The Line Items That Only Exist If Someone Is Paying

The things that make a VPN provider checkable are not features; they are salaries. An independent audit is professional-services spend. Answering a government request properly requires a lawyer. Maintaining clients across platforms and handling reported vulnerabilities requires engineers on payroll. None of it scales down to zero, and none of it appears in a comparison table as a cost.

Which means these items follow the money in a predictable way, and their presence or absence tells you something about the funding model that the marketing page will not.

To be clear about scope: what an audit or a transparency report actually proves is a separate question, and a technical one. This post is about what they cost and who can afford to buy them.

The four items in this category

Independent review. Hiring an outside firm to examine infrastructure, apps, or policy claims is a discrete, invoiced, repeatable expense. Repeatable matters: a review of a system as it stood two years ago describes a system that has since changed, so the meaningful version is a recurring bill rather than a one-off.

Legal capacity. Requests arrive — from law enforcement, from civil litigants, from regulators in several countries at once. Handling them correctly means someone qualified reads each one and decides what the provider is actually obliged to do. Doing that badly is cheap; doing it properly is not.

Security engineering. Clients on multiple platforms, kept working as those platforms change, plus a channel for reported vulnerabilities and someone who triages it. This is ongoing payroll that does not fall as the user base grows.

Incident response. When something goes wrong, the work is investigation, notification, and remediation, all under time pressure. It is unbudgeted by definition and it competes with everything else.

Why some free tiers can absolutely afford all of it

This is the part that gets left out of the scary version of this argument, and it is the more useful half.

A freemium tier inside a subscription business is funded by people who pay. If those subscribers are numerous enough to fund audits and lawyers — and in a subscription business they usually are, because those costs are shared across the whole customer base — then the free users benefit from spending they did not pay for. The free tier inherits institutional capacity. This is the single strongest practical argument for preferring a free tier that sits under a paid product; the structural comparison is in free VPN vs. paid VPN.

A grant-funded or donation-funded service frequently has these items funded explicitly. Funders in this space often require external review as a condition, which means the audit is not competing with the server bill at all — see how donation- and grant-funded VPNs stay free.

A bundled VPN inside a larger company can absorb the costs into departments that already exist. A telecom or security company has lawyers and a security team whether or not it ships a VPN. The caveat is that the app may be operated by a licensing partner rather than the brand, in which case the relevant institutional capacity is the partner’s — the question to ask is in the VPN you are already paying for.

So “free” does not imply “unaudited”. What matters is whether any revenue stream is large enough, and stable enough, to carry costs that produce no growth.

Which arrangements struggle with it

Thin per-user revenue. Where income comes from advertising impressions inside the app, the revenue per user per month is small and the free tier’s spending has to stay proportionally small. Professional-services fees are not proportional to anything — they are a lump. A lump is hard to carry on thin margins, so the spend tends to go to the things that grow installs instead. The mechanics of that revenue are in what an ad-funded VPN is actually selling.

A funding model that dislikes being examined. Where the revenue comes from onward use of usage data or of the connection itself, external review is not just an expense; it produces documentation of the arrangement. The incentive to commission it is weaker, and that is a structural observation rather than a claim about anyone. The two models are described in do free VPNs sell your data and bandwidth resale.

Anything running close to its funding limit. A service whose revenue barely covers bandwidth is choosing between capacity and everything else, and capacity wins because without it there is no product. That is also the state described in what happens when a free VPN runs out of money.

Absence is not proof, and presence is not a verdict

Two errors to avoid.

A small, honest, independently run service may have none of these items simply because it is small. That is a description of its size, not of its intentions. What it does mean is that you are relying on the operator’s competence directly, with no external check — which may be a perfectly reasonable thing to accept for casual use.

A published audit is not a guarantee, because its scope was chosen and paid for by the subject. Reading what it covered, and when, is the whole exercise — and it is a technical exercise this site does not attempt.

The economic point is narrower and firmer than either: these items cost money that produces no growth, so they exist only where revenue is stable enough to spare it. Work out which revenue that is and you know whether to expect them at all.

What to check

1. Find out whether there is a paying customer base. If a free tier sits under a real subscription product, the institutional spending has an obvious funder.
2. Look for a security contact or vulnerability-reporting page. Cheap to publish, and its absence tells you nobody is staffed to receive reports.
3. Check whether external review is recent and recurring, not a single old engagement referenced permanently.
4. For a bundled app, establish who operates it, because that is whose lawyers and engineers matter.
5. For a grant-funded service, look at who funds it — funders are usually named, and their requirements are often public.
6. Match your expectations to the revenue you found. Expecting audit-grade assurance from a service with thin per-user income is expecting spending the business model cannot support, and the same reasoning tells you when a free VPN is genuinely fine anyway.