> iVPN (because they're based in a non fourteen-eyes jurisdiction, namely Gibraltar).

Gibraltar is an British territory under the jurisdiction and sovereignty of the United Kingdom, it's part of the fourteen-eyes.

    Then there's the whole 'we never keep logs' claim which can't be proven. So, caveat emptor folks! 

It can be trusted with a fair degree of certainty depending on the company. For instance, we know that PIA at the very least was willing to testify under oath that they had no records to provide the US government. Could they be keeping secret logs or have changed practices since? Sure, but at some point the claim seems credible.

Now those flavor-of-the-month budget VPNs that cannot possibly be profitable unless you're the product? Different story.

FoxyProxy also testified under oath to the US Secret Service that they have no logs:

https://blog.getfoxyproxy.org/2017/11/04/secret-service-subp...

The company has been owned by the same individuals since 2006.

Parallel construction also isn't out of the question for these VPN providers that have testified under oath. If I were the NSA I'd buy some "no logs" VPN providers that don't provide logs in court, but do have them to make catching criminals much easier.

It doesn't hurt that the "no logs under oath" assertion will no doubt engender trust with the very people you want to log.

> VPN providers that don't provide logs in court, but do have them

That doesn’t make sense. If the provider has the logs, they’ll be presented in court if the company is given a subpoena and the owners are American. No one is going to risk contempt and jail time for their customers.

The apperence of not having logs is useful for both the law enforcement and the VPN owner, so why whould they subpoena the logs? The VPN could leak some details to the law and in exchange the law mostly leaves them alone. And the law would get cases where they know that spending their time will pay of: Saying "yeah, the computer repair shop found CP on the guys computer", thinking "because we told them where to look".

i thought pia got bought recently by a much less trust worthy vpn?

They were bought by Kape Technologies which used to be called Crossrider and has a history of producing malware and the owners used to work at the Israeli version of the NSA.

https://restoreprivacy.com/private-internet-access-kape-cros...

Huh, looks like it was. That would make me apprehensive about continuing to trust them.

They were bought by Kape Technologies, an Israeli surveillance firm whose founders have ties to Unit 8200. PIA literally couldn't up a bigger red flag if they tried.

The issue is that yesterday they may not have kept logs, and today they might, and there's no feasible way to know for sure. Even warrant canaries can't be relief on if the type of warrant requires no notification whatsoever.

i'm mostly happy with ProtonVPN for average stuff. clearly tho, when it's serious time you gotta pwn your own box