VPN for Human Rights Defenders: Threat Modeling Before Tool Selection

Why "which VPN should I use" is the wrong first question

If you searched for a VPN for human rights defenders, you probably expected a ranked list of providers with feature comparisons and a "winner" at the top. That approach works reasonably well for someone picking a VPN to watch a show that isn't available in their country. It works badly, and sometimes dangerously, for someone documenting abuses, supporting at-risk communities, or communicating with people whose safety depends on that communication staying private. The reason is simple: a VPN is a tool that addresses a specific, narrow set of risks, and if you pick one before you've worked out what your actual risks are, you can end up with a product that does nothing useful against the threat you're actually facing — while giving you a false sense that the problem is handled.

That false sense of security is the real danger here, more than any specific technical weakness in any specific VPN app. Someone who installs a VPN, sees a "connected" indicator, and stops thinking about the problem has often taken on more risk than someone who never installed anything, because the second person at least still knows they're exposed. This guide is built around reordering the process: work out your threat model first, understand precisely what a VPN does and does not do, and only then look at how the providers covered on this site differ in the ways that actually matter for your situation.

What does threat modeling actually mean in practice?

"Threat model" sounds like a term borrowed from a corporate security team, and in a sense it is — but the underlying idea is something everyone already does informally, just without naming it. A threat model is an honest, specific answer to four questions: what are you trying to protect, who might come after it, how likely are they to actually target you rather than someone else, and what happens to you or to others if they succeed. Skipping this step and going straight to "which VPN is best" means answering a product question before you've answered the actual question, which is what you need protected and from whom.

Who — and what — are you protecting?

Be specific rather than general. "My privacy" is too vague to act on. "The identities of people who shared testimony with me," "the fact that I'm in contact with a particular organization," "my physical location when I'm traveling to document something," and "the content of messages I exchange with a legal team" are all different things, and they call for different combinations of tools. A VPN is well suited to protecting some of these — your IP-based location, and the contents of your traffic on a network you don't control — and essentially irrelevant to others, like protecting the identity of a source once you've already messaged them through a platform that logs who messaged whom. Write your list down. It doesn't need to be formal, but it needs to be honest and specific, because the next steps only work if this one is accurate.

Who is the realistic adversary — and is it really who you assumed?

People often default to imagining the most powerful plausible adversary — a well-resourced state intelligence service — because that's the scenario most discussed in the media coverage of surveillance and human rights work. For some readers of this guide, that is genuinely the correct adversary to plan around. For many others, the more realistic near-term risk is a local security service with modest technical capability but real power to detain, question, or seize a device; a hostile employer or family member with physical access to your phone; or an opportunistic actor exploiting weak account security rather than breaking encryption. These call for different responses. A VPN does very little against someone who has physically taken your unlocked phone. It does something real against a network operator or local ISP trying to see which sites you visit. Getting the adversary right changes which tools are worth your limited time and attention.

What happens if that adversary succeeds?

This question is uncomfortable, but it's the one that should drive how much friction and inconvenience you're willing to accept from your security practice. If the worst realistic outcome is an account being locked out, you can reasonably choose convenience over some marginal security gain. If the worst realistic outcome is a source being identified and facing detention, prosecution, or violence, the calculus changes completely, and it's worth accepting real inconvenience — slower workflows, fewer platforms, more device discipline — in exchange for a meaningfully smaller attack surface. A VPN sits somewhere in the middle of most people's toolkits: it's rarely the single most important decision you'll make, but it's also not a decision to make carelessly if the stakes are high.

How does the answer change what "good enough" looks like?

Once you've named what you're protecting, who from, and what failure looks like, "good enough" stops being an abstract standard and becomes something you can actually evaluate a tool against. A journalist in a country with a functioning independent judiciary, working on a story that's sensitive but not physically dangerous, has a different bar than an organizer inside a state that has a track record of surveilling and detaining activists. Both might reasonably use a VPN. Neither should be using the same generic checklist without adapting it to their own answers from this section.

What can a VPN for human rights defenders actually protect against?

Strip away the marketing language that surrounds most VPN products and the underlying mechanism is narrow and specific. A VPN does two concrete things: it encrypts the traffic between your device and the VPN provider's own server, so anyone positioned on the network in between — your home internet provider, the operator of a hotel or conference Wi-Fi network, a mobile carrier — sees only encrypted traffic headed to a VPN server rather than the contents of what you're doing or the specific destinations you're visiting. And it substitutes the VPN provider's IP address for your own, so that the websites and services you connect to see the provider's address rather than one that traces back to your physical connection.

