Who Owns Your VPN? The 2026 Ownership Map

Quick answer

The VPN market looks like dozens of rivals. It is mostly a handful of owners wearing many brands. One company, Kape Technologies, owns ExpressVPN, Private Internet Access, CyberGhost and Zenmate, and two of the review sites that rank them. NordVPN and Surfshark, routinely pitted against each other, share a parent. Ziff Davis owns IPVanish and the tech magazines that review it. Knowing who sits behind the logo will not tell you a VPN is bad. It tells you whose interests it ultimately answers to, which is the thing you are really trusting when you hand over every packet you send.

The market in one table

Map the brands to their owners and the long "best VPN" list collapses into a short one.

A VPN is a company you pay to see all of your traffic. The most important fact about it is therefore not the logo or the launch-week discount, but who controls it, where they sit, and what else they answer to. Two brands under one owner share that owner's incentives, its jurisdiction, and often its plumbing, however different the marketing looks.

Kape Technologies, four VPNs and two review sites

Kape owns four consumer VPN brands. It bought CyberGhost in March 2017 for about $10 million, Zenmate soon after for around $5 million, Private Internet Access in 2019 for $127 million, and ExpressVPN in 2021 for $936 million (ProPrivacy; CyberInsider). One company now sits behind four of the brands that compete for the same buyer.

The acquisitions are ordinary. The history is not. When Kape bought CyberGhost in 2017 it was still called Crossrider, a firm whose platform was used to bundle adware into software downloads. It rebranded to Kape Technologies in 2018 and dropped the ad-tech business (Wikipedia). People and companies can change, and the past does not automatically poison the present. It does set the bar for scrutiny. Routing your traffic through a company that built its first fortune on adware is a choice worth making with open eyes, rather than because an advert sounded sure of itself.

The reviewer owns the reviewed

In May 2021 Kape also bought Webselenese, the company behind vpnMentor and Wizcase, two of the most-read VPN review sites on the internet, with around 6.1 million monthly visitors between them (CyberInsider). So one company owns four VPNs and two of the sites that review VPNs. You can guess how it went. By late 2021, Kape's own brands held the top three places in vpnMentor's "best VPN" ranking, while rivals like NordVPN and Surfshark slid down it. Both sites still describe themselves as independent, and neither puts the word "Kape" anywhere a reader would easily see it.

Kape is not alone in the shape of this. Ziff Davis owns IPVanish, StrongVPN and Encrypt.me, bought from StackPath in April 2019, and Ziff Davis also owns PCMag, IGN and Mashable, titles that review VPNs (TechRadar; MarketScreener). To its credit, PCMag leaves its parent's VPNs out of its main "best VPN" roundup, which is more daylight than Kape's sites offer. The structure is still the point. When one owner sits on both sides of the recommendation, a glowing review is an advert wearing a press badge, and the only defence a reader has is knowing the ownership before they read the verdict.

This is, plainly, why this site publishes its formula and its ownership data instead of asking you to trust a number. A ranking you cannot audit is an opinion with confidence.

NordVPN and Surfshark are the same company

In February 2022, Nord Security and Surfshark, both Lithuanian, merged under a Netherlands-registered holding company, Cyberspace B.V. (Infosecurity Magazine; PR Newswire). They kept separate brands, apps, pricing and infrastructure, and they are still compared against each other as rivals all over the internet. They share an owner. Nord's earlier acquisition of AtlasVPN had already folded a third brand into the same group before AtlasVPN was shut down in 2024 and its users were moved to NordVPN.

None of this makes NordVPN or Surfshark a bad product. Both are audited, both perform well, and we rank them on that evidence. It does mean an article presenting them as two independent contenders is staging a match between two teams owned by the same club.

Who is still independent

The genuinely independent VPNs are a shorter list than the market implies, and it holds most of the names built by people who cared more about the privacy than the marketing. Proton VPN is owned by Proton AG in Switzerland. Mullvad is owned by Amagicom AB in Sweden, and runs the servers behind Mozilla VPN, so even Mozilla's option is Mullvad underneath. IVPN, Windscribe and AirVPN remain independently held. Riseup VPN is run by a non-profit activist collective and owned by no one as a business.

Independence guarantees nothing on its own. A small independent with no audit is not safer than an audited brand under a large owner. What independence removes is a whole class of conflict, the pressure from a parent's other businesses and its shareholders, and that absence has value.

Does ownership actually matter?

Yes, though not the way a scare headline wants. Ownership is not destiny. A VPN owned by a public company can still run an audited no-logs policy, sit in a sound jurisdiction, and behave well, and several do. What ownership changes is incentives, and incentives are exactly what you are betting on when you trust a no-logs promise you cannot personally check.

A public company answers to shareholders, which is a steady pressure to monetise that an independent does not carry in the same form. An owner of several VPN brands has reasons to share infrastructure and data handling across them. An owner of both the VPNs and the sites reviewing them has an obvious reason to flatter its own. None of these is proof of anything. Each is a reason to weight the facts you can verify, an external audit, the jurisdiction, the published evidence, above the ones you cannot, the brand and the advert. That is the whole skill.

What to do with this

Before you trust a VPN, find out who owns it, where they are, and what else they own. Then weight the audit and the jurisdiction over the logo. Our comparison tool carries the ownership data for every provider we grade next to the audit status and the score, so you see the company behind the brand in the same place you see the evidence, and the ranking is computed from that evidence rather than from who owns whom or who pays us.

The industry would much rather you shopped by brand. Shop by owner, audit and jurisdiction instead, and most of the marketing stops working on you. That is the entire point of a map.

Frequently asked questions