The best VPN for Czechia? Seven questions to ask any provider.
State of things on 18 October 2026: Pevnost is in private beta. The first server, in Hluboká nad Vltavou, is live with our DNS resolver inside the tunnel at 10.8.0.1. Accounts are paid by bank transfer; Bitcoin on-chain is the preferred way to pay; card and bank transfer also work; Lightning opens once our channel is funded, Monero and cash by post later. Windows app 0.3.1 beta and Android app 0.1.0 beta (APK) are on the Apps page; iOS and macOS use the official WireGuard app. Last reviewed 18 October 2026.
Type “best VPN Czechia” into a search engine and you get rankings in which the winner is whoever pays the highest commission. We will not pretend to be neutral: we run a Czech VPN and want you to pick us. So instead of a ranking, here is something more useful: seven questions every provider should be able to answer, and the criteria for judging the answers. We add our own answer to each, including the places where it is not the best on the market.
1. Which law do you sit under, and where are the servers?
Not “where we are not”, but where you are. A provider that names only “offshore” or a country with no enforceable law is telling you that you will not be able to reach it either. A useful answer names the country, the legal entity and the physical location of the servers, and explains what that law means for you: is there a retention duty, can anyone order logging built in, how does a request from authorities proceed. We compared VPN jurisdictions in a separate post.
Pevnost: Czech and EU law, operator Jan Faltýsek, sole trader, ID 11840064, server in Hluboká nad Vltavou. A VPN like ours has no duty to retain traffic data; the Constitutional Court annulled blanket retention in 2011 (Pl. ÚS 24/10) and the police access provision the same year (Pl. ÚS 24/11); the narrower 2019 regime (Pl. ÚS 45/17) binds telecom operators, not us. Weakness: one country, one node. If you need an exit abroad, you will not find it with us today.
2. What exactly do you not write down, and what do you keep?
“No logs” without a list is empty. Ask for a table: IP addresses, connection times, destinations, DNS queries, web and API access logs. And a second table: what is kept, for how long and why. A provider without the second table either has not thought about it or is leaving something out. What “no logs” means technically and how to verify it is in its own post.
Pevnost: nodes run from RAM only, nothing is written to disk, the resolver logs nothing. We keep a random account ID, the expiry date, device public keys, a payment record (with the payer’s name where the method carries it) and aggregate node load for 30 days. The full table with legal bases is in the privacy policy.
3. Which protocol, and what code runs on the server?
The protocol decides what the server has to know about you. OpenVPN with a username and password knows which account is which connection; WireGuard knows only a device public key. Ask also whether what runs on the server can be read: a published image, a hash, a reproducible build. Proprietary “own protocols” are a reason for caution, not excitement.
Pevnost: WireGuard only, in the Linux kernel, a public boot image with its hash on the status page. Consequence: no TCP fallback and no obfuscation; on a network that blocks UDP you will not connect. Why we chose that is in WireGuard vs OpenVPN.
4. Can I pay without you knowing who I am?
Registering with an email and paying by card ties your name to the account at the provider and at the payment processor. A useful provider asks for neither name nor email, accepts cryptocurrency and says openly what each method reveals. Be wary of “private” payments that still require an email for confirmation.
Pevnost: the account is a random ID with no name, email or password. Pay with Bitcoin (preferred), by card through Stripe or by bank transfer; Monero is coming. Transfers and cards carry the payer’s name and we keep the statement as tax law requires, which we say up front. The guide to paying without a name lists which method leaves which trace.
5. Who owns you?
Many well-known brands belong to a handful of holdings that also own the review sites ranking them. Ask for the real owner, their address, and whether you can find them in a public register. A provider you cannot find is a provider you cannot sue.
Pevnost: one natural person, Jan Faltýsek, listed in the Czech Trade Licensing Register, address in the footer of every page. The weakness we do not hide: one person is also a single point of failure, and a private beta means the service is still settling.
6. What happens when the police ask?
A good answer describes a procedure, not a feeling: who reviews the request, what is handed over, how long it takes, whether requests are counted publicly, and whether there is a warrant canary for orders under a gag. A bad answer is “that does not concern us”.
Pevnost: a written answer, usually within 7 days, that no activity data exists; at most the table from question 2 is handed over. Every request is counted in the quarterly transparency report, and the monthly warrant canary covers orders we may not talk about. A preservation order under section 7b of the Code of Criminal Procedure can freeze what we already hold, and your activity is not in it. Liability for what users do through the tunnel does not fall on a mere-conduit service under Article 4 of the Digital Services Act and section 3 of Act No. 480/2004 Coll.; abuse (attacks, spam) is dealt with and port 25 is blocked.
7. What does it cost, and why?
A cheap VPN for a few crowns a month on a three-year plan has to earn its money elsewhere: commissions, data, or simply not existing in three years. An expensive one is paying for the advertising you saw. Ask for one price, with no first-year tricks, and for a way to try the service without paying.
Pevnost: 120 CZK for 30 days or 1 200 CZK a year (5 € / 50 €), one price list, no discount codes. Two hours free to try, no payment and no card, one trial per connection and one device. Five devices per account, no data cap, 30-day refund. It is not the cheapest VPN on the market; it is the price at which a Czech server and one operator can be sustained without commissions.
How to add it up
There is no single best VPN for Czechia. If you want exits in ten countries and foreign streaming catalogues, we are not it and we say so. If you want a Czech no-log VPN under a law you understand, with an operator you can find in a register and claims you can check, take the seven answers above and compare them with anyone else’s. Then create an account, try the two free hours and run the leak test. If something does not add up, write to support@pevnost.net; we answer questions the same way we asked them here.