Those two mechanisms are genuinely useful for a human rights defender in specific, identifiable situations: using an untrusted network at an internet cafe, a shared office, or a conference without a local network operator being able to see which sites you're visiting; hiding your approximate physical location from a website or platform that would otherwise infer it from your IP address; and adding a layer of traffic protection when you're on a mobile network in a place where you have reason to distrust the carrier. If your threat modeling from the previous section surfaced any of these as real concerns, a VPN is doing genuine work for you.

What can't a VPN protect against — and why does that gap matter so much here?

The gap between what a VPN actually does and what its marketing implies matters more for a human rights defender than for almost any other category of user, because the cost of misunderstanding it is higher. A VPN does not make you anonymous. If you log into a platform with your real name, or an account that's linkable to your real identity, that platform still knows who you are regardless of which IP address you connected from — a VPN changes the network path, not the account layer. A VPN does not protect a compromised or physically seized device; if malware is already on your phone, or someone with authority has taken it and is examining its contents, the VPN app running on it is irrelevant to that specific problem. A VPN does not reliably hide the fact that you're using a VPN in the first place — VPN traffic is often detectable as such by a sophisticated network operator, even when the contents are unreadable, and in places where VPN use itself draws suspicion, that detectability matters. And a VPN does nothing for metadata that exists outside the encrypted tunnel entirely: who called whom on a phone network, which cell towers your phone pinged before you turned a VPN app on, or which physical location a friend tagged you at on a social platform.

There's also a category of risk that sits at the edge of what a VPN can meaningfully address even within its own domain: traffic correlation. A sufficiently well-positioned adversary who can observe both the traffic entering a VPN server and the traffic leaving it toward its final destination can, in principle, correlate timing and volume patterns to link the two, even without decrypting anything. This is a real, studied weakness of the single-hop VPN model, not a hypothetical one, and it's part of why multi-hop routing and Tor exist as options for higher-sensitivity scenarios. For most day-to-day use it's not the most pressing risk on your list, but it's worth knowing it exists rather than assuming that "encrypted" is a synonym for "unobservable to every possible adversary."

None of this is a reason to avoid VPNs. It's a reason to be precise about what problem you're solving with one, and to pair it deliberately with other tools and habits for the problems it doesn't touch — which we cover later in this guide.

What extra features actually matter for a high-risk threat model?

Once you move past the core question of encryption and IP masking, VPN providers differentiate themselves with a long list of secondary features, and not all of them matter equally once you've done real threat modeling. A few are worth understanding specifically because they map onto risks a human rights defender is more likely to face than an average user.

A kill switch blocks all network traffic if the VPN connection drops unexpectedly, rather than silently falling back to your normal, unprotected connection. Without one, a momentary drop — which happens on real networks, especially mobile ones — can leak your real IP address and unencrypted traffic for the seconds or minutes before you notice the app has disconnected. For anyone whose threat model includes a scenario where even a brief exposure matters, a reliable, system-level kill switch is close to a baseline requirement rather than a nice-to-have, and it's worth testing rather than trusting the marketing description: turn on the VPN, then forcibly disable your network connection, and see whether traffic actually stops.

DNS leak protection keeps your device's domain-name lookups routed through the VPN tunnel rather than leaking out to your ISP's default DNS servers, which would otherwise reveal which sites you're visiting even while the rest of your traffic is encrypted. Most modern VPN apps handle this correctly by default, but it's specifically worth verifying with an independent DNS leak test after connecting, rather than assuming it's covered.

Multi-hop or "double VPN" routing sends your traffic through two VPN servers in sequence instead of one, which means no single server operator sees both your real IP address and your final destination at the same time. It comes at a real cost to speed, and it doesn't eliminate the need to trust the provider generally — both hops are typically still run by the same company — but it can be a reasonable addition for a specific high-sensitivity session where you've decided the tradeoff is worth it.

Split tunneling, which lets you route only some apps or sites through the VPN while others use your normal connection, is convenient for everyday use but worth using deliberately rather than by default if you're in a high-risk category — it's easy to misconfigure and accidentally leave the exact traffic you meant to protect running outside the tunnel. If you use split tunneling at all, verify the configuration rather than assuming it's set correctly, and lean toward a simpler, always-on setup for anything sensitive.

