Disclosure Partner links are marked. We may earn a commission if you use one. It costs you nothing extra and never changes our verdict. How we review
The best VPN for traders in 2026 is the service whose logging policy, legal home and kill switch you can read on the provider's own site, not the one with the loudest speed claim. On that rule, NordVPNPartner is the first name here: the company says the VPN operates under Panama law, its 3 February 2026 post describes a Deloitte review of the no-logs setup finished on 12 December 2025, and the kill-switch page names the major apps. We compared features, published specs, jurisdiction, audits and the price each provider listed. We did not lab-test speeds, and every figure below should be checked on the provider's site before you pay.
The list has six names. Only NordVPN is a partner link. ExpressVPN, Mullvad, Proton VPN, CyberGhost and Private Internet Access are here so the list is not a single advertisement. None of them is a button.
How we picked the best VPN for traders
The rule is the same for every name, and it is a reading rule. We did not install the apps, open accounts, or time a connection. A pick earned its place when the provider's own pages, opened on 10 November 2026, answered five questions in public text.
- Logs. What the company says it does not store: browsing, DNS lookups, IP addresses tied to a session, timestamps, bandwidth. A slogan is not enough. We looked for a policy page or a privacy policy that lists the categories.
- Jurisdiction. The country the company itself names for the VPN business, and, where the same pages name a parent or a postal address, that fact too. A parent in one country and an operating company in another are both facts. We do not collapse them into one.
- Outside review. The firm, the year, the standard if they name one, and the kind of conclusion. A reasonable-assurance line is not the same thing as a limited-assurance line. A code review of an app is not the same thing as a review of whether servers keep session logs. If the full report was behind a login or a terms click, we say so, and we do not pretend we read it.
- Kill switch and apps. Whether a page says the app blocks ordinary internet traffic when the tunnel drops, on which systems, and whether that block is on by default. A switch you never enable does not help a login.
- Price and payment. The figure on the pricing page that day, the renewal after the intro term, the device count, and the payment methods the page actually lists. Intro prices are advertising. The renewal is the bill.
What this rule does not do: it does not rank speed, streaming, or "works with my broker". We have no timing data. NordVPN's features page calls the service the fastest and footnotes tests by Artifact Security in June 2026 and West Coast Labs in October 2025. Those are NordVPN's citations. They are not a test we ran, and they are not a reason this list puts NordVPN first.
An outside review is a point in time. Deloitte, KPMG or Securitum can say what they saw on the days they were in the systems. They cannot see a change made the next month. The company paid for the engagement. That does not make the report useless. It means you should read the date and the sentence, not a badge.
Prices move, and they move by country. A page opened from one network can show a different intro from a page opened in another. Sales tax, where the page mentions it, is extra. The numbers in this article are the numbers on the pages we opened on 10 November 2026. If the provider's site disagrees today, the site wins.
The six picks, in the order the rule produced
NordVPN is first because all five questions had a page. Mullvad is second because the payment model is the clearest if you do not want an email on the VPN account, even without a Deloitte-style no-logs opinion. Proton VPN is third because Switzerland, open-source apps and a 2026 Securitum write-up are all on the company's site, and the free plan's limits are specific. ExpressVPN, CyberGhost and Private Internet Access follow on the same rule: each one had a logging statement, a place, a named review and a price block, with the weaknesses written in the cons rather than smoothed out.
NordVPN
NordVPN's support article on where the service is based says the VPN operates under the jurisdiction of Panama, and that the parent, Nord Security, is in the Netherlands. The article says Panama has no mandatory data-retention law that would force the VPN to store logs. That is the company's statement of the law, not a legal opinion from us.
The no-logs post of 3 February 2026 says this was the sixth outside review. Deloitte Lithuania did the work under ISAE 3000 (Revised), between 10 November and 12 December 2025, and issued the report on 12 December 2025. NordVPN says Deloitte looked at ordinary servers and at specialty ones, including Double VPN, obfuscated servers and Onion over VPN, and concluded that the systems were designed and implemented in line with the no-logs statement. The same post says the full report is technical and is available inside a Nord Account. We did not log in, so we did not read the report. We read NordVPN's description of it.
