VPN providers
RiseupVPN privacy rating
Free, donation-funded VPN run by the Riseup collective in the United States. It needs no account and uses the open-source LEAP VPN client with OpenVPN.
Summary
RiseupVPN scores 70 out of 100 (grade C) on the VPN providers criteria. It meets 5 of 11 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration and open-source apps. It partly meets transparency report, security headers, audited no-logs policy and modern protocols. It does not meet independent audit and tells users about requests. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.
Score 70 out of 100. How scoring works
Criteria
-
Yes
Open source Weight 3 of 3
Is all the source code needed to run the product public?
The LEAP VPN client and provider software are open source under GPL-3.0.
-
Yes
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The privacy policy states no third-party cookies or tracking of any kind are used. The Android app has no known trackers on Exodus.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Entirely funded by user donations. No ads.
-
No
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
No independent audit is published.
-
Partial
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
A signed warrant canary is updated regularly. No request counts are published.
-
No
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
No published policy on notifying users about data requests.
-
Partial
Audited no-logs policy Weight 3 of 3
Has an independent audit confirmed that activity and connection logs are not kept?
Riseup states it does not log VPN users' IP addresses. Not audited.
-
Yes
Open-source apps Weight 2 of 3
Are the apps for every platform open source?
The desktop and Android clients are open source under GPL-3.0.
-
Partial
Modern protocols Weight 1 of 3
Is WireGuard (or another modern audited protocol) supported?
The client uses OpenVPN. WireGuard is not supported.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Partial
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B (75/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.