Finally, how you pay for and sign up to a VPN is itself a piece of the picture. An account tied to your real name, home address, and a card that traces back to you is a weaker link than one set up with minimal identifying information, where the provider supports it. This isn't a reason to avoid a provider that requires standard billing details — most do — but it's a factor worth weighing consciously rather than ignoring, particularly if the account itself being linked to you is part of what you're trying to avoid.

How should you handle a VPN and your devices when crossing a border?

Border crossings are a distinct risk scenario from everyday use, and worth planning for separately rather than assuming your normal setup carries over safely. In many jurisdictions, border agents have broad authority to search electronic devices, and in some cases to compel a password or biometric unlock, with far less legal protection than would apply to a search inside the country. A VPN app installed on a device that gets physically searched doesn't protect anything at that point — the question at a border isn't about network traffic, it's about what's stored on the device and what accounts it can access once unlocked.

If border crossings are part of your realistic threat model, the more relevant precautions usually sit outside VPN selection entirely: traveling with a minimal or dedicated device that doesn't contain sensitive material, signing out of accounts rather than staying permanently logged in, understanding what a factory-reset-and-restore-later workflow would look like, and knowing before you travel what your rights and realistic options are at the specific border you're crossing, which vary enormously by country and can change. Organizations that specialize in digital security for people who travel under this kind of scrutiny — again, Access Now's Digital Security Helpline and Front Line Defenders are useful starting points — publish more detailed, current guidance on this than a general VPN buyer's guide can respons­ibly provide, precisely because the right answer depends on details specific to your situation and destination.

If you're advising or training others, what changes?

A lot of human rights work involves not just protecting yourself but advising, training, or supporting other people — colleagues, community members, sources — who may have a very different technical background and a very different risk exposure than you do. This is where a generic "just use a VPN" recommendation becomes actively risky to pass along, because it skips the exact reordering this guide opens with: the people you're advising need to go through their own version of the threat-modeling questions above, not simply adopt your tool choices wholesale.

A recommendation that's appropriate for you — someone who understands what a kill switch is, checks for DNS leaks, and reads a privacy policy before trusting it — can be actively unsafe advice for someone who will install an app, see a green "connected" indicator, and assume the problem is now solved. If you're in a position of advising others, it's worth spending time on the underlying concepts — what a VPN does and doesn't cover, why device security and account hygiene matter as much or more — rather than handing over a single product recommendation as if it were a complete solution. A tool recommendation without the reasoning behind it tends to produce exactly the false sense of security this guide warns about at the very top, just transmitted to someone else.

Is a free VPN ever an acceptable choice?

Budget is a real constraint for a lot of human rights work, whether you're an individual defender covering your own costs or a small organization stretching a limited grant across everything it needs. It's worth addressing directly rather than assuming a paid subscription is always available: a free VPN is not automatically unsafe, but the free VPN market has a well-documented history of providers that monetize through data collection, third-party advertising partnerships, or outright weak security practices, precisely because running server infrastructure costs money and a free product has to be paid for somehow. That doesn't mean every free option is compromised — some paid providers offer genuinely limited free tiers with the same underlying infrastructure and policies as their paid product — but it does mean the ordinary evaluation steps in this guide, reading the actual privacy policy and checking for independent audits, matter more with a free product, not less, because the incentive misalignment is stronger.

If cost is the binding constraint, a free tier from a provider that also has a paid product, a transparent policy, and an audit history is generally a safer choice than a standalone free-only VPN with no paid business model behind it and no clear answer to the question of how it sustains itself. Where the budget allows it, treating a VPN subscription as a necessary operating cost for security-sensitive work — the same category as, say, paying for encrypted email or secure storage — is usually the more defensible framing than treating it as a discretionary expense to cut first.

Does jurisdiction matter, and how much?

Where a VPN provider is legally headquartered affects what legal process can compel it to hand over, and to whom, which is why jurisdiction gets discussed as a companion to a provider's logging policy rather than a substitute for it. A strong no-logs policy paired with a jurisdiction openly hostile to that kind of privacy commitment is a materially weaker combination than the same policy paired with a jurisdiction whose legal system supports it. Proton VPN, for instance, leans heavily on its Swiss jurisdiction as part of its privacy positioning; you can read the fuller picture in our Proton VPN review.

