VPN Trust Report - AV-TEST

Transcription

VPN Trust ReportA test commissioned by AnchorFree and performed by AV-TEST GmbHDate of the report: August 27th, 2018IntroductionA Virtual Private Network is a tool to provide anonymity, protect privacy from ISPs and websitescollecting user data, enable security on public Wi-Fi hotspots and circumvent geolocation blocks toavoid censorship. The technologies used and the reliability of the protection has been reviewed andassessed in our previous report1 and should only be one part of an overall review. This report isabout the credibility and trust of companies providing VPN solutions. When using a VPN the usertrusts handing over their privacy to an external private or public company. The VPN provider may beable to access what the user is aiming to protect from the Internet Service Provider and otherparties. The VPN may be able to intercept, sent and received packages, and create a detailed map ofthe user's online behavior. Trust is hard to measure and particularly difficult when we have noinsights into the concerned parties or when the Companies providing the VPN service are nottransparent. In order to find a method of evaluating how trustworthy a company appears, thetransparency in regards to management, the requests for data handling and further company detailsneed to be evaluated. When general information like this, which is commonly known for mostcompanies, is not publicly made available in a clear and obvious manner it raises questions ofresponsibility, credibility and trust.1“VPN Comparative Test.” AV-TEST, 15 June 2018, www.av-test.org/fileadmin/pdf/reports/AV-TEST VPN Comparative Test Report June 2018 EN.pdfCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org1

Executive SummaryWe evaluated the VPN tools on the following four criteria:Transparency Report which provides information on official data requests and how they are handled.Only three products provide this information AnchorFree, Avast and Cisco and only AnchorFreestates that no information at all has been shared.Board of Directors is responsible for overseeing the activities of the company and is mentioned andlisted by roughly half the tested products. Those are AnchorFree, Avast, Cisco, F-Secure, KeepSolid,Pulse Secure and Symantec.In August 2018, AV-TEST performed a test of Virtual Private Networks (VPN) solutions. VPNs havebeen reviewed in different fields of data request transparency, management team and leadershipand jurisdiction.The presented evaluation assesses AnchorFree’s Hotspot Shield Elite, Avast SecureLine, AviraPhantom VPN Pro, Cisco VPN, ExpressVPN, F-Secure FREEDOME VPN, KeepSolid‘s VPN Unlimited,London Trust Media’s Private Internet Access, NordVPN, Pulse VPN, Symantec’s Norton WiFi Privacyand Tunnel Bear now owned by McAfee.The Management team runs the day to day business and every company has it in one form oranother. Yet two vendors made no mention of it: ExpressVPN and NordVPN.Investors trust a company enough to back it by acquiring a stake in that company. We foundinformation for investors for several of the tested companies but the number of companiesdisclosing the actual investors is relatively low with two, those are AnchorFree and F-Secure.The official office address is related to the jurisdiction as this will influence what data has to bestored or with whom it has to be shared. All vendors disclosed their official office locations and byextension the location of their jurisdiction.We asked all vendors to comment on and confirm the findings of this report and that their mainoffices are indeed at the posted addresses. Five vendors replied and confirmed this, those wereAnchorFree, Avast, Avira, KeepSolid and Symantec.Copyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org2

