The Trust Problem with VPNs

With National Data Privacy Day approaching, I've been thinking about a fundamental contradiction in VPN privacy: every VPN asks you to trust them. But trust is antithetical to privacy. If you have to trust someone not to observe you, you don't have privacy—you have their promise. Here's a thought experiment: You've used a VPN for years because they promised not to keep logs. But how would you know if they were telling the truth?

The Promise Problem:

Every major VPN makes some version of "we don't log your activity." But these promises are, by design, unverifiable. You're trusting a company's word about what happens inside systems you can't see. Sometimes that trust is misplaced. In 2016, a VPN with a "zero-logs" policy provided detailed logs to law enforcement. In 2019, another disclosed a breach they weren't forthcoming about. In 2021, a provider was acquired by a company with adware history. The point isn't that these companies are villains. It's simpler: when privacy depends on trusting internal practices, you're accepting uncertainty most users don't appreciate. Policies can be violated. Companies get acquired. Jurisdictions issue subpoenas.

Policy vs. Architecture:

Imagine two hotels. At the first, management promises staff will never enter your room without permission. At the second, your room physically cannot be opened without your specific key—not by housekeeping, not by management, not by anyone.

Both offer privacy. But fundamentally different kinds. One is a policy. The other is a physical constraint.

Most VPNs operate like the first hotel. They promise not to look at your data, but their systems are technically capable of doing so. They're just promising not to.

What if the system itself made certain violations impossible—not because of policy, but because of how it was built?

What's Changing:

Two shifts matter. First, quantum computing's impact on encryption. Today's standards are secure against conventional computers, but quantum will eventually break many. NIST published post-quantum standards in 2024 for this reason. Sophisticated adversaries may be collecting encrypted data today intending to decrypt it later.

Second, passwordless authentication. Technologies like FIDO2 and passkeys are finally making passwords obsolete. Within years, typing passwords will feel as dated as carrying a Rolodex. Both shifts point the same direction: security moving from trust-based systems toward cryptographic guarantees. Privacy should follow.

Verifiable Privacy:

Privacy claims should be auditable and provable. They shouldn't require taking a company's word.

This is what we're building at Culper Systems. We call it "Verifiable Lattice Privacy Architecture" (VLPA). It's designed so that user identity and network traffic are cryptographically separated at the architectural level. Even with full access to the infrastructure—even if you were an engineer working inside our company—you couldn't correlate who a user is with what they're doing online. It's not a policy decision. It's a mathematical constraint engineered into the foundation.

The question shouldn't be "does this company promise not to log my data?" It should be "is this system designed in a way that makes logging impossible?"

When you rent a room with keys only you control, you don't need to trust management's intentions. You verify privacy by understanding how the system works. Digital privacy should offer the same possibility. The cryptography exists. The question is whether we'll demand systems that prove their privacy claims rather than just assert them.