Jurisdiction is one input, not the whole answer. A provider based in a favorable jurisdiction that keeps detailed connection logs anyway offers you very little extra protection, because the logs — and therefore the thing a legal order could compel disclosure of — simply don't exist in the favorable case only if the no-logs claim is actually true and specific. Treat jurisdiction as a modifier on top of a real, specific logging policy, not as a stand-alone reason to trust a provider.

What does a no-logs policy actually need to say before you trust it?

"No logs" as a marketing headline is close to meaningless without specifics, and for a human rights defender, taking it at face value without reading further is a real risk, not just an inconvenience. A provider can truthfully say it doesn't log "browsing activity" while still retaining connection timestamps, source IP addresses at time of connection, bandwidth consumed per session, or DNS query records — any of which could be enough to link a session to a person under the right circumstances. When you're evaluating a provider specifically because your safety may depend on the claim being accurate, read the actual privacy policy text, not the marketing summary of it, and look for what categories of data are explicitly excluded from collection versus what's simply not mentioned.

Some providers commission independent audits of their no-logs claims, their app source code, or both. An audit from a credible, named firm is a meaningfully stronger signal than an unverified claim, and it's worth specifically seeking out providers that have one. But an audit is a snapshot in time, scoped to whatever the audit actually covered — it is not a permanent guarantee that nothing has changed since, and it's not a blanket statement about every claim the provider makes. We only reference a specific audit on this site when we can point to the actual audit report and its date and scope, and you should apply the same standard yourself when reading any provider's own claims about its audits.

Is it legal — or safe — to use a VPN where you work?

VPN restrictions and outright bans

A number of countries restrict VPN use, require VPN providers to register with the state, or ban unapproved VPNs outright, and the specific rules and how strictly they're enforced change over time and vary by country in ways this guide can't responsibly summarize as a static fact. If your work takes you into or through a jurisdiction where you're not certain of the current legal status of VPN use, that's a question worth researching specifically for that country and current as of your travel dates — not something to assume based on what was true a year or two ago, or based on what's true in a different country. Organizations that specialize in digital security support for at-risk activists, journalists, and human rights defenders — Access Now's Digital Security Helpline and Front Line Defenders are two well-known examples — are better positioned to advise on the current legal and practical situation in a specific country than a general buyer's guide can be.

Does using a VPN itself attract attention?

In some environments, the mere fact that a device is running VPN traffic — detectable to a sophisticated network operator even when the contents are unreadable — can itself be a signal that draws scrutiny, independent of whether VPN use is technically restricted. This is a genuinely difficult tradeoff with no universally correct answer: some providers offer "obfuscated" server options specifically designed to make VPN traffic harder to distinguish from ordinary encrypted web traffic, which can reduce this risk in places where it matters, at some cost to connection speed and reliability. Whether that tradeoff is worth it depends entirely on your threat model from earlier in this guide — it's a question to weigh deliberately, not a feature to pick because it sounds more secure.

How does a VPN fit alongside the rest of a digital security practice?

A VPN is one layer among several, and treating it as the whole practice is the most common and most consequential mistake in how this topic gets discussed. The layers below it, and around it, often matter more.

Device security comes first

A VPN running on a compromised device protects nothing meaningful — the device itself is the point of failure, and traffic encryption downstream of that failure doesn't help. Keeping your operating system and apps updated, using a strong device passcode rather than a pattern or a short PIN, enabling full-disk encryption where it isn't on by default, and being deliberate about which apps you install and what permissions you grant them all matter more, in a strict sense, than which VPN provider you choose. If you have to prioritize your limited time and attention, device hygiene comes before VPN selection, not after.

Messaging and account compartmentalization

A VPN protects the network path your traffic takes; it does nothing about what happens once that traffic reaches its destination. If you're communicating with sources, colleagues, or people you're supporting, the choice of messaging platform and how you compartmentalize accounts matters at least as much as your VPN choice — end-to-end encrypted messaging, separate accounts for separate contexts so a compromise of one doesn't cascade into everything, and a habit of assuming that any platform you don't control could eventually be compelled to disclose metadata about who you talked to and when, even if it can't read the message contents.

