As part of our research, we also make sure to find out where the company is based and under what legal framework it operates. Some countries don't have data-retention laws, making it easier to keep a promise of "We don't keep any logs." It's also useful to know under what circumstances a VPN company will hand over information to law enforcement and what information it would have to provide if that should happen.
Of course, there are more than just phones and computers in a home. Game systems, tablets, and smart home devices such as light bulbs and fridges all need to connect to the internet. Many of these things can't run VPN software on their own, nor can they be configured to connect to a VPN through their individual settings. In these cases, you may be better off configuring your router to connect with the VPN of your choice. By adding VPN protection to your router, you secure the traffic of every gadget connected to that router. And the router—and everything protected by it—uses just one of your licenses. Nearly all of the companies we have reviewed offer software for most consumer routers and even routers with preinstalled VPN software, making it even easier to add this level of protection.
Providers can also log less-specific data about when or how often you connect to your VPN service. In some cases, these logs are a routine part of server or account management, and can be responsibly separated and scrubbed. In other cases, VPN providers take note of every connection and use that information to actively police individual customers. Though it’s reasonable for companies to protect their networks from abuse, it becomes a dealbreaker when companies keep extensive connection data for a longer period of time. Some VPN companies we spoke with explained how a log might note your current connection for authentication purposes, but that log is deleted as soon as you disconnect. This kind of “live log” isn’t a concern, and even those culled every few hours—or as long as the end of each day—shouldn’t be confused with logs of your traffic and online destinations.
We also dove deeper into the desktop apps of the top-performing services. Great apps have automatic location selection, easy-to-use designs, and detailed but uncluttered settings panels. We set up each service’s Android app on a Samsung Galaxy S8 running Android 7.0 Nougat. We took into account how easy each one was to set up and connect, along with what options were available in the settings pane.
In our review of IPVanish, I gave a four-star rating for its strong encryption, excellent performance, and a large set of servers. While it is based in the U.S., the company promises to keep no logs other than payment information, which you can also avoid by paying with Bitcoin. IPVanish has more than 40,000 unique IP addresses on more than 1,000 servers spread out over more than 60 countries, meaning you get some serious diversity. There's no limit to how many times you can switch servers, allowing you to move around until you find the absolute best. Toss in a kill switch, IPv6 and DNS leak protection, and manual port selection, and this becomes a very attractive option. Yearly plans start at about $6 per month, while monthly plans start at about $10.
This was technically #8 in the ranking, but after we saw it mentioned positively so many times in Reddit discussions, we decided to bump it up. Private Internet Access VPN, otherwise known as PIA, attempts to give off reliability vibes with its home page (children on bikes was an interesting choice), which some might feel conned by. However, we've gathered that Redditors believe that this wasn't a farce, and that it's actually a super trustworthy option. It was Mashable's top choice too, due to the fact that it comes with a ton of user-friendly features and doesn't kill your device to install. However, it's not the most aesthetically pleasing interface of the bunch, and some users mention that they had to switch VPNs simply because of that. But if you don't care about the looks so much as server reliability, variety of features, and speed, it's a good choice. Reddit user KaiForceOne writes:
Whereas most providers say they log nothing, that’s not always the case. Some record very little data like the day you subscribed, the amount of data you’ve consumed, and delete those logs when you end the session. Other providers log your IP address, the servers you used, and store those logs. If they’re based in the US, UK or any other country with data retention laws, they can be compelled to hand over that data to law enforcement.
We also like how easy it is to connect, and how clear and accessible the settings are, on all platforms when using the IVPN app. (ChromeOS has an option to use a less-secure VPN protocol with most providers, including IVPN. But TorGuard, our budget pick, supports the more secure OpenVPN on Chromebooks and tablets.) If you do want to tweak some settings, IVPN has easy-to-understand checkboxes for most options. For example, the kill switch (labeled “firewall”) has an easy on/off toggle. Anytime it’s on and the app is open, all traffic in and out of your computer will cut off if you forget to connect to the service or the secure connection drops for some reason.
Buffered VPN doesn't disclose much about the size of its network, but the 30-day money back guarantee means that you can take their service for a test drive and really get a feel for how well it performs for you. The company lost a few points from us because they do keep some connection information. They gained points for their client support, unlimited bandwidth, and generous number of simultaneous sessions allowed.