An older FAQ on the server page still says the no-logs policy has been audited four times. That line is behind the February 2026 post. When two NordVPN pages disagree, we use the later dated post for the count, and we mention the stale line so you can see it.
The server FAQ on the same page says NordVPN has 7,064 servers covering 150 countries. The features page, read the same day, says servers across 225 or more locations. Locations are not the same thing as countries: one country can have many cities. Both sentences are theirs. We did not count servers.
The kill-switch page says the feature exists on Windows, macOS, Android, iOS and Linux. On Windows you can choose an app-level block or a system-level block. The help text says the switch is off by default on Windows, Android, macOS and Linux. Turn it on before a session. Android also has the system's "always-on VPN" behaviour from Android 7, which the page describes.
The features page also describes split tunneling, a second encryption hop it calls Double VPN, obfuscated servers, a private DNS, and a dedicated IP you add at checkout. The pricing table showed that dedicated IP as an add-on on Basic, Complete and Prime. Up to 10 devices sit on one account, on every tier we saw.
The pricing page title says you can pay by card, crypto or PayPal. On the 2-year block, Basic was $3.49 a month, $94.23 for the first 27 months (the page adds 3 months), then $139.08 a year. Complete was $3.99 a month and $107.73 for those 27 months, then $219.48 a year. Prime was $6.99 a month and $188.73, then $296.28 a year. Sales tax may apply, which the page says. Complete and Prime add other tools, including a password manager and, on Prime, identity features. If you only want the tunnel, Basic is the line to compare. The pricing table includes a 30-day refund. Read the current terms on their site.
Support, on the features page, is email or live chat, described as around the clock. We did not open a ticket.
Mullvad
Mullvad VPN AB lists a Gothenburg postal box on the pricing page: Box 53049, 400 14 Gothenburg, Sweden. The "why Mullvad" page calls Sweden a safe place for a VPN under the laws that apply to the company. It also says the account asks for no personal information, not even an email.
The no-logging page, last updated 17 June 2026, says Mullvad does not log traffic, DNS requests, connections, timestamps, IP addresses or bandwidth. It does describe what a payment record looks like, and it says identifiable payments such as a bank wire, PayPal or a card can mean personal data is processed under GDPR. Cash is different: the page says the envelope is shredded after the time is added to the numbered account, and that the company has no way to prove who generated the account. The currencies it lists for cash are EUR, USD, GBP, SEK, NOK, CHF, CAD, AUD and NZD.
The price is the unusual part. The pricing page shows €5 a month including VAT, for one month, one year or longer, and it showed a dollar equivalent of $5.61 on the day we read it. Cryptocurrency is discounted 10 percent on that page, because of lower fees. There is no intro cliff. Devices: five per account. The page says there is no free plan, on purpose.
The app help describes a kill switch that is always on from the moment you connect until you disconnect, and that cannot be turned off in settings. A separate Lockdown mode also blocks the internet after you disconnect or quit. The help page warns that Lockdown mode means the computer needs Mullvad in order to reach the internet at all, and that apps you exclude with split tunneling still get out.
We did not find, on the pages we opened, a single no-logs assurance report of the Deloitte or KPMG kind. What we did find were other reviews Mullvad has published around its software. Assured Security Consultants reviewed the GotaTun code between 19 January and 15 February 2026. X41 D-Sec reviewed the public API and connected services in October 2025 and dated its public report 20 January 2026. Those are code and service reviews. They are not a certificate that no session log exists. The server help says VPN servers run from RAM, are owned or are dedicated rented machines, and are not virtual locations. The live server page is a status board, and we did not take a total off it.
The refund line on the pricing page is 14 days, and it excludes cash, which the page ties to anti-money-laundering rules.
Proton VPN
Proton's pricing page ends with Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland. The no-logs feature page says Swiss law does not obligate the company to retain connection logs, and that the no-logs policy applies to every user, including the free plan. The company says it does not log pages visited, session length or IP address.
