Who Owns Your VPN? The 2026 Ownership Map

Quick answer

The VPN market looks more diverse at brand level than it is at ownership level. One company, Kape Technologies, owns ExpressVPN, Private Internet Access, CyberGhost and Zenmate, and two of the review sites that rank them. NordVPN and Surfshark, routinely pitted against each other, belong to the same wider group. Ziff Davis owns IPVanish and media brands that review VPNs. Knowing who sits behind the logo will not tell you a VPN is bad. It tells you whose interests it ultimately answers to, which is the thing you are really trusting when you hand over every packet you send.

The legal answer is narrower than “where is the VPN based?” The relevant state may reach the contracting operator, controller, parent or processor when that entity is covered by domestic or cross-border process and possesses or controls responsive data. The US CLOUD Act, UK Investigatory Powers Act and incoming EU e-Evidence rules all make corporate and data-control boundaries more important, not less. None proves that a VPN keeps browsing logs; that remains an architecture and evidence question.

The market in one table

Map the brands to their owners and the long "best VPN" list collapses into a short one.

A VPN operator is technically able to observe sensitive connection metadata and, depending on implementation, traffic leaving its servers. One important fact about it is therefore not the logo or the launch-week discount, but who controls it, where they sit, and what else they answer to. Two brands in one group share corporate incentives, but their contracting entities, jurisdictions, infrastructure and data practices may still differ. The map must record those layers rather than infer one from another.

How we built this map

The table is a current research view, not a claim that every company in a corporate group shares one database or one legal entity. We match each brand to five separate layers: the consumer-facing name, the company named in the current terms or privacy policy, the immediate owner, the ultimate controlling group where that is disclosed, and the jurisdiction that can issue an order to the service actually handling the account. Those layers often point to different countries. A London headquarters, a Dutch holding company and a British Virgin Islands contracting entity are not interchangeable facts.

We prefer current company filings, annual reports, acquisition announcements, terms, privacy policies and official ownership disclosures. Provider histories and press pages are useful but interested evidence. Trade reporting fills gaps only where the transaction record is inaccessible. Search snippets, copied ownership charts and an unexplained "based in" badge are discovery aids, not proof. Where the operating entity or ultimate controller remains unclear, the correct label is unresolved rather than independent.

That last rule matters because absence of a visible parent is not evidence that no parent exists. Private companies can disclose little, brands can contract through regional subsidiaries, and acquisitions can move products without immediately rewriting every policy page. The map therefore records an as-of date and treats ownership confidence as a field that can change, not as permanent biography.

Kape Technologies, four VPNs and two review sites

Kape owns four consumer VPN brands. It bought CyberGhost in March 2017 for about $10 million, Zenmate soon after for around $5 million, Private Internet Access in 2019 for $127 million, and ExpressVPN in 2021 for $936 million (ProPrivacy; CyberInsider). One company now sits behind four of the brands that compete for the same buyer.

Kape's own current company history confirms the CyberGhost, Private Internet Access, Webselenese and ExpressVPN acquisitions, and records that it delisted from the London Stock Exchange in May 2023 (Kape Technologies). That change matters because the group is no longer subject to the same public-market reporting visibility. It does not prove weaker privacy. It raises the importance of product-level audits and disclosures because fewer facts now arrive through public filings.

The acquisitions are ordinary. The history is not. When Kape bought CyberGhost in 2017 it was still called Crossrider, a firm whose platform was used to bundle adware into software downloads. It rebranded to Kape Technologies in 2018 and dropped the ad-tech business (Wikipedia). People and companies can change, and the past does not automatically poison the present. It does set the bar for scrutiny. Routing your traffic through a company that built its first fortune on adware is a choice worth making with open eyes, rather than because an advert sounded sure of itself.

The reviewer owns the reviewed

In May 2021 Kape also bought Webselenese, the company behind vpnMentor and Wizcase, two of the most-read VPN review sites on the internet, with around 6.1 million monthly visitors between them (CyberInsider). So one company owns four VPNs and two of the sites that review VPNs. You can guess how it went. By late 2021, Kape's own brands held the top three places in vpnMentor's "best VPN" ranking, while rivals like NordVPN and Surfshark slid down it. Both sites still describe themselves as independent, and neither puts the word "Kape" anywhere a reader would easily see it.

