Category 04 of 22

VPN

In short

VPN services encrypt the connection between your device and a server run by the provider, replacing your visible IP address with the server's. For EU buyers, the deciding question is the operating company's country of incorporation and the evidence behind its no-logs claim. Top European options on EU Vetted include Mullvad VPN (Sweden, EU-owned, CLOUD Act exposure: None, independently audited), Proton VPN (Switzerland, CLOUD Act exposure: None, independently audited), IVPN (Gibraltar, CLOUD Act exposure: None, transparency report published), and OVPN (Sweden, EU-owned, CLOUD Act exposure: None).

About this category

About VPN

VPN (Virtual Private Network) services are tools designed to encrypt the connection between your device and a server operated by the VPN provider, and to present that server's IP address to the wider internet rather than yours. The practical effect is that your internet service provider, network operator, or anyone monitoring traffic at the network level sees a connection to the VPN server rather than to the sites and services you are actually reaching. The category covered here is consumer and business VPN services, not enterprise SD-WAN or remote-access infrastructure.

A VPN sits in the path of every byte you route through it, which is why the operating company's country of incorporation carries more weight here than in most categories. The laws of the country where the operator is incorporated set the baseline for what it can be compelled to retain or disclose, regardless of what its marketing says. Some jurisdictions impose mandatory data-retention obligations or broad lawful-access powers; others have narrower regimes. If the operator is a US-incorporated company, the CLOUD Act applies to the consolidated group, which can compel data production regardless of where servers are located. European-incorporated operators such as Mullvad (Sweden, EU-owned, CLOUD Act exposure: None) and OVPN (Sweden, EU-owned, CLOUD Act exposure: None) have no US parent company that can be compelled this way. Swiss operators such as Proton VPN (CLOUD Act exposure: None) operate under Swiss law, which has comparable or stronger privacy protections in practice.

No-logs claims are where VPN marketing and evidence most often diverge. Every VPN says it keeps no logs; the question is what evidence supports that claim. Independent technical audits of server infrastructure, published transparency reports, and documented records of legal requests that produced no usable data all strengthen the claim. Mullvad and Proton VPN have both published third-party infrastructure audits; IVPN maintains a transparency report. When comparing providers, weigh the assertion against the evidence offered for it rather than the wording of the policy page itself.

Showing all 10 alternatives in this category updating

		Cert.	Pricing	Signals	Open
Proton VPN CERN-founded Swiss VPN (Proton AG, Geneva), owned by non-profit Proton Foundation; 15,000+ servers, audited no-logs, open-source apps, free tier.	GENEVA · CH Switzerland	—	Freemium €5 /mo	Public DPA Sub-processors Open source	→
AirVPN Italian hacktivist-founded VPN (Perugia, 2010), no-logs, port forwarding, but no longer serves Italian residents (Piracy Shield).	— Italy	—	Paid €7 /mo	Public DPA Sub-processors Open source	→
IVPN Gibraltar-incorporated VPN (IVPN Limited / ex-Privatus, founded 2009), Cure53-audited no-logs, open-source apps, independent ownership.	— Gibraltar	—	Paid €6 /mo	Public DPA Sub-processors Open source	→
Mullvad VPN Swedish founder-owned VPN (Mullvad VPN AB / Amagicom AB, Gothenburg, 2009), anonymous numbered accounts, Cure53-audited, flat €5/month.	— Sweden	—	Paid €5 /mo	Public DPA Sub-processors Open source	→
OVPN Swedish founder-owned VPN (OVPN Integrität AB, est. 2014), fully owns hardware, diskless RAM-only, court-proven no-logs, legal-fees insurance.	— Sweden	—	Paid €4 /mo	Public DPA Sub-processors Open source	→
Surfshark NL-incorporated VPN (Surfshark B.V., Amsterdam, KvK 81967985): moved from BVI to NL Oct 2021, merged with Nord Security 2022, RAM-only, Deloitte-audited.	— Netherlands	—	Paid €3 /mo	Public DPA Sub-processors Open source	→
AzireVPN Swedish privacy VPN (Stockholm, est. 2012): Blind Operator, RAM-only, audited no-logs; acquired by Malwarebytes (US) 7 Nov 2024.	— Sweden	—	Paid	Public DPA Sub-processors Open source	→
CyberGhost Romanian-operated VPN (CyberGhost S.R.L., 2011) under Kape Technologies (UK; ex-Crossrider) → Unikmind/Teddy Sagi (IM) since 2023; listed as a warning.	BUCHAREST Romania	—	Paid €2 /mo	Public DPA Sub-processors Open source	→
NordVPN Panama-incorporated VPN (NordVPN S.A.) under NL holding Nord Security, LT operations; Deloitte + PwC no-logs audits, RAM-only diskless servers, ISO 27001.	— Lithuania	ISO/IEC 27001	Paid €4 /mo	Public DPA Sub-processors Open source	→
Opera VPN Oslo-heritage browser VPN (Opera Norway AS): Deloitte-audited free browser proxy + paid VPN Pro, but ultimately Chinese-controlled via Kunlun Tech (Opera Limited, Cayman/NASDAQ). Listed as a warning.	— Norway	—	Freemium €4 /mo	Public DPA Sub-processors Open source	→

Feature comparison

Beyond compliance: how these alternatives compare on the capabilities you actually use day to day.