The audit post, updated 16 June 2026, says this was the fifth year of an outside review by Securitum. The post quotes the 2026 report: the evidence reviewed did not indicate that the examined servers logged browsing, DNS queries, destination services, traffic contents or user-identifiable connection metadata, and Securitum did not identify persistent records tying a specific user to activity on a reviewed server. That is Proton's quotation of the report. The post links the report. We are relying on the quotation as published, and on the date.
The kill-switch page says the switch blocks traffic if the VPN drops, and that it is on every plan, including the free one. The features page also describes an always-on reconnect, and a Secure Core hop. The pricing comparison we read did not spell out which paid tier includes Secure Core. Confirm that on the plan table the day you subscribe. Do not assume the free plan has the extra hop.
VPN Plus, the paid VPN plan, was listed at $2.99 a month, billed at $35.88 for the first 12 months, then $83.88 every 12 months. The page said 10 devices, highest speed, and 20,000 or more servers in 140 or more countries. Proton Unlimited, at $6.49 a month for the first year and $77.88 up front, then $119.88 a year, bundles other Proton products. Compare Plus if you want the VPN line.
The free plan, on the same page, is $0, one device, medium speed, and servers in 10 countries selected at random. Streaming and the malware blocker are marked as not included on the free column we read. No-logs is marked included. Payments listed in the FAQ: Visa, Mastercard, American Express, PayPal, or Proton credits. The FAQ says credits can be bought with cash, a bank transfer or Bitcoin once you have an account. A refund, if you ask within 30 days, is described in that FAQ. Read the terms.
The pricing page says the apps are open source. We did not audit the code.
ExpressVPN
The privacy policy says ExpressVPN does not log browsing history, traffic destination, data content, DNS queries, your IP address, the VPN IP address you were given, connection timestamps or session duration. It says the headquarters and registered place of business are in the British Virgin Islands, and that Express Technologies Ltd. operates under BVI law. It also says personal data is controlled by that BVI company, not by the ultimate holding company, which it names as Kape Technologies PLC in the UK. Both sentences matter. The operating company and the owner are not the same address.
The 25 June 2025 post says KPMG examined TrustedServer and the privacy-policy claims as of 28 February 2025, under ISAE (UK) 3000 Type 1, and provided reasonable assurance that the systems worked as designed, with no identified issues in the technical safeguards against activity logging. The post calls this KPMG's second assessment and the page title says a third KPMG audit. The trust-center list names earlier KPMG privacy work as well, including 2022 and 2023. The full 2025 report, the post says, is available after you accept KPMG's terms. We did not click through into the report.
The pricing page, in US dollars, showed three 28-month plans. Basic was $2.99 a month, $83.72 for the first 28 months, then $99.95 a year, with 10 devices and servers in 113 countries. Advanced was $4.19 a month and $117.32 up front, then $119.95 a year, with 12 devices. Express Pro was $7.19 a month and $201.32 up front, then $199.95 a year, with 14 devices and a dedicated IP included. Advanced and Pro add other products, from a password store to identity tools. For a VPN comparison, use Basic. The page says sales tax can apply at checkout. It also says a first-time user who is not satisfied in the first 30 days can ask support for a refund.
The kill-switch page describes an Internet Kill Switch that blocks traffic, including DNS, if the tunnel drops, until the tunnel is back. The page presents it as active with the app rather than as a switch buried in settings. We did not install the app to confirm the default. Platforms, from ExpressVPN's own description pages, include the major desktop and mobile systems and the company's router. Check the download list on their site for the device you use. We are not repeating a device matrix we did not see as a single table on the pricing page, beyond the "multiplatform apps" line that table does include.
CyberGhost
The homepage says CyberGhost is headquartered in Romania and that the company does not track, share or sell user data. A FAQ on that page says the firm does not track, store or hand over browsing activity, and that Deloitte inspected the servers and management systems. The homepage also lists servers in 100 countries, an automatic kill switch, apps for Windows, macOS, Android, iOS and Linux, router setup, and up to 7 devices at once.
The price block on 10 November 2026: $2.19 a month for 2 years plus 4 months, billed at $61.32 for those 28 months, then $61.32 a year. The monthly plan renews at $12.99. Amounts are in US dollars, the page says. The long plan's refund window, as the homepage describes it, is 45 days. The monthly plan's is 14 days. Payment methods were not in that block. Check the checkout.