OverviewTransparency Report – Is a regular statement published by a company. The report informs aboutwarrants, subpoenas and other requests for information by government agencies. It is very probablethat a VPN provider will be confronted with such requests, so the report should include how thecompany has responded to the request and what information was disclosed. The statement is inretrospective for a period of time like every 6 or 12 months.The statement may include the requesting authorities, the authorities’ countries of origin, thenumber of requests, the amount and type of data handed over.The Transparency report should be clearly marked as such and be a separate individual page ordocument.Board of Directors - is an organised group of people jointly overseeing the activities of a company.The responsibilities of the board among others are to govern the company with respect to theobjectives, broader policies, justify the company’s actions and performance to the stakeholders andappoint a CEO. The boards’ responsibilities may vary by jurisdiction.The composition of the board member will be reflected in the company’s strategic focus andorientation.Management - is organising the day to day decision and activities. It may include the chief executiveofficer, chief financial officer, chief technology officer and others. They are responsible for achievingthe objectives provided by the board of directors to whom they have to answer for performance andactions. The management team’s skill set, experience and reputation directly reflect on the quality ofthe product and service provided.Investors - are organisations or people backing an organisation with financial capital to gaininfluence, making a financial investment or for broader strategic reasons.The money provided by investors can bring influence and therefore have a direct influence on thestrategic orientation of the company.Official location and Address of the company – Is the geographical location where the company issituated, often registered. From this usually the applied jurisdiction of the company results.Jurisdiction - describes the region or country and the according law the organisation needs to adhereto. The jurisdiction usually derives from where the company is registered. The question of jurisdictiongets more complex with companies operating local branches in different jurisdictions. Thejurisdiction provides the company with rights and obligations. For example, in VPN comparisons, a lotof emphases is put on intelligence agencies and agreements between different jurisdictions, whichmakes annual transparency reports a must to establish the trust of any VPN. Jurisdiction is also veryimportant for what general consumer protections a company must abide by.Ease of access to information – reflects how hard or easy the previously mentioned items can befound for the VPN provider.Copyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org3

Test ResultsAvast – Avast SecureLine VPNDefault webpage: https://www.avast.comTransparency ReportLink: : AnnualDate: 2017, updated January 19, 2018Included: Number of requests from intelligence agencies – 0Number of requests from law enforcements – 28o Countries of disclosure request Czech Republic – 19 France – 3 Italy, Germany, Poland, Sweden, Netherlands, United States - 1Data disclosed – 1o Czech Republic – email IP addressData shared: YesBoard of directorsLink: uency: QuarterlyIncluded: Name, Resume, time of employmentManagementLink: d: Name, Resume, time of employmentInvestorsLink: Publicly traded companyOfficial location and AddressLink: https://www.avast.com/contacts (Avast Software s.r.o)Country of residence: Czech RepublicAddress: Enterprise Office Center, Pikrtova 1737/1A, 140 00 Prague 4Additional addresses: 16Copyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org4

Jurisdiction (country of registration)Link: https://www.avast.com/contactsCountry of jurisdiction: Czech RepublicLocation Main officesLocation: Prague, Czech Republic (confirmed by vendor)Ease of access to informationTransparency report: Easy – “About us”, “Transparency Report”Board: Easy – “About us”, “About us”Management: Easy – “About us”, “About us”Investors: Not availableOfficial location and Address: Easy – “About us”, “Contact us”Jurisdiction: Easy – “About us”, “Contact us”Avira – Avira Phantom VPN ProDefault webpage: https://www.avira.com/Transparency ReportLink: Not availableFrequency: Not availableDate: Not availableIncluded: Not availableData shared: Not availableComment by Vendor in appendixBoard of directorsLink: Not availableIncluded: Not availableComment by Vendor in appendixManagementLink: https://www.avira.com/en/about-aviraIncluded: Name, Resume, time of employmentInvestorsLink: Not availableCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org5

Official location and AddressLink: https://www.avira.com/en/contact (Avira Operations GmbH & Co. KG)Country of residence: GermanyAddress: Tettnang, Kaplaneiweg 1, 88069 Tettnang, GermanyAdditional addresses: USA, China, Romania, NetherlandsJurisdiction (country of registration)Link: https://www.avira.com/en/contactCountry of jurisdiction: Germany (14 eyes)Location Main officesLocation: Germany, Kaplaneiweg 1, 88069 Tettnang (confirmed by vendor)Ease of access to informationTransparency report: Not availableBoard: Not availableManagement: Easy – “About”Investors: Not availableOfficial location and Address: Easy – “About, Contact”Jurisdiction: Not availableCisco – AnyConnect Secure Mobility ClientDefault webpage: https://www.cisco.com/Transparency ReportLink: https://www.cisco.com/c/dam/en us/about/doing sts.pdfFrequency: Twice a yearDate: 01.07.2017 – 31.12.2017Included: National requestso Number of requests for Customer Data – 4, disclosed – 0o Number of requests for Non-Customer Data – 41, disclosed – 2o Number of requests for Emergencies – 0o Number of requests for National Security – 0o Number of CLOUD Act Requests – 0Copyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org6

