VPN providers
NymVPN privacy rating
VPN from Nym Technologies SA in Switzerland that runs on a decentralized network of independent nodes. It offers a fast two-hop WireGuard mode and an anonymous mode routed through the Nym mixnet.
Summary
NymVPN scores 77 out of 100 (grade B) on the VPN providers criteria. It meets 7 of 12 criteria: open source, no ads or data sales, independent audit, TLS configuration, anonymous payment, open-source apps and modern protocols. It partly meets no trackers or telemetry, transparency report, security headers and audited no-logs policy. It does not meet tells users about requests. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.
Score 77 out of 100. How scoring works
Criteria
-
Yes
Open source Weight 3 of 3
Is all the source code needed to run the product public?
The apps and the Nym network node software are open source under GPL-3.0.
-
Partial
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
App error reports via Sentry and usage statistics are off by default. The website uses self-hosted Matomo analytics.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid subscriptions. The privacy statement rules out selling data to advertisers.
-
Yes
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Full Cure53 report on the apps, VPN, infrastructure and cryptography is public.
-
Partial
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
The privacy statement says requests will be challenged and made public. No request counts are published.
-
No
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
No published policy on notifying users about data requests.
-
Partial
Audited no-logs policy Weight 3 of 3
Has an independent audit confirmed that activity and connection logs are not kept?
The privacy statement describes a no-logs design with anonymous credentials. The Cure53 audit is a security audit, not a no-logs assessment.
-
Yes
Anonymous payment Weight 2 of 3
Can an account be created and paid for without an email address, name or card?
Cash, Monero and Zcash are accepted, and no email is needed with these payment methods.
-
Yes
Open-source apps Weight 2 of 3
Are the apps for every platform open source?
Apps for Windows, macOS, Linux, Android and iOS are open source.
-
Yes
Modern protocols Weight 1 of 3
Is WireGuard (or another modern audited protocol) supported?
The fast mode uses WireGuard across two hops.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Partial
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B (75/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.