Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
Golden Frog built VyprVPN because the National Security Agency had been intercepting traffic on AT&T’s network. The company registered the service in Switzerland, and in 2018 it became the first VPN anywhere to commission an independent audit of its no-logs claim.
In 2023 it was sold to Certida LLC, a company in Texas. So the jurisdiction is now the United States, and the audit that made its reputation was performed on a different company in a different country.
Is VyprVPN Any Good?
It owns every server it runs, rather than leasing capacity from datacentre operators, and it operates its own DNS resolver. Both are real structural advantages and both survive the ownership change.
Chameleon is its distinguishing feature. The protocol scrambles OpenVPN metadata so that inspection systems cannot identify the tunnel — obfuscation, under a different name, and one of the older implementations in the market.
⚠️ And the speeds are the recurring complaint. Multiple independent reviews describe them as poor; one publication placed it twenty-sixth of thirty providers tested.
The Reversal at the Centre of This
Room 641A was a room in an AT&T building in San Francisco. Revealed in 2006, it housed equipment splitting the carrier’s traffic to the NSA. Golden Frog says the incident is why the company exists.
Switzerland was the answer to that. Outside the intelligence-sharing arrangements, no mandatory retention, a privacy jurisdiction by reputation — the same argument now being tested by a proposed ordinance.
⚠️ Then the company moved to Texas. Certida LLC acquired it in 2023, which places VyprVPN inside the Five Eyes arrangement and under the legal process — including sealed orders — that the service was built to avoid.
The change was not loudly announced. Reviewers describe noticing it after the fact, and as of 2026 the Android application is still listed on Google Play under the developer name of the company that sold it three years ago.
The Audit, and What It Can Still Tell You
Leviathan Security examined the service in 2018 and confirmed the no-logs claim. That was the first such audit any VPN had commissioned, and the industry now treats them as standard because of it.
It found a genuine fault. The kill switch was storing user IP addresses, and the published report confirms the company fixed every issue raised. That is not a black mark — it is what an audit is for, and most providers publish reports that find nothing.
⚠️ But it describes a company that no longer exists. Eight years, one acquisition and one change of country later, the only verification on record predates all three — and what an audit proves is bounded by when it happened.
No re-audit has been published since the sale. Reviewers also note the dedicated VPN privacy policy was replaced with a generic website policy, which is a downgrade in specificity at the moment specificity mattered most.
The Platform Gaps Are Severe
Chameleon does not run on iPhone. The feature the service is known for is missing from the platform most people carry.
⚠️ Neither does the kill switch. Not a reduced version — absent entirely on iOS, and published accounts trace the user request for it to 2014. A VPN without one leaks the moment the tunnel drops.
Split tunnelling covers Windows, macOS and Android, and not iPhone — though per-app routing is unavailable to every consumer VPN there, so that gap is not VyprVPN’s fault.
There is no Linux application and no browser extensions, which is unusual for a service that markets itself on security.
Its Chameleon protocol has a direct counterpart at NordVPN — two proprietary protocols, one current audit.
Like StrongVPN, it owns its servers rather than leasing them — and between them they have a single audit.
What It Costs
Around $3 a month on the two-year plan, with a thirty-day money-back guarantee and a three-day trial available through the mobile apps.
⚠️ Check the renewal before committing. Our renewal table exists because that figure decides the total, and it is the number providers publish least clearly.
For the same money you can have an audited alternative. Private Internet Access has three Deloitte audits and three federal demands answered with nothing; Proton VPN has five audits and a non-profit owner.
Everything Else, Briefly
Network: around 700 servers across 63 locations, all owned rather than rented. Small by current standards and unusual in being self-operated.
VyprDNS: its own zero-knowledge resolver, which removes one of the five causes of DNS leaks outright.
Streaming works well according to independent reviews, including on high-bitrate content.
Protocols: WireGuard, OpenVPN, IKEv2 and Chameleon, with AES-256 throughout.
