Step 1: define the job and the boundary
Write down why you want a VPN, which devices and networks it must cover, which countries or gateways you need, and what failure would matter. A consumer VPN can change the network path and visible IP; it does not secure an infected device or make a logged-in account anonymous.
Also distinguish a full-device VPN app from a browser-only proxy. Check split tunneling, kill-switch behavior, IPv6 handling and whether the app routes all traffic you expect. NIST’s remote-access guidance is useful background for thinking about the tunnel as one control in a larger system.
For US readers, the FTC explains that most websites now use encryption. A VPN is an additional network control; it does not replace account security, software updates or checking whether a website is legitimate.
Step 2: examine privacy claims as claims
Read the current privacy policy and list the categories separately: account, payment, support, diagnostics, connection metadata, DNS and browsing activity. “No logs” has no single universal scope.
If an independent report exists, identify the assessor, date, standard, systems, period or point in time, and exclusions. An ISAE 3000 assurance report is not the same thing as a penetration test or app code review. Each can be useful, but for different questions.
Step 3: verify operational fit
Install only from the provider or official app store. Test on the devices and networks you use. Measure repeated performance against a same-session baseline, simulate a tunnel interruption, and check that the app’s routing controls behave as documented. Review the provider’s support and incident communications.
Step 4: compare the complete commercial terms
Record the total billed now, term length, tax, renewal date and rule, cancellation route and refund eligibility. Recheck the live checkout because promotions and then-current renewal prices can change.
The result should be a reasoned fit statement, not a universal winner: what the service was checked for, when it was checked, what remains uncertain, and why it matches your particular use case.