Who the file actually flags
Sorted in rank order. “Not set” means the key is absent. Do not read that cell as a tested no.
| Provider | warrant_canary | Privacy | audit_firm |
|---|---|---|---|
| ExpressVPN | not set | 96 | KPMG |
| NordVPN | true | 94 | Deloitte |
| Surfshark | not set | 89 | not named |
| Proton VPN | not set | 98 | Securitum |
| Mullvad | not set | 95 | Cure53 |
| Private Internet Access | not set | 82 | not named |
| Windscribe | not set | 85 | not named |
| hide.me | not set | 92 | not named |
| VyprVPN | not set | 88 | not named |
| CyberGhost | not set | 75 | not named |
| PrivateVPN | not set | 72 | not named |
| IPVanish | not set | 65 | not named |
| Hotspot Shield | not set | 68 | not named |
| Ivacy | not set | 65 | not named |
| TunnelBear | not set | 85 | not named |
When the three points matter
Privacy is 25 percent of the composite. A canary is +3 inside that category, beside larger inputs: the Eyes penalty, the no-logs claim, and the audit band. NordVPN can hold Deloitte and a canary flag at the same time. Mullvad can hold Cure53 and privacy 95 with the canary key unset. The flag does not reorder those facts.
A canary only works if someone checks that it is still current. This file has no canary date and no “still current” field. Read the provider’s own notice, then re-check the JSON before treating the flag as live. A dropped tunnel on public Wi-Fi is a different control, scored under Security.
Related on this site
- Best VPN for privacy — parent use-case.
- NordVPN scorecard — the only row with warrant_canary true.
- How to read a no-logs audit and which jurisdiction matters.
- Proton VPN and Mullvad — higher privacy scores, canary key not set in the file.
- Methodology and comparison JSON.
- Match engine.
FAQ
What is a warrant canary?
A standing public statement that a secret legal demand has not arrived. The useful signal is when the statement stops. Methodology scores a canary at +3 inside Privacy. It does not replace an audit.
Which providers does the comparison file flag?
Only NordVPN, with warrant_canary true. Every other provider omits the key, including Proton VPN and Mullvad. Omission is not a finding that their website lacks a canary.
Does a canary prove a no-logs policy?
No. A canary is a process notice. A no-logs claim is about what the provider stores, scored with jurisdiction and audit_type. NordVPN also has audit_firm Deloitte. The canary flag does not change audit_type.