The report we opened is from Deloitte Audit Romania, engaged by CyberGhost S.R.L. It is a limited-assurance review under ISAE 3000 (Revised), as of 31 October 2025. The conclusion is the limited-assurance formula: nothing came to the auditors' attention to make them believe the configuration was not prepared, in all material respects, in line with the company's description. That is weaker, on purpose, than "in our opinion the system is as described". CyberGhost's own pages also point to earlier Deloitte work in 2022 and 2024. The company's FAQ says Deloitte concluded that no user data is stored. The report's own sentence is the one to remember, and it is narrower than that FAQ line. The report says it does not cover any other date.
The homepage says the kill switch and DNS-leak protection are part of the product. It does not, in the text we read, say whether the switch is on by default. Turn it on and look.
Private Internet Access
The privacy policy names Private Internet Access, Inc., with a legal-department address at 2590 Welton Street, Suite 200, Denver, CO 80205, United States. It says personal data is stored primarily in the United States, and that an email address and a payment are what the signup collects. It says the company does not collect browsing history, connected content, user IPs, connection timestamps, bandwidth logs or DNS queries. It also says that neither PIA nor anyone at Kape Technologies logs browsing or individual connection data beyond what the policy lists. Payments it names: Stripe, Amazon Payments, BitPay and PayPal. It says anonymous payment methods exist. An email is still required, which is a different model from Mullvad's numbered account.
The no-logs page says the policy was tested in US court proceedings in 2016 and 2017, and that the company could not produce browsing records because it does not keep them. We did not read the court papers. The page also says Deloitte reviewed the setup in 2022, 2024 and 2025 under ISAE 3000 (Revised). The 2024 report we opened is a limited-assurance engagement for Private Internet Access, Inc., concluded as of 31 January 2024, with the same "nothing has come to our attention" form as CyberGhost's 2025 report. We did not open a separate 2025 PDF, so we do not describe that year's conclusion in our own words. The page says servers are RAM-only and are rebooted so that memory is wiped.
The same no-logs page says you can choose from 180 server locations across 113 countries. The order page also says 113 countries, including all 50 US states, and unlimited devices on one subscription. A company blog post dated 15 October 2026 said the network had reached 179 locations in 112 countries after an expansion. The two counts are a few weeks apart and they do not match. Use the in-app list. The server page also explains virtual locations: some country names are IPs that exit elsewhere, and it gives India via Singapore as an example. If you care where the machine sits, read that list before you connect.
The kill switch, on the no-logs page, blocks internet traffic until the VPN reconnects. A Windows help article dated 14 July 2026 says that kill switch is on by default, and that an advanced switch can keep blocking even when the app is closed. We did not confirm the default on macOS, Android or iOS from a page we saved. Check the app.
The order page, in US dollars, showed a monthly renewal of $11.95, a one-year price of $47.88 that renews at $47.88 a year, and a three-year renewal of $81.20 every three years. It also showed an introductory discount marked 83 percent off. The introductory total was not a clean figure in the text we captured, so we are not printing one. New subscribers can ask for a refund within 30 days, the page says, and app-store purchases follow the store's rules.
- 01
NordVPN
NordVPN's support page says the VPN operates under Panama law, and its 3 February 2026 post says Deloitte Lithuania reviewed the no-logs setup from 10 November to 12 December 2025. The kill-switch page names Windows, macOS, Android, iOS and Linux, and says you have to turn the switch on.
- Sixth no-logs review named on the 3 February 2026 post, report date 12 December 2025
- Kill switch documented for each major app
- Basic plan price was on the pricing page: $94.23 for the first 27 months
- The switch is off until you enable it, on the apps the help text names
- The same Basic plan renews at $139.08 a year on the page we read
- The full Deloitte report sits behind a Nord Account, so we did not read it
Visit NordVPN Partner
- 02
Mullvad
Mullvad's pricing page lists €5 a month including VAT, the same rate for a month or a year, and it accepts cash. The no-logging page, updated 17 June 2026, says the company does not keep activity logs, and the app help says the kill switch is on from the moment you connect.
