An unaudited no-logs claim is a marketing statement
A no-logs policy is a promise, and an outside audit is the evidence that it holds. Check who did the audit, how recently, and whether it examined the servers or only the policy documents. Securitum has audited Proton VPN's no-logs policy every year from 2022 to 2026, Deloitte assured Surfshark's in 2023 and 2025, and NordVPN lists reviews by PwC and Deloitte from 2018 to 2024. KPMG assessed ExpressVPN's servers and privacy policy as of February 2025, and Assured AB's 2022 audit of Mullvad servers found no logging of customer data.
Jurisdiction matters more than most buyers realize
Proton VPN is based in Switzerland and says Swiss law doesn't oblige it to retain data logs. ExpressVPN operates from the British Virgin Islands and NordVPN from Panama, and both say no data retention laws there apply to VPN providers. Surfshark says the Netherlands, its base, doesn't require companies to store or report user data, and Mullvad is incorporated in Sweden. Jurisdiction weighs most for journalists, activists and others who expect legal requests for their data.
Renewal pricing is the price to compare
ExpressVPN, NordVPN, Proton VPN and Surfshark sell one- and two-year plans at a first-term price that rises at renewal. ExpressVPN Basic is $74.85 for its one-year plan, then $99.95 a year; Proton VPN Plus is $53.88 for the first year, then $83.88. Surfshark doesn't publish its renewal prices. Mullvad charges a flat €5 a month with no introductory rate and no increase.
Free plans are rare here, and limited
Proton VPN is the only provider here with a free plan: no data cap and no credit card, but one device at a time, servers in 10 countries chosen at random, and no P2P or secure streaming. The others offer trials or refunds instead, from Surfshark's 7-day trial, which asks for payment details, to Mullvad's 14-day money-back guarantee.