International Requestso Number of requests for Customer Data – 0, disclosed - 0o Number of requests for Non-Customer Data – 1, disclosed – No Informationo Number of requests for Emergencies – 0Cisco states following definition for customer data – “Customer Data is all data (includingtext, audio, video or image files) that is provided to Cisco in connection with your use of ourproducts or services. Customer Data does not include Administrative Data, Payment Data,Support Data or Telemetry Data, as defined in the Data Definitions document. Requests thatdo not fall into the Customer Data category are listed as “Non- Customer Data.””Data shared: YesBoard of directorsLink: rnance/board-of-directors/default.aspxIncluded: Name, Resume, time of employmentManagementLink: https://newsroom.cisco.com/exec-biosIncluded: Name, Resume, time of employmentInvestorsLink: Publicly traded companyOfficial location and AddressLink: https://www.cisco.com/c/en/us/about.html (Cisco Systems, Inc.)Country of residence: USAAddress: 170 West Tasman Dr., San Jose, CA 95134, USAAdditional addresses: Not availableJurisdiction (country of registration)Link: Not availableCountry of jurisdiction: Not availableLocation Main officesLocation: No confirmation from vendorEase of access to informationTransparency report: Easy – “ABOUT US, The Trust Center”, “Transparency Report”Board: Easy – “Investor relations”, “Corporate Governance”, “Board of Directors”Management: Easy – “ABOUT US, About Cisco”, “Executive Team”Investors: Not availableCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org7

Official location and Address: Easy – “ABOUT US, About Cisco”Jurisdiction: Not availableExpressVPNDefault webpage: https://www.expressvpn.com/Transparency ReportLink: Not availableFrequency: Not availableDate: Not availableIncluded: Not availableData shared: Not availableBoard of directorsLink: Not availableIncluded: Not availableManagementLink: Not availableIncluded: Not availableInvestorsLink: Not availableOfficial location and AddressLink: https://www.expressvpn.com/ (ExpressVPN)Country of residence: British Virgin IslandsAddress: Not availableAdditional addresses: Not availableJurisdiction (country of registration)Link: tionCountry of jurisdiction: British Virgin IslandsLocation Main officesLocation: No confirmation from vendorEase of access to informationTransparency report: Not availableCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org8

Board: Not availableManagement: Not availableInvestors: Not availableOfficial location and Address: Easy – Main pageJurisdiction: Easy – “About ExpressVPN, Privacy Policy”, “Jurisdiction and Applicable Law”F-Secure – F-Secure FREEDOME VPNDefault webpage: https://www.f-secure.com/Transparency ReportLink: Not availableFrequency: Not availableDate: Not availableIncluded: Not availableData shared: Not availableBoard of directorsLink: https://www.f-secure.com/en/web/investors global/management/board-of-directorsIncluded: Name, Resume, time of employmentManagementLink: https://www.f-secure.com/en/web/investors global/management/leadership-teamIncluded: Name, Resume, time of employmentInvestors, ShareholdersLink: Publicly traded company, https://www.f-secure.com/en/web/investors global/shareholdersOfficial location and AddressLink: https://www.f-secure.com/en/web/about global/contact/offices (F-Secure Corporation)Country of residence: FinlandAddress: Tammasaarenkatu 7, P.O. Box 24, 00181 Helsinki, FinlandAdditional addresses: 20 are mentioned on the webpage. According to F-Secure themselves it hasrecently been increased to 25 (confirmed by vendor)Jurisdiction (country of registration)Link: reCountry of jurisdiction: FinlandCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org9

Location Main officesLocation: No confirmation from vendorEase of access to informationTransparency report: Not availableBoard: Easy – “Investors”, “Management”, “Board of Directors”Management: Easy – “Investors”, “Management”, “Leadership Team”Investors: Easy – “Investors”, “Share”, “Shareholders”Official location and Address: Easy – “Offices”Jurisdiction: Medium – “Terms of service”, “Terms of services”AnchorFree – Hotspot Shield EliteDefault webpage: https://www.hotspotshield.com/Transparency ReportLink: https://www.hotspotshield.com/privacy/, version at the time of the Free Transparency Report-11292017.pdfFrequency: AnnualDate: 29.11.2017, period 2017 until 31.10.2017Included: Number of data requests– 81Data disclosed – 0Listing of requests per monthSeparated listing of requests by countrieso United States – 62o France – 7o Germany – 3o India, UK – 2o Canada, Brazil, Switzerland, Czech Republic, Spain – 1Separated listing of requests by typeo Search Warrant – 4o Court Order – 1o Subpoena – 38o Other – 38Definitions on the type of requestsData shared: NoCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org10