- No email on the account: you get a number
- Cash, Bitcoin, Monero and ordinary cards are all on the pricing page
- Kill switch cannot be switched off while you are connected, per the app help
- Five devices, not ten
- We did not find a Deloitte-style no-logs opinion on the pages we opened
- A cash payment cannot be refunded, which the pricing page ties to anti-money-laundering rules
- 03
Proton VPN
Proton's pricing page places the company in Switzerland and lists VPN Plus at $2.99 a month for the first year, billed at $35.88. The audit post updated 16 June 2026 says Securitum's 2026 review did not find browsing or connection logs on the servers it examined, and the kill switch is on every plan, including the free one.
- Switzerland, and a no-logs claim that covers the free plan on the features page
- Open-source apps, as the pricing page states
- Kill switch on the free plan as well as the paid plans
- The free plan is one device, medium speed, and servers in 10 countries picked at random
- The first-year price renews at $83.88 a year
- Secure Core, the extra hop, needs a check on the current plan table before you assume it is included
- 04
ExpressVPN
The privacy policy says Express Technologies Ltd. operates in the British Virgin Islands and does not keep browsing, DNS or connection logs. A 25 June 2025 post says KPMG examined TrustedServer and those claims as of 28 February 2025 and gave reasonable assurance.
- KPMG review dated to 28 February 2025, under ISAE (UK) 3000
- Pricing page: servers in 113 countries, and 10 devices on the Basic plan
- The pricing page says a new user can ask support for a refund in the first 30 days
- Basic renews at $99.95 a year after an intro term of 28 months
- Higher tiers bundle other products, so the VPN line is the Basic price
- The privacy policy names Kape Technologies PLC in the UK as the ultimate holding company
- 05
CyberGhost
CyberGhost's homepage says the company is headquartered in Romania, with servers in 100 countries, a kill switch, and up to 7 devices. A Deloitte Audit Romania report we opened is a limited-assurance review of the no-logs setup as of 31 October 2025.
- Romania headquarters, stated on the homepage
- The 28-month price was $2.19 a month, $61.32 up front, on 10 November 2026
- The Deloitte report is a public PDF, not locked behind an account
- The opinion is limited assurance: nothing came to the auditors' attention, which is a narrower line than a reasonable-assurance conclusion
- Renews at $61.32 a year
- Payment methods were not in the pricing block we read
- 06
Private Internet Access
The privacy policy gives a Denver address for Private Internet Access, Inc., and says the company stores personal data primarily in the United States. The no-logs page lists Deloitte reviews in 2022, 2024 and 2025, and says a kill switch blocks traffic until the VPN reconnects.
- Unlimited devices on the order page
- Open-source apps, stated on the order page and in the privacy policy
- Windows help article of 14 July 2026: the kill switch is on by default
- US storage of account data, which some traders will not want
- The 2024 Deloitte report we opened is limited assurance as of 31 January 2024; we did not open a 2025 PDF
- The order page showed an 83 percent intro cut, but not a clean intro total in the text we captured
Comparison table: logs, home, kill switch and price
The first table is the short form of the rule. The second is the awkward detail: server counts that do not match inside one company, device caps, how you can pay, and what kind of outside review we actually saw. Prices are introductory where the page was an intro, and the renewal is in the price section below. All of them were read on 10 November 2026. Check the provider's site.
