Who owns which VPN service?

A VPN carries all of your internet traffic through one company’s servers. That moves your trust rather than removing the need for it: away from your internet provider, toward the VPN company. You can only make that decision if you know who owns the service.

That is exactly the information missing from most comparisons — and there is a structural reason for it.

The conflict of interest nobody likes to write about

Kape Technologies owns ExpressVPN, CyberGhost and Private Internet Access. The same company also bought vpnMentor and Wizcase — two of the largest “independent” VPN comparison sites by traffic.

So a recommendation you read there may be the owner recommending its own product. That is not illegal, and it is sometimes disclosed, but it explains why this particular overview is one that almost nobody publishes.

Nord Security, in turn, is the company behind NordVPN, and it merged with Surfshark in 2022 — two brands that often appear in comparisons as alternatives to each other.

The overview

7 entries are not verified yet. We only publish what we have checked ourselves – a visible gap beats a guessed number.

Why the country matters

Where a company is based decides which authorities can demand data, under what conditions, and whether the country requires providers to retain connection records at all. A provider in Panama or Switzerland operates under different obligations than one in the United States.

That does not mean US providers are unsafe. It means the question “what happens if someone demands data” has a different answer depending on where the company sits.

For a US-based provider, two things are worth knowing:

• There is no general law requiring VPN companies to keep logs. A provider that genuinely stores nothing has nothing to hand over.
• But a US company can receive a subpoena, or a National Security Letter that comes with a gag order — meaning the company is legally barred from saying it happened. This is why some providers publish a “warrant canary”: a regularly updated statement that no such demand has been received. When the statement stops being updated, that silence is the signal.

The Federal Trade Commission can act against a company that misrepresents what it does with your data. That is a real backstop, but it works after the fact — it does not tell you what is happening today.

And a marketing promise like “no logs” is only worth something once it has been independently audited.

How this page is maintained

An empty field means: not verified by us yet. We do not enter anything we cannot back up, even when a value sounds plausible. For numbers a purchase decision rests on, a visible gap is worth more than a good guess.

Every value we do fill in gets a source and a date it was checked. If something changes later, we replace the value and set a new date – and the change stays traceable through the page’s version history.

What a VPN actually does and when it is worth paying for is in free vs. paid VPN . Setting one up is covered in set up a VPN on your phone .