Board of directorsLink: https://www.anchorfree.com/about/team/Included: Name, Resume, time of employmentManagementLink: https://www.anchorfree.com/about/team/Included: Name, Resume, time of employmentInvestorsLink: https://www.anchorfree.com/about/team/Included: Name, Resume, time of employmentOfficial location and AddressLink: https://www.anchorfree.com/about/contact/ (AnchorFree Inc.)Country of residence: USAAddress: 1800 Seaport Blvd, Redwood City, CA 94063, USAAdditional addresses: Switzerland (Anchorfree GmbH), UkraineJurisdiction (country of registration)Link: https://www.hotspotshield.com/terms/Country of jurisdiction: USALocation Main officesLocation: 1800 Seaport Blvd, Redwood City, CA 94063, USAEase of access to informationTransparency report: Easy – “Privacy policy”, “Transparency Report”Board: Easy – “About us”Management: Easy – “About us”Investors: Easy – “About us”Official location and Address: Medium – “About us”, “Contact us” (different from “Contact us” onstart page of Hotspotshield)Jurisdiction: Easy – “Terms” - searchNordVPNDefault webpage: https://nordvpn.com/Transparency ReportLink: Not availableCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org11

Frequency: Not availableDate: Not availableData shared: Not availableIncluded: Not availableBoard of directorsLink: Not availableIncluded: Not availableManagementLink: Not availableIncluded: Not availableInvestorsLink: Not availableOfficial location and AddressLink: https://nordvpn.com/contact-us/ (NordVPN.com, Tefinkom co S.A)Country of residence: PanamaAddress: 50th Street Global Plaza Tower, Panama City, PanamaAdditional addresses: Not availableJurisdiction (country of registration)Link: https://nordvpn.com/terms-of-service/Country of jurisdiction: PanamaLocation Main officesLocation: No confirmation from vendorEase of access to informationTransparency report: Not availableBoard: Not availableManagement: Not availableInvestors: Not availableOfficial location and Address: Easy – “Contact Us”Jurisdiction: Easy – “Terms of Services”Copyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org12

Symantec – Norton WiFi PrivacyDefault webpage: https://us.norton.com/Transparency ReportLink: Not availableFrequency: Not availableDate: Not availableIncluded: Not availableData shared: Not availableBoard of directorsLink: anagement-teamIncluded: Name, Resume, time of employmentManagementLink: anagement-teamIncluded: Name, Resume, time of employmentInvestorsLink: Publicly traded companyOfficial location and AddressLink: https://www.symantec.com/contact-us (Symantec Corporation)Country of residence: USAAddress: 350 Ellis Street, Mountain View, CA 94043, United StatesAdditional addresses: 45Jurisdiction (country of registration)Link: https://www.symantec.com/privacyCountry of jurisdiction: USALocation Main officesLocation: 350 Ellis Street, Mountain View, CA 94043, United StatesEase of access to informationTransparency report: Not availableBoard: Medium – Symantec webpage, “About Symantec”, “Management Team”Management: Medium – Symantec webpage, “About Symantec”, “Management Team”Investors: Not availableCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org13

Official location and Address: Medium – Symantec webpage, “Contact UsJurisdiction: Easy – “Privacy Policy”London Trust Media – Private Internet AccessDefault webpage: https://www.privateinternetaccess.com/Transparency ReportLink: Not availableFrequency: Not availableDate: Not availableIncluded: Not availableData shared: Not availableBoard of directorsLink: Not availableIncluded: Not availableManagementLink: cluded: Name, Job titleInvestorsLink: Not availableOfficial location and AddressLink: articles/where-are-you-locatedCountry of residence: USAAddress: Not availableAdditional addresses: Not availableJurisdiction (country of registration)Link: articles/where-are-you-locatedCountry of jurisdiction: USALocation Main officesLocation: No confirmation from vendorEase of access to informationTransparency report: Not availableBoard: Not availableCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org14