| Pick | Best for | Logging, as the company states it | Legal home, as stated | Kill switch | From-price we could read |
|---|---|---|---|---|---|
| NordVPN | A named 2025 review plus apps | No connection or activity logs, per the Feb 2026 post | Panama for the VPN; parent in the Netherlands | Windows, macOS, Android, iOS, Linux; off until you enable it | $3.49/mo Basic, $94.23 for 27 months |
| Mullvad | Paying without an email | No activity logs, policy updated 17 June 2026 | Sweden, Gothenburg | Always on while connected; Lockdown mode is extra | €5 a month, including VAT |
| Proton VPN | Switzerland and open-source apps | No activity or connection metadata, free plan included | Switzerland, Geneva | Every plan, including free | $2.99/mo Plus, $35.88 for the first year |
| ExpressVPN | A 2025 KPMG review | No browsing, DNS, IP or session logs, per the privacy policy | British Virgin Islands; UK holding company named | Internet Kill Switch described on their feature page | $2.99/mo Basic, $83.72 for 28 months |
| CyberGhost | A public limited-assurance report | No browsing or connection logs, per the homepage and the report | Romania | Homepage lists an automatic kill switch; default not stated | $2.19/mo, $61.32 for 28 months |
| Private Internet Access | Unlimited devices, open-source apps | No browsing, IP, timestamp or DNS logs, per the privacy policy | United States, Denver address | Blocks traffic until reconnect; Windows default on, per July 2026 help | $11.95/mo, or $47.88 for one year |
| Pick | Places, as published | Devices | Payment we saw listed | Outside review we can name |
|---|---|---|---|---|
| NordVPN | FAQ: 7,064 servers, 150 countries. Features: 225+ locations | 10 | Card, crypto or PayPal | Deloitte Lithuania, ISAE 3000, report 12 Dec 2025; full text behind an account |
| Mullvad | RAM-only, owned or dedicated rented; no total taken | 5 | Cash, Bitcoin, Bitcoin Cash, Monero, bank wire, card, PayPal, and several EU methods | Code and API reviews in 2025 and 2026; not a no-logs assurance opinion |
| Proton VPN | 20,000+ servers in 140+ countries on Plus | 10 on Plus; 1 on free | Card, PayPal, or credits via cash, bank or Bitcoin | Securitum, 2026, quoted on the audit post updated 16 June 2026 |
| ExpressVPN | 113 countries on the pricing page | 10 on Basic | PayPal and credit card, from the pricing page | KPMG, as of 28 Feb 2025, reasonable assurance; report behind KPMG's terms |
| CyberGhost | 100 countries on the homepage | 7 | Not in the price block we read | Deloitte Audit Romania, limited assurance, as of 31 Oct 2025 |
| Private Internet Access | 180 locations in 113 countries on the no-logs page; a 15 Oct 2026 post said 179 in 112 | Unlimited, on the order page | Stripe, Amazon Payments, BitPay, PayPal, plus anonymous methods the policy mentions | Deloitte, page lists 2022, 2024, 2025; 2024 report we opened is limited assurance as of 31 Jan 2024 |
Two reading notes sit under those grids.
A limited-assurance report says the auditor did not see evidence that the description was wrong. A reasonable-assurance report, which is what NordVPN and ExpressVPN say they received, is a positive conclusion: in the auditor's opinion the description holds. Neither one is a promise about next month. Mullvad's published reviews are real and they are about code and the API, which is a different question from "do the VPN servers keep session logs".
Server marketing drifts. NordVPN's own FAQ and features page do not use the same geography. PIA's October blog and its November no-logs page do not use the same counts. We printed both. We did not pick the larger number and call it checked.
What traders should check before a session
A trading login is a password, a second factor, and a network path. A VPN only touches the path. Before you type the password on a network you do not control, the order is short.
Connect the VPN first. Confirm the app shows a tunnel, not a spinning icon. Turn the kill switch on if the app does not force it. NordVPN's own help says the switch is off until you enable it. Mullvad's help says the opposite: the block is already there while you are connected. Proton says the switch is there on the free plan too. The point is to look at the app in your hand, not at this paragraph.
Then open the platform. If the tunnel drops, a system-level kill switch should stop the browser rather than let the login page load on the cafe network. That is what the kill-switch pages describe. We did not sit in a cafe and try it.
A DNS leak is the quiet version of the same failure. The page contents may stay encrypted while the lookup of the site name goes to the network's own resolver. The network then sees which platform you opened. Several of these companies say their apps prevent that. NordVPN's features page points readers at a DNS leak test. We did not run one. After you install, use the provider's own check, or a check you already trust, and do it before you rely on the tunnel.
The platform still sees the account. It sees the device fingerprint it already collects, the two-factor prompt, and the orders. A VPN does not delete that. It also does not stop a person who has the password. Turn on the platform's two-factor authentication. Keep the password in a password manager, which is a different product and not one this article reviews. Those two steps matter more, on a trusted home line, than the VPN does.
