Methodology

Rules for research, sources, corrections and admitting new providers.

What the marks mean and what the colours mean

Every cell carries two pieces of information that are kept strictly apart. The mark says what is the case. The colour says how well it is evidenced.

The mark: what is the case

feature present
feature partly present
feature not present
no source available
credible sources contradict each other

The colour: how well evidenced

green for evidenced
yellow for provider claim
orange red for contradictory
grey for unknown

Green therefore means well evidenced, not good. A green cross means it is well evidenced that this feature is missing. Whether a feature is desirable is for you to decide, not for us.

For the same reason colour never carries meaning on its own. Every cell also has a mark, and the detail view spells everything out in plain words, together with the sources.

The four confidence levels

Confidence describes the quality of the evidence for a statement and nothing else. It is not a grade for the provider.

confirmedAssigned when independent evidence exists: a published audit report, a court document, a reproducible measurement or source code that can be inspected. A statement by the provider alone is never enough.

provider claimAssigned when only the provider makes the statement, for example on its own website, in its help centre or in its terms of service. This is not an accusation but a classification: the statement is documented, but not independently verified.

disputedAssigned when at least two credible sources contradict each other. Both sources are linked, the wording stays neutral, and we do not resolve the contradiction with an opinion of our own.

unknownAssigned when no reliable source is available to us. Gaps stay open; we do not fill them with plausibility.

The evidence requirement

No value without a source and a retrieval date. Every statement carries at least one link to the document it comes from and the date on which we retrieved it. Without evidence the cell reads unknown.

The retrieval date is there because provider pages change. Wherever possible we also store an archived copy, so the passage stays verifiable even if the original disappears or is rewritten.

A provider statement reaches the level provider claim at most. It only rises to evidenced once an independent source is added. That applies unchanged to providers who are allowed to maintain their own record.

Handling contradictions

When two credible sources contradict each other we set the cell to contradictory and link both sources. We do not pick the one we like better.

The accompanying text stays neutral and only describes what the contradiction consists of. Judgemental words do not appear in it.

The provider concerned is asked for a statement and has 14 days to respond. The answer is documented as a note on the data point and linked. If no answer arrives, we record that as well.

When data ages

Data ages. That is why we check the retrieval date of every source automatically against two deadlines.

Volatile fields, such as streaming availability, whether the service works in China, and prices, count as possibly outdated after 6 months.
All other fields count as possibly outdated after 12 months.

Once a statement passes its deadline the interface marks it visibly and the data point enters our review list. We do not delete the value, because an old evidenced value is worth more than an empty cell. We simply do not hide its age.

Wording for incidents and proceedings

A narrow guideline applies to fields about incidents, seizures, data breaches and court proceedings.

Facts only, always with a date and a source. The form is: on (date) servers in (place) were seized, plus the link to the passage.
No judgements and no adjectives such as scandalous or shady. What an incident means is for readers to decide.
Ongoing proceedings are marked as ongoing. A suspicion stays a suspicion until it is decided.
Statements and replies from the provider are linked and documented on the data point.

Why there is no score and no winner

No overall score, no winner, no sorting by quality.

Scores come from weightings. Whoever sets the weighting steers the outcome. Several large VPN review sites belong to the same groups as the providers at the top.

We supply the table. Which row matters to you is your call. Providers alphabetically, criteria in catalogue order.

For the same reason verified status affects neither order nor filters nor the presentation of a value. Providers appear alphabetically, criteria in the order of the catalogue.

Admission criteria for new providers

The matrix is not a directory of everything that calls itself a VPN. What gets added is what can be checked. The criteria are written down here so that admission and refusal stay traceable.

Two conditions, both have to be met

The service is publicly available. Anyone can obtain and use it, without an invitation, without a closed test phase and without belonging to an organisation. Announcements, beta programmes and internal tools are not added.
The operator is verifiable or explicitly marked as anonymous. Verifiable means a legal entity that can be looked up in a public register, in a legal disclosure or in an imprint. Where that is not possible, we add the service with the note anonymous operator. Anonymity is a circumstance we record, not a reason for exclusion.

What else applies

There has to be publicly available evidence for the core company data. Without evidence no entry is created, only a row made of unknown, and that helps nobody.
Resold services are marked as such and linked to the technical operator instead of appearing as an independent provider.
Services that technically are not a classic VPN, such as browser proxies and relays, appear in the separate category meant for them.
Discontinued services stay with the status discontinued. Their history is part of the picture the matrix draws.

What does not influence admission

Being added costs nothing and cannot be bought. The verified badge is a different matter and changes neither the admission nor the position nor a single value.
Size, fame and marketing budget play no role. A service with a handful of users sits next to a corporate product as long as both can be documented.
Our opinion of the service plays no role. Providers with documented incidents belong in the matrix, those especially.

Suggesting a provider

There is no form for this, because a form would collect data nobody needs for the review. An email is enough. So that we can start without asking back, it should contain:

The name of the service and the address of its official website.
The legal company name and its country, or an explicit note that the operator wants to stay anonymous.
Evidence for the company as an address: register extract, imprint or legal disclosure.
Addresses of the privacy policy and the terms of service.
Addresses of existing audit reports, transparency reports and a warrant canary, where they exist.
Since when the service has been publicly available.
Whether you speak for the provider or write as an uninvolved person. Both are welcome, it only changes the confidence of the first values.

Address for admission suggestions: redaktion@vpn-matrix.com

Anyone speaking for the provider themselves should use the provider channel on the contact page. Go to the contact page

What happens next

We check the two conditions and report back, including a refusal, which then comes with its reasoning.
On admission an entry is created with the core company data, everything else stays unknown. It is filled in step by step with evidence, not in one go.
Values that come from the provider alone carry the confidence provider statement. That also applies to values taken from an admission suggestion.
The admission appears in the change log like any other change.

Conflicts of interest

Editors and moderators disclose every business relationship with a listed provider. Anyone with such a relationship does not moderate the records concerned, another person takes over.

The operator of this project works as an IT security consultant. Should a client relationship with a listed provider ever arise, it would be disclosed on the transparency page and the record concerned would be looked after by someone else.

We accept no affiliate commissions and no advertising. The only source of income is the verified badge, and what it covers and what it explicitly does not cover is public.

Corrections, objections and contact

Mistakes happen. That is why the route for reporting them is short.

Every cell offers a way to suggest a change in its detail view. The source is a required field. Without evidence a suggestion is not accepted.
Suggestions enter a moderation list and are reviewed. The decision is published with its reasoning, including rejections.
Providers can reach the editorial team directly. We reply, review and document the statement on the data point, even where we stand by our presentation.
Every published change appears in the change log, with the old value, the new value and who submitted it.

Direct line for providers: anbieter@vpn-matrix.com

Go to the change log Go to the transparency page Go to the contact page