for: Contracting entity, controlling group, legal notices, data-controller roles and documented changes of ownership.

ExpressVPN privacy policy (opens in a new tab) · Kape: group brands, including PIA and ExpressVPN (opens in a new tab) · Surfshark: shared holding company with Nord Security (opens in a new tab)

Cookies, fingerprints & logged-in accounts

Websites can recognize account logins, cookies, browser characteristics and information you supply. Those signals are different from an IP address.

A VPN does not separate your personal and research identities by itself, or protect a compromised device. The tool must fit the adversary and activity you are concerned about.

Look for: A clear research threat model, account separation, browser privacy controls and limits of the VPN rather than promises of complete anonymity.

EFF: cookies and browser fingerprinting explained (opens in a new tab) · EFF Surveillance Self-Defense: Choosing the VPN That’s Right for You (opens in a new tab)

Prefer to administer the tunnel yourself?

Explore free, open-source VPN software. Self-hosting moves responsibility to you and your hosting arrangement; it does not remove jurisdiction, billing records or the need to maintain the system.