Some platforms restrict the countries they will open an account for, or the countries they will let you trade from. A VPN that makes the session look as if it comes from somewhere else can break those terms, and it can also trip a fraud check that freezes the login. This page does not review brokers, does not name a broker rule, and does not suggest hiding a country you are not allowed to use. If the terms say the service is not offered where you live, a tunnel is not a permission slip. Read the platform's own terms.
The trade itself is a separate problem. A VPN does not change the gold price on Baroq Markets, and it does not change how large a position should be. The position size calculator asks what a stop-out may cost. Work that out before you care which city the VPN server sits in. The free guides cover lot size, pip value and what moves the gold price. The free tools are the same idea in calculators. None of that is a VPN feature.
Public Wi-Fi, DNS and the kill switch
Public Wi-Fi is the case where this list earns its keep, and it is a smaller subject than the advertising around it. On a hotel, airport or cafe network, the network can see the names of the sites you open if those lookups are not inside a tunnel. A VPN's job is to put the lookups and the traffic inside the tunnel, so the network sees a connection to the VPN server and not much else.
That trade has a cost, and it is the VPN company. If the VPN keeps session logs, you have moved the record from the cafe to the VPN. That is why the logging policy and the legal home are the first two questions, ahead of the server map. A no-logs sentence that has never been reviewed by an outsider is still a sentence. A reviewed one is better evidence, and it is still evidence about a date, not about forever.
The kill switch is the piece that covers the gap when the tunnel fails. Hotel Wi-Fi drops. Laptops wake. Phones switch from Wi-Fi to a mobile network. In that gap, without a switch, the platform login can leave on the open network for a few seconds. With a system-level switch, the device goes quiet instead. The cost of the switch is that everything pauses, including a price page you wanted to glance at. That is the right failure mode for a login. It is an annoying failure mode for a chart you were only watching. Mullvad's Lockdown mode, which also blocks traffic when you quit the app, is stricter still. Use the strict version for the session where you type a password. You can relax it when you are done, if the app lets you.
None of this makes the platform safe, and none of it changes market risk. A VPN is not two-factor authentication, and it is not a password. On a home connection you trust, you can trade without one. On a network you do not control, connect first, confirm the switch, then log in.
How to choose the right VPN
Three checks, in this order. Skip a name that fails the first one, even if the intro price is the lowest on the page.
- Jurisdiction and logs first. Read the logging categories in the privacy policy, not the homepage badge. Then read where the company says the VPN business lives, and where it says account data is stored. Those can differ. NordVPN says Panama for the VPN and the Netherlands for the parent. ExpressVPN says the British Virgin Islands for the operating company and names a UK holding company. PIA prints a Denver address and says account data is stored in the United States. Mullvad is in Sweden. Proton is in Switzerland. CyberGhost says Romania. If you cannot find the sentence, do not guess it from a review site.
- Apps and a kill switch second. The switch has to exist on the system you will actually use, and you have to know if it starts off. A Windows article does not prove the iPhone app. Router setup, where you want the whole desk on one tunnel, is a separate download. NordVPN, CyberGhost and ExpressVPN all mention routers somewhere on the pages we read. Confirm the steps on the provider's site, because firmware pages go stale.
- Price and payment third. Compare the renewal, not the percentage off. Then decide whether the payment itself exposes the trading identity. Mullvad will take cash against an account number and does not ask for an email. Proton will take credits bought with cash or Bitcoin, after an account exists. PIA requires an email and also says anonymous payment methods exist. NordVPN's pricing page title lists card, crypto or PayPal. ExpressVPN's pricing page title lists PayPal and credit card. CyberGhost's checkout we did not capture. A card in your own name, on a VPN account that also has your email, is a normal purchase. It is also a link between you and the service. If that link is the thing you are trying not to create, Mullvad is the page to read next, and the flat €5 is the price to compare after you have accepted Sweden as the legal home.
What to avoid: a free app with no policy page, a "no logs" badge with no firm and no year, and any instruction, from anyone, to use a tunnel so you can trade from a country the platform does not allow. Avoid choosing on a speed chart this article does not have.