Management: Easy – “Company, PIA Team”Investors: Not availableOfficial location and Address: Easy – “support”, “FREQUENTLY ASKED QUESTIONS”, “Where are youlocated?”Jurisdiction: Easy – “support”, “FREQUENTLY ASKED QUESTIONS”, “Where are you located?”Pulse Secure – Pulse Connect SecureDefault webpage: https://www.pulsesecure.net/Transparency ReportLink: Not availableFrequency: Not availableDate: Not availableIncluded: Not availableData shared:Board of directorsLink: torsIncluded: Name, ResumeManagementLink: uded: Name, ResumeInvestorsLink: Not availableOfficial location and AddressLink: https://www.pulsesecure.net/company/locations (Pulse Secure LLC)Country of residence: USAAddress: 2700 Zanker Road, Suite 200, San Jose, California 95134, United States of AmericaAdditional addresses: 7Jurisdiction (country of registration)Link: https://www.pulsesecure.net/support/eula/Country of jurisdiction: USACopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org15

Location Main officesLocation: No confirmation from vendorEase of access to informationTransparency report: Not availableBoard: Easy – “ABOUT US”, “Board of Directors”Management: Easy – “Leadership”Investors: Not availableOfficial location and Address: Easy – “ABOUT US”, “Locations”Jurisdiction: Easy – “SUPPORT”, “Support Home”, “EULA”TunnelBear Inc (McAfee) – TunnelBearDefault webpage Tunnelbear: https://www.tunnelbear.com/Default webpage McAfee: https://www.mcafee.comTransparency ReportLink: Not availableFrequency: Not availableDate: Not availableIncluded: Not availableData shared: Not availableBoard of directorsLink: Not availableIncluded: Not availableManagementTunnelbearLink: https://www.tunnelbear.com/aboutIncluded: Name, ResumeMcAfeeLink: Included: Name, ResumeInvestorsLink: Not availableCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org16

Official location and AddressTunnelbearLink: https://www.tunnelbear.com/about (TunnelBear Inc.)Country of residence: CanadaAddress: 310 Spadina Ave, Suite 200, Toronto, Ontario, M5T 2E7Additional addresses: Not availableMcAfeeLink: https://www.mcafee.com (McAfee, LLC.)Country of residence: USAAddress: Corporate Headquarters, 2821 Mission College Blvd., Santa Clara, CA 95054 USA,Additional addresses: NumerousJurisdiction (country of registration)TunnelbearLink: https://www.tunnelbear.com/aboutCountry of jurisdiction: CanadaMcAfeeLink: l/website-terms-of-service.htmlCountry of jurisdiction: USALocation Main officesLocation: No confirmation from vendorEase of access to informationTunnelbearTransparency report: Not availableBoard: Not availableManagement: Easy – “About Us”Investors: Not availableOfficial location and Address: Easy – “About Us”Jurisdiction: Easy – “About Us”McAfeeTransparency report: Not availableCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org17

Board: Not availableManagement: Easy – “About Us”Investors: Not availableOfficial location and Address: Easy – main pageJurisdiction: Easy – “Legal Contracts & Terms”KeepSolid – VPN UnlimitedDefault webpage: https://www.vpnunlimitedapp.com/Transparency ReportLink: Not availableFrequency: Not availableDate: Not availableIncluded: Not availableData shared: Not availableBoard of directorsLink: rsIncluded: Name, ResumeManagementLink: uded: Name, ResumeInvestorsLink: No investors (confirmed by vendor)Official location and AddressLink: https://www.keepsolid.com/ (KeepSolid Inc)Country of residence: USAAddress: United States 3220 Arlington Ave. Suite 5A Bronx 10463Additional addresses: Not availableJurisdiction (country of registration)Link: iticism/Country of jurisdiction: USACopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org18

Location Main officesLocation: United States 3220 Arlington Ave. Suite 5A Bronx 10463, Ukraine, Odessa 2A ShevchenkoStreet 65044Ease of access to informationTransparency report: Not availableBoard: Easy – Keepsolid webpage, “Press Room”, “Board of Members”Management: Easy – Keepsolid webpage, “Press Room”, “Management”Investors: Not availableOfficial location and Address: Easy – Keepsolid webpageJurisdiction: Medium – “Blog”, “VPN Unlimited: Addressing Criticism and Learning from Lessons”Copyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org19

