[m4rtink]

But how do you verify the backend code and infrastructure?

Thats the most important question for a VPN.