| Provider | No-logs audits | Auditor | Jurisdiction |
|---|---|---|---|
| NordVPN | 6 | PwC, Deloitte | Panama |
| Surfshark | 2 | Deloitte | Netherlands (9 Eyes) |
| ExpressVPN | 3 | KPMG | British Virgin Islands, Kape-owned |
| CyberGhost | 3 | Deloitte | Romania, Kape-owned |
| PureVPN | 4 | KPMG | BVI, operated from Pakistan |
| IPVanish | 2 | Leviathan, Schellman | United States (Five Eyes), Ziff Davis-owned |
| Windscribe | 1 | Packetlabs, production infrastructure | Canada (Five Eyes); Greek case dismissed, no data to give |
| Proton VPN | 5 | Securitum | Switzerland, moving infrastructure to EU |
| Private Internet Access | 3 | Deloitte | United States (Five Eyes), Kape-owned |
| Mullvad | 10+ | Cure53, Assured AB | Sweden (14 Eyes) |
| TunnelBear | Annual since 2017 | Cure53 | Canada (Five Eyes), US parent |
| Norton VPN | 2 | VerSprite | United States (Five Eyes) |
| Hotspot Shield | 0 | protocol audited, policy not | United States (Five Eyes) |
| AirVPN | 0 | none — the client is open source instead | Italy (14 Eyes) |
| IVPN | 8, annual since inception | Cure53 | Gibraltar (status disputed) |
| Hide.me | 1 modern, in 2024 | Securitum, though one source names Altius IT | Malaysia (outside the alliances) |
| PrivadoVPN | 0 | none in six years of operation | Iceland (moved from Switzerland, 2026) |
| TorGuard | 0 | none; settled a lawsuit without disclosing records | United States (Five Eyes) |
| FastestVPN | 1, in 2023 | Altius IT | Cayman Islands (outside the alliances) |
| StrongVPN | 0 | none in over two decades | United States (Five Eyes), Ziff Davis-owned |
| VyprVPN | 1, in 2018 | Leviathan Security, before the 2023 sale | United States (Five Eyes), Certida-owned since 2023 |
| PrivateVPN | 0 | none; support says there is nothing to audit | Sweden (14 Eyes), ownership disputed |
| ZoogVPN | 0 | none; support describes one as planned | Greece (outside the alliances), run from Ukraine |
Who It Is For
Take it if Chameleon is what you need and you are not on an iPhone. Obfuscation from a provider that owns its own hardware is a genuinely narrow offering, and this is one of the few places to get it.
Look elsewhere if you are buying the Swiss story. It ended in 2023, and any page still selling it is out of date.
⚠️ And look elsewhere if you use an iPhone at all. No kill switch is not a missing extra; it is the feature that stops your address leaking when the connection fails.
How We Research
This review draws on VPN Scorecard for the Certida acquisition, the identification of the legal operator on the company’s own trust page and the absence of any re-audit, on VPNCompare for the platform-by-platform feature gaps and the Google Play developer listing, on Cloudwards and vpnMentor for the jurisdiction change and the detail that the 2018 audit found the kill switch storing addresses, on vpn.com for the Chameleon mechanism, and on TheBestVPN for the speed placement and the Room 641A origin. Several of these publishers sell VPN subscriptions or belong to companies that do, so we have used them for documented facts rather than for rankings, and we name them here. We do not run our own tests. Our method lives on the About Us page.
VyprVPN FAQ
No. Golden Frog registered it in Switzerland, but Certida LLC of Texas acquired the service in 2023, which moved the jurisdiction to the United States. Pages still describing it as Swiss are out of date, and as of 2026 its Android listing still names the previous owner.
Once, by Leviathan Security in 2018 — the first no-logs audit any VPN commissioned. It confirmed the claim and found the kill switch storing user IP addresses, which the report says was fixed. No audit has been published since, so the only verification predates both the current owner and the current jurisdiction.
VyprVPN’s own obfuscation layer. It scrambles OpenVPN metadata so that deep packet inspection cannot identify the traffic as a VPN, at some cost to throughput. It runs on Windows, macOS and Android, and is not available on iPhone.
On Windows, macOS and Android, yes. On iOS it is absent entirely, and published accounts trace user requests for it back to 2014. That matters, because a kill switch is what prevents your real address being exposed when the tunnel drops.
Independent reviews consistently describe the speeds as its weakest area, with one publication ranking it twenty-sixth of thirty providers tested. It owns its own hardware, which helps consistency rather than peak throughput.
VyprVPN
The Verdict
Its own server hardware, its own DNS resolver, the Chameleon obfuscation protocol and the first independent no-logs audit in the industry. Against that: a 2023 sale that moved it from Switzerland into United States jurisdiction, no audit since 2018, no kill switch or Chameleon on iPhone, no Linux client, a small network and speeds that independent reviews rank near the bottom.
Final Verdict
VyprVPN paid for the first no-logs audit in this market. An outside firm checked the claim in 2018, found a fault, and the industry now treats audits as table stakes partly because of it.
Then it became the thing it was built against. A service created in response to American surveillance now answers to American courts, and the audit that earned its reputation describes a company under different ownership in a different country.
Chameleon and the owned hardware are still real. If those are what you want, this is one of few places to get them — and if you carry an iPhone, the feature list shrinks to almost nothing.