SummaryTable available reeNordVPNSymantecLondonTrust MediaPulse SecureProductAvast SecureLineVPNAvira Phantom VPNProAnyConnect SecureMobility ClientExpressVPNF-SecureFREEDOME VPNHotspot Shield EliteNordVPNNorton WiFiPrivacyPrivate InternetAccessPulse ConnectSecureTunnelBearTransparencyReport (yearlyupdated)YesData shared accordingto Transparencyreport *YesBoard unnelbearNounknownNoInc.McAfee TunnelBearNounknownNoKeepSolidVPN UnlimitedNounknownYes* - This does not necessarily mean identifying information of customers has been orFreeNordVPNProductInvestorsNoOfficial Location Jurisdictionand shVirginIslandsFinlandNIPUSAPanamaUSANIPAvast SecureLineVPNAvira Phantom VPNProAnyConnect SecureMobility ClientExpressVPNNoF-SecureFREEDOME VPNHotspot Shield PanamaYesYesYesNIPCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org20

SymantecLondonTrust MediaPulse SecureNorton WiFiPrivacyPrivate InternetAccessPulse ConnectSecureTunnelBearTunnelbearInc.McAfee TunnelBearKeepSolidVPN CanadaNIPNoNoUSAUSAUSAUSANIPUSA,Ukraine(USA), (Germany) – Assumed jurisdiction due to official address, no specific information availableNIP – No confirmation from vendor about main officesTable ease of access to reeNordVPNSymantecLondonTrust MediaPulse SecureProductAvast SecureLineVPNAvira Phantom VPNProAnyConnect SecureMobility ClientExpressVPNF-SecureFREEDOME VPNHotspot Shield EliteNordVPNNorton WiFiPrivacyPrivate InternetAccessPulse ConnectSecureTunnelBearTunnelbearInc.McAfee TunnelBearKeepSolidVPN UnlimitedTransparencyReportEasyBoard ofDirectorsEasyManagementEasyNot availableNot availableEasyEasyEasyEasyNot availableNot availableNot availableEasyNot availableEasyEasyNot availableNot availableEasyNot availableMediumEasyNot availableMediumNot availableNot availableEasyNot availableEasyEasyNot availableNot availableEasyNot availableNot availableNot availableEasyEasyEasyCopyright 2018 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, GermanyPhone 49 (0) 391 60754-60, Fax 49 (0) 391 60754-69, Web https://www.av-test.org21

ordVPNSymantecLondonTrust MediaPulse SecureProductInvestorsAvast SecureLineVPNAvira Phantom VPNProAnyConnect SecureMobility ClientExpressVPNF-SecureFREEDOME VPNHotspot Shield EliteNordVPNNorton WiFiPrivacyPrivate InternetAccessPulse ConnectSecureTunnelBearNot available,Public companyNot availableTunnelbearInc.McAfee TunnelBearKeepSolidVPN UnlimitedOfficial Locationand AddressEasyEasyJurisdictionEasyEasyEasynot specificallyprovidednot EasyEasyEasyEasyNot availableEasyEasyNot availableEasyEasyNot availableNot availableEasyEasyEasyEasyNot available,Public companyNot availableNot available,Public companyEasyNot availableNot available,Public companyNot availableEasyWhen looking at the transparency regarding requests for data only three companies currentlypublishing such full-scale report: AnchorFree, Avast and Cisco. NordVPN has something resembling atransparency report, but it is only three lines in the “about” section and doesn’t fulfil several aspectsexpected from a full fledged transparency report. F-Secure informed us upon information requestthat they are considering publishing one from 2019 onwards. Of the three products publishing thereport, only AnchorFree claims to have not released any data on its users. Avira informed us thatbecause they have a no log-policy in place, ther

transparency in regards to management, the requests for data handling and further company details need to be evaluated. When general information like this, which is commonly known for most companies, is not publicly made available in a clear and obvious manner it raises questions of responsibility, credibility and trust. 1 "VPN omparative .