Who owns your VPN and why is it important?

Chances are you installed a VPN to protect your online activity. Unfortunately, the company operating it might know more about you than your ISP does.

Understanding who owns your VPN is essential whether you’re traveling, working remotely, or just casually browsing. In this guide, I walk you through spotting red flags and choosing a service that meets your privacy needs.

TL;DR: VPN ownership in a nutshell

Market research shows the VPN market has consolidated around a handful of corporate groups. Three companies dominate the top tier:

• Kape Technologies: ExpressVPN, CyberGhost, Private Internet Access
• Nord Security: NordVPN, Surfshark
• Ziff Davis: IPVanish, StrongVPN, Hotspot Shield)

Most of these brands have undergone third-party audits confirming no-logs practices but for users who prefer a VPN without a parent company, independent services like Proton VPN, Mullvad, and Windscribe stand out.

Here’s what to do first:

1. Check your VPN’s parent company: Search “[VPN name] parent company”, or use OpenCorporates to trace corporate structures.
2. Verify independent audits: Look for recent third-party no-logs audits from firms like Deloitte, KPMG, or Securitum.
3. Avoid free VPNs: Many free VPNs sell user data to third parties.
4. Prioritize providers with verified transparency: Look for independently audited no-logs policies, transparency reports, and clear ownership disclosure.

Why ownership matters

When you connect to a VPN, all of your internet traffic flows through their servers. Your browsing history, login credentials, and location data pass through tunnels they control. Even if a VPN company says they don’t log your activity, you’re relying on their word.

Ownership matters because:

• Parent companies have multiple interests: If your VPN’s owner also runs ad networks, data analytics, or surveillance tools, conflicts of interest can emerge.
• Hidden ownership structures: Some VPNs use shell companies or offshore holdings to mask their true controllers. Tools like OpenCorporates can help trace these connections.
• Shaped infrastructure: Research from Citizen Lab revealed that dozens of supposedly independent VPNs operate on shared server networks under the same control.
• Jurisdiction affects legal obligations: For example, companies in Five Eyes alliance nations (US, UK, Canada, Australia, New Zealand) face intelligence-sharing agreements that can override privacy promises.

Major VPN mergers you should know

The consumer VPN market has undergone massive consolidation since 2018. In particular, Kape Technologies (formerly Crossrider) has acquired four major VPN services:

• ExpressVPN (2021)
• CyberGhost (2017)
• Private Internet Access (2018)

Kape is publicly owned, headquartered in London and Tel Aviv, and controlled by investor Teddy Sagi. Before rebranding in 2018, Crossrider distributed browser extensions that security vendors classified as adware and potentially unwanted programs.

Nord Security purchased Surfshark in February 2022. Both VPNs continue operating independently with separate server fleets. Meanwhile, independent providers like Proton VPN (Switzerland-based, part of Proton AG’s privacy ecosystem) and Mullvad (Sweden, self-funded, no venture capital) maintain full ownership control and transparent operations.

The problem with “family” VPN networks

A 2025 investigation by the Tech Transparency Project first uncovered “VPN families” – clusters of seemingly separate services actually controlled by the same entity.

• Family A: Eight VPNs including Turbo VPN and Robot VPN linked to Qihoo 360, a Chinese cybersecurity firm designated by the US Department of Defense with military connections.
• Family B: Multiple services sharing IP addresses and hosting infrastructure
• Family C: X-VPN and Fast Potato VPN

The risk is that one breach or policy change affects all services in the family. Users unknowingly trusting “different” VPNs are actually entrusting the same corporation.

How independent audits provide verification

Anyone can claim “no logs”. Leading providers now prove it by undergoing annual third-party security audits:

Not all audits carry equal weight. Reputable auditors include Deloitte, KPMG, PwC, Cure53, Securitum, and Assured AB. Smaller, unknown firms may lack rigor or independence. Also note that while most providers publish full audit results publicly, others restrict access to paying subscribers (NordVPN and Surfshark).

Jurisdiction still counts

Where your VPN is headquartered determines what laws apply. Some favorable jurisdictions include:

• Switzerland (Proton VPN): Strong constitutional privacy protections, not in Five Eyes.
• Panama (NordVPN):No mandatory data retention, outside intelligence alliances.
• Romania (CyberGhost):EU member but outside Five Eyes.
• British Virgin Islands (PureVPN): No data retention mandates.

Higher risk jurisdictions include:

• United States (PIA, IPVanish): Five Eyes member, subpoena power exists
• Canada (TunnelBear): Five Eyes member, intelligence-sharing obligations
• China-linked entities: Subject to national security laws requiring data cooperation

Even with strong privacy policies, US-based VPNs have complied with subpoenas – though no logs existed to provide in most cases. Jurisdiction creates legal exposure even for the most honest providers.

What makes a VPN trustworthy?

In my experience, reliable VPN providers tend to share these traits in common:

• Transparent ownership: Clear corporate structure, no hidden parent companies.
• Regular independent audits: Annual third-party verification of no-logs claims.
• Physical server ownership: Controlling hardware reduces third-party access.
• Public transparency reports: Documenting government data requests.
• No advertising dependencies: Revenue comes from subscriptions, not data sales.

Providers like Mullvad allow account creation with randomly generated numbers with no email required. An increasing number of VPNs also publish transparency reports.

Conversely, you should avoid VPN providers that:

• Hide ownership behind shell companies
• Have never undergone independent audits
• Are owned by advertising or surveillance corporations
• Operate free tiers funded by data sales

Key takeaways

Choosing a VPN is about more than just features or speed – it’s about who you trust with your internet traffic.

A few final thoughts worth keeping in mind:

Perfect privacy doesn’t exist. Every VPN requires some level of trust. The goal is choosing providers whose business model and legal framework align with your privacy goals – not finding someone who can guarantee 100% anonymity.

Transparency is an ongoing practice. Audits happen annually, ownership structure changes, and jurisdictions evolve. A company’s situation can change between audits. Checking a provider’s transparency report once isn’t enough; it’s worth staying aware of major developments like mergers or policy updates.

You have more control than you might think. Understanding ownership helps you spot when “competing” VPNs are actually subsidiaries. Audit reports and server ownership details separate marketing claims from verifiable facts – you don’t need technical expertise to ask these questions.

Trust, but verify. Independent audits, public transparency reports, and clear ownership disclosure aren’t just nice-to-haves – they’re baseline expectations for any privacy service worth using.

FAQs