How We Work
Transparent by design.
Independent editorial judgement, cited sources, and transparency about our methods and limitations. The same principles across everything we publish.
Last updated: April 2026
What We Publish
Three Types of Content
Research
Independent editorial analyses of privacy topics. Each article documents its methodology, cites primary sources, and includes a limitations section. Research conclusions represent our editorial assessment based on the evidence gathered.
Audits: Systematic evaluation of products against defined criteria
Policy Analysis: Deep reading and comparison of legal or policy documents
Data Studies: Quantitative analysis of measurable privacy phenomena
Every factual claim is sourced. No key finding rests solely on a product's self-reported claims. Articles include a changelog and revision history.
Guides
Actionable articles written for a general audience. They walk through specific privacy tasks: changing settings, choosing tools, understanding threats. No jargon without explanation.
When a guide references a setting or feature, we verify it exists and works as described. Guides are reviewed and updated periodically.
Comparisons
Every product receives an independent editorial assessment based on publicly available information. We review privacy policies, security documentation, audit reports, and published features.
Our grades represent our editorial opinion, not certifications or endorsements. They are designed to help you make more informed decisions.
Comparisons
Grade Scale
A letter grade system from A+ to F. Each tier reflects our overall assessment of a product's privacy and security posture.
A+ / A / A-
Excellent
Top-tier privacy and security. Strong encryption, verified no-logs or zero-knowledge architecture, independent audits, privacy-friendly jurisdiction, and open source code.
B+ / B / B-
Good
Solid privacy fundamentals with minor concerns. May have jurisdiction issues, corporate ownership questions, or limited audit history, but still demonstrates a genuine commitment to user privacy.
C+ / C / C-
Average
Functional product with room for improvement. May lack independent audits, have limited transparency, or collect more data than privacy-focused alternatives.
D+ / D
Below Average
Privacy is not a primary focus of the product. Data collection practices go beyond what is necessary for core functionality, in our editorial assessment.
F
Failing
In our editorial opinion, the product's data practices are fundamentally at odds with user privacy. This tier reflects our assessment of publicly available information.
Comparisons
Scoring Signals
No single signal determines a grade. The final assessment is a holistic editorial judgment based on all available evidence.
No-logs / zero-knowledge
Verified by independent audit
Unverified claims or known logging
Independent audits
Recent audit by reputable firm
No audits or audits older than 2 years
Jurisdiction
Privacy-friendly (e.g. Switzerland, BVI, Panama)
Five Eyes / Fourteen Eyes member
Open source
Client and/or server open source
Fully proprietary, no public code
Corporate ownership
Independent or privacy-focused parent
Owned by advertising / data company
Security track record
No breaches, or breaches handled transparently
Breaches concealed or poorly handled
Encryption
Strong, modern protocols (WireGuard, E2EE)
Weak or outdated protocols
Past incidents aren't permanent marks. Historical incidents (e.g. past breaches or logging events) are weighed against what the company has done since: a transparent disclosure followed by structural changes (RAM-only servers, new audits, jurisdiction changes) carries less weight than an unaddressed incident.
Comparisons
Category-Specific Criteria
What we assess for each product category.
VPNs
- Encryption protocols and implementation
- Logging policy and verifiable no-logs claims
- Jurisdiction and legal obligations
- Independent security audits
- Ownership and corporate structure
- Kill switch and leak protection
- Speed and server network
Browsers
- Telemetry defaults and opt-out options
- Tracking protection and content blocking
- Fingerprint resistance
- Built-in ad blocking capabilities
- Open source status and rendering engine
- Update frequency and ownership
Email Providers
- End-to-end encryption support
- Zero-access encryption architecture
- Jurisdiction and legal framework
- Metadata handling and storage encryption
- Open source status and data practices
Password Managers
- Encryption standard and implementation
- Zero-knowledge architecture
- Independent security audits
- Open source status and breach history
- Platform support and data practices
Standards
Sources and Verification
Every claim traceable. Every source weighted. Every editorial decision ours.
Verifiable Sources
We cite our sources across all content types so you can verify our findings yourself. Research articles include numbered source lists. Comparison cards link to the evidence behind each assessment. Guides reference official documentation.
Source Reliability Tiers
T1 Academic papers, regulatory filings, independent audit reports
T2 Established news coverage, expert analysis
T3 Company's own claims -- hedged with "claims to", "according to"
Evidence-Based, Not Lab-Tested
We do not test products in controlled lab environments. Our assessments are based on documented evidence, published research, and expert analysis of publicly available information.
AI-Assisted Research
We use AI tools (Claude by Anthropic) for research, fact-checking, and drafting assistance. Specific claims are verified against primary sources where possible. All methodology, editorial decisions, and final content are our own.
Policies
Our Commitments
Independence
Our grades are not influenced by affiliate relationships. Products with affiliate programmes and products without them receive the same editorial treatment.
Corrections and Right of Reply
If you believe we have made a factual error, we want to hear from you. Companies and individuals discussed in our content are welcome to respond. We will consider any evidence provided and update our content if the facts support it.
Updates
All content is periodically reviewed for accuracy. Research articles include changelogs. Comparisons are re-evaluated as products change. Grades may change over time in either direction.
All content on The Threat Model reflects our independent editorial analysis and opinion. It is published in good faith for informational purposes and is not professional security, legal, or financial advice. We make every effort to ensure accuracy but do not guarantee that all information is complete or current. See our terms of service for full details.