Feature	Proton VPN	AirVPN	IVPN	Mullvad VPN	OVPN	Surfshark	AzireVPN	CyberGhost	NordVPN	Opera VPN
Servers	20000 servers	514 servers		548 servers		4500 servers	153 servers
Countries	140 countries	23 countries		50 countries		100 countries	62 countries	100 countries	125 countries
Simultaneous devices	10 devices	5 devices	2 devices	5 devices	4 devices	Unlimited	5 devices	7 devices	10 devices	6 devices
Protocols	WireGuard OpenVPN IKEv2	WireGuard OpenVPN	WireGuard OpenVPN IKEv2	WireGuard	WireGuard OpenVPN	WireGuard OpenVPN IKEv2	WireGuard	WireGuard OpenVPN IKEv2	WireGuard OpenVPN IKEv2
Kill switch	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	No
Audited no-logs	Yes	No	Yes	Yes	No	Yes	Yes	Yes	Yes	Yes
Port forwarding	Yes	Yes	No	No	Yes	No	Yes	No	No	No
Platforms	iOS macOS Windows Android Linux	iOS macOS Windows Android Linux	iOS macOS Windows Android Linux	iOS macOS Windows Android Linux	iOS macOS Windows Android Linux	iOS macOS Windows Android Linux	iOS macOS Windows Android Linux	iOS macOS Windows Android Linux	iOS macOS Windows Android Linux	Windows macOS Android

SWITCHING GUIDES

Switching from US vpn?

Side-by-side European alternatives (same hosting, ownership and CLOUD Act checks) for the US tools most often replaced in this category.

FAQ

Frequently asked questions

What is the best EU-hosted VPN?

Mullvad VPN (Sweden) and OVPN (Sweden) are the strongest EU-owned and EU-operated options: both are Swedish-incorporated, with published privacy policies and GDPR commitments (CLOUD Act exposure: Mullvad None, OVPN None). IVPN (Gibraltar) and Proton VPN (Switzerland) are also strong privacy-architecture choices (CLOUD Act exposure: IVPN None, Proton VPN None). IVPN publishes a transparency report, Proton VPN has published independent infrastructure audits. For buyers specifically requiring an EU-incorporated operator, Mullvad and OVPN are the strongest starting points. Proton VPN is Swiss-based and is the most widely audited privacy VPN globally.

Is there a GDPR-compliant VPN?

Yes. VPNs operated by EU-incorporated companies with EU-only infrastructure and published privacy policies fall within GDPR's scope. Mullvad (Sweden) and OVPN (Sweden) both publish detailed privacy policies with explicit GDPR commitments. That said, a VPN's privacy posture is largely determined by its logging practices and technical architecture. GDPR compliance is a legal framework, not a substitute for independently audited no-logs architecture.

Does VPN traffic fall under the US CLOUD Act?

A VPN operated or ultimately owned by a US-incorporated company falls within CLOUD Act jurisdiction, which can compel the company to produce data it controls regardless of server location. European-incorporated operators such as Mullvad (Sweden, CLOUD Act exposure: None), OVPN (Sweden, CLOUD Act exposure: None), and AirVPN (Italy, CLOUD Act exposure: None) have no US parent company that can be compelled this way. What this tracks is corporate control, not evidence of any actual legal demand having been served.

Does a VPN make me anonymous online?

No. A VPN is designed to encrypt traffic between your device and the VPN server and to replace your visible IP address with the server's. It does not make you anonymous: your account, payment method, browser fingerprint, logged-in services, and device behaviour can all still identify you. A VPN reduces certain kinds of network-level visibility (for example, hiding your traffic from your internet service provider), but anonymity depends on your broader setup, not on the VPN alone.

How much weight should I give a 'no-logs' claim?

A no-logs claim on its own is a policy statement. It is considerably more credible when backed by independent technical audits, a published transparency report, or a documented history of responding to legal requests with no usable data. Mullvad and Proton VPN have both published independent infrastructure audits. IVPN maintains a transparency report. Treat audits and transparency reporting as the evidence; the claim is the assertion they support.

Why do some European VPNs not appear on mainstream ranking lists?

Some privacy-focused European VPNs (notably Mullvad and IVPN) decline affiliate and paid-marketing relationships on principle. Because a significant share of 'best VPN' content elsewhere is monetised through affiliate links, providers that opt out can be underrepresented or absent from those lists. Absence from a commercial ranking is not a verdict on the product; it is a fact about how such lists are funded.

What is the difference between Mullvad, Proton VPN, and NordVPN from a compliance perspective?

Mullvad (Sweden) and Proton VPN (Switzerland) are the two strongest options on EU Vetted in terms of compliance architecture: independently audited, published transparency reports, no-account-ID Mullvad cash payment accepted, Swiss or Swedish legal base (CLOUD Act exposure: Mullvad None, Proton VPN None). NordVPN is registered in Lithuania (EU) but has a complex ownership structure and sub-processor concerns documented in its DPA. Its EU registration does not resolve those gaps. Compliance assessment reflects corporate structure, sub-processors, and audit evidence, not just country of registration.