Tor, and when it's the more appropriate tool

A VPN and Tor solve overlapping but distinct problems, and for some human rights defenders, Tor — or a VPN used alongside Tor rather than instead of it — is the more appropriate tool for a specific task. A VPN routes your traffic through a single provider's server, which means you're trusting that one provider not to log or misuse your data. Tor routes traffic through multiple independently operated relays, which reduces how much any single party can learn, at a real cost to connection speed. For everyday browsing and general network protection on untrusted Wi-Fi, a VPN is usually the more practical choice. For a specific, high-sensitivity task — accessing a resource you have strong reason to believe is monitored, for example — Tor or a VPN-plus-Tor combination may be worth the slower, less convenient experience. Neither tool is a universal upgrade over the other; they suit different situations.

How do you evaluate a VPN provider once you know your threat model?

With your threat model in hand, provider evaluation becomes a much narrower, more answerable question than "which VPN is best." Ask, specifically: does this provider have a logging policy that's specific rather than vague, and does it say clearly what categories of data are and aren't collected? Is the provider's jurisdiction one whose legal system is compatible with that policy actually holding up under pressure? Has the provider had an independent audit of its no-logs claims or app code, from a named firm, with a report you can actually locate and read? Does it offer features relevant to your specific threat model, such as obfuscated servers if network-level VPN detection is a real concern for you, or a kill switch that blocks traffic entirely if the VPN connection drops, so you don't leak your real IP address during a momentary disconnection?

These are the questions worth spending your evaluation time on. Marketing language about being "the fastest" or "the most trusted" is not something this guide can verify or vouch for, and you shouldn't weight it heavily either — it's not falsifiable in the way a jurisdiction, a logging policy's actual text, or an audit report are.

How do you verify a VPN you're already using is actually working?

It's worth treating "I have a VPN installed" and "my VPN is actually protecting me right now" as two separate claims, because they aren't always the same thing, and the gap between them is exactly where a false sense of security tends to live. A few concrete checks take a few minutes and are worth doing periodically, not just once when you first set up the app. Connect to the VPN and visit an IP-address-checking page to confirm the address shown is the VPN provider's, not your own — apps occasionally fail silently or connect to the wrong server. Run a DNS leak test while connected to confirm your domain lookups are routed through the tunnel rather than leaking to your normal ISP's DNS servers. If the app claims to have a kill switch, actually test it: connect, then forcibly cut your network connection, and confirm that traffic stops rather than silently falling back to your unprotected connection. And periodically re-check that the app itself is up to date, since a known vulnerability in an outdated client is a real, mundane way for a VPN's protections to be undermined regardless of how good the provider's underlying policies are.

None of these checks require special technical expertise, and doing them once when your risk is elevated — before a trip, before a sensitive piece of work, after installing on a new device — is a habit worth building rather than a one-time setup step to forget about.

What does a practical selection checklist look like?

Bringing the above together into something you can actually act on: first, write down your specific threat model — what you're protecting, from whom, and what failure looks like — before you look at a single provider. Second, treat a VPN as one layer, and make sure device security and communication compartmentalization are also part of your plan, not an afterthought to add later. Third, when you do evaluate a provider, read the actual privacy policy text rather than the marketing summary, note whether an independent audit exists and what it actually covered, and weigh jurisdiction as a modifier on top of that — not a substitute for it. Fourth, if your work involves travel to or communication with people in a jurisdiction where VPN legality or VPN detectability is uncertain, research that specific, current situation rather than assuming — and consider reaching out to an organization that specializes in digital security support for human rights defenders if the stakes are high enough to warrant it. Fifth, revisit the plan periodically. Threat models change as your work, your location, and the political environment around you change, and a security practice that made sense a year ago may not be the right one today.

Practical takeaway

A VPN is a genuinely useful tool for a human rights defender in specific, well-understood situations — protecting traffic on untrusted networks and hiding your IP-based location from the services you connect to — and it is not a general-purpose shield against a well-resourced adversary, a compromised device, or the risks that live at the account and metadata layer rather than the network layer. Do the threat modeling first. Once you know what you're actually defending against, evaluating a specific provider's logging policy, jurisdiction, and audit history becomes a concrete, answerable exercise rather than a guess based on marketing copy. Our individual provider reviews — including Proton VPN and NordVPN — link out to each provider's own policy pages so you can verify claims yourself rather than taking any review's word for it, including ours.