Price, renewal and how you pay
Intro prices are a discount on a longer contract. The renewal is what you pay if you forget to cancel. Here is each figure we could read on 10 November 2026, and the renewal beside it. Dividing a yearly renewal by 12 is our arithmetic, shown so the monthly equivalent is obvious. It is not a second price the company printed.
NordVPN Basic. $94.23 for the first 27 months, which the page presents as $3.49 a month plus 3 extra months. Renewal: $139.08 a year. Divided by 12, that renewal is $11.59 a month. Complete renews at $219.48 a year, Prime at $296.28. Sales tax may apply. A 30-day refund is on the pricing table. Card, crypto or PayPal, from the page title.
Mullvad. €5 a month including VAT, and the page showed $5.61 as the dollar equivalent that day. The same rate if you add a year. No intro, no renewal jump. Crypto is 10 percent less on that page. Five devices. Fourteen days to ask for money back, except cash.
Proton VPN Plus. $35.88 for the first 12 months, shown as $2.99 a month. Renewal: $83.88 a year, which divided by 12 is $6.99 a month. Ten devices, 140 or more countries. The free plan is $0 with the limits above. Refund if you ask within 30 days, per the FAQ, subject to the terms.
ExpressVPN Basic. $83.72 for the first 28 months, shown as $2.99 a month. Renewal: $99.95 a year, which is $8.33 a month if you divide by 12 and round to the cent ($99.95 / 12 = $8.329). Ten devices, 113 countries. Higher tiers cost more because they are bundles. Sales tax may apply. A new user can ask for a refund in the first 30 days.
CyberGhost. $61.32 for the first 28 months, shown as $2.19 a month. Renewal: $61.32 a year, which divided by 12 is $5.11 a month. The monthly plan renews at $12.99. Seven devices, 100 countries. Refund window of 45 days on the long plan and 14 days on the monthly plan, as the homepage describes it. US dollars.
Private Internet Access. Monthly renewal $11.95. One year $47.88, renewing at $47.88, which divided by 12 is $3.99 a month. Three-year renewal $81.20 every three years, which divided by 36 is about $2.26 a month. The page advertised an 83 percent intro cut and we are not printing an intro total we could not read cleanly. Unlimited devices. Thirty days for a new subscriber to ask for a refund, with app stores excepted.
Put the renewals in one line and the order of "cheap" changes. Mullvad stays at €5. CyberGhost's renewal is $5.11 a month by division. Proton Plus renews at $6.99 a month by division. ExpressVPN Basic renews near $8.33. NordVPN Basic renews at $11.59. PIA's one-year renewal divides to $3.99, and its monthly plan stays at $11.95 if you do not take the long term. The lowest intro on a banner is not the lowest bill in the second year. Check the provider's site, because a sale can change any of these by the time you click.
Do not buy a two-year term because a page says you will save a large percentage. The percentage is usually the intro compared with the company's own monthly rate, or with the renewal. It is not a comparison against Mullvad's €5, and it is not a comparison against a plan you already have.
A VPN does not lock the account
The tunnel is one step. It is not the lock.
The lock is the platform: a unique password, two-factor authentication, a device you control, and alerts when a new device logs in. A password manager belongs in that list. This article does not name one and does not carry a partner link for one. If the password is reused from an old forum, the VPN is irrelevant.
The money decision is somewhere else again. Whether you hold gold or silver is a holding question, worked through in gold vs silver. How you buy bars and coins, and what you pay above the spot price, is in how to buy physical gold. Neither page depends on a VPN. The live quote is on Baroq Markets. The size of a trade, if you trade, starts from the loss you can accept, which is what the position size calculator is for.
Use the VPN for the path. Use the platform's own security for the account. Use the renewal price, not the badge, when you pay. And read the provider's site on the day you pay: the logging sentence, the address, the kill switch in your app, and the amount that will be charged when the intro ends.
Educational content, not financial advice. Prices, fees and offers change: check them on the provider's own site before you sign up. Trading leveraged products carries a high risk of losing money, and you can lose all of it.