Kape is not alone in the shape of this. Ziff Davis owns IPVanish, StrongVPN and Encrypt.me, bought from StackPath in April 2019, and Ziff Davis also owns PCMag, IGN and Mashable, titles that review VPNs (TechRadar; MarketScreener). To its credit, PCMag leaves its parent's VPNs out of its main "best VPN" roundup, which is more daylight than Kape's sites offer. The structure is still the point. When one owner sits on both sides of the recommendation, a glowing review is an advert wearing a press badge, and the only defence a reader has is knowing the ownership before they read the verdict.

This is, plainly, why this site publishes its formula and its ownership data instead of asking you to trust a number. A ranking you cannot audit is an opinion with confidence.

NordVPN and Surfshark share a corporate group

In February 2022, Nord Security and Surfshark, both Lithuanian, merged under a Netherlands-registered holding company, Cyberspace B.V. (Infosecurity Magazine; PR Newswire). Surfshark says the companies retained separate brands, apps, product development and infrastructure, and they are still compared against each other as rivals across the market. The defensible conclusion is that they share a corporate group, not that the two services are operationally identical. Nord's earlier acquisition of AtlasVPN had already folded a third brand into the same group before AtlasVPN was shut down in 2024 and its users were moved to NordVPN.

None of this makes NordVPN or Surfshark a bad product. Both are audited, both perform well, and we rank them on that evidence. It does mean an article presenting them as two independent contenders is staging a match between two teams owned by the same club.

Who is still independent

The genuinely independent VPNs are a shorter list than the market implies, and it holds most of the names built by people who cared more about the privacy than the marketing. Proton VPN is operated by Proton AG in Switzerland, whose controlling shareholder is now the non-profit Proton Foundation (Proton). Mullvad is owned by Amagicom AB in Sweden, and runs the servers behind Mozilla VPN, so even Mozilla's option is Mullvad underneath. IVPN, Windscribe and AirVPN remain independently held. Riseup VPN is run by a non-profit activist collective and owned by no one as a business.

AdGuard shows why operator is not the same as owner

AdGuard VPN is a useful boundary case. Its current privacy policy identifies ADGUARD SOFTWARE LIMITED, registered in Limassol, Cyprus, as the data controller. Its about page says the same company develops AdGuard VPN, AdGuard Ad Blocker and AdGuard DNS, and that three founders head the business. Those are strong first-party facts about the operator, controller and product family. They do not name the founders, show shareholdings, or establish an ultimate beneficial owner (privacy policy; about page).

The accurate label is therefore private operator identified; ultimate control unresolved in the current public primary record. Calling it independent simply because no parent is displayed would reverse the burden of proof. This distinction also affects how to read the AdGuard VPN review: the named Cyprus controller, the open-source TrustTunnel code, the Android app assessment and the unaudited no-logs claim are four separate evidence questions.

Independence guarantees nothing on its own. A small independent with no audit is not safer than an audited brand under a large owner. What independence removes is a whole class of conflict, the pressure from a parent's other businesses and its shareholders, and that absence has value.

Why the owner's country is not the whole legal answer

A VPN's advertised jurisdiction is only one possible point of legal contact. A demand may be directed to the company that contracts with the user, the data controller named in the privacy policy, a parent that controls the records, an infrastructure or payment provider, or a designated legal representative. The decisive questions are which entity is covered by the power, which entity possesses or controls the requested data, and what data the service created in the first place.

This is where our ownership evidence tracker and legal tracker map meet. The ownership tracker answers who operates, controls and sits beside the brand. The legal tracker asks what retention, preservation, disclosure and interception powers exist in the relevant country. Neither can answer the reader's risk question alone. A map of laws without the correct entity can attach the right rule to the wrong company; an ownership chart without legal process can mistake corporate geography for legal immunity.

The six-layer legal-reach test

1. Contracting operator: the entity named in the terms and usually the first recipient of an account-related demand.
2. Data controller: the entity deciding why and how personal data is processed. It may differ from the operator or payment company.
3. Parent and control: the company that can direct policy or has possession, custody or control of group records. Ownership alone does not prove record-level control.
4. Infrastructure and processors: hosting, analytics, support, app-store and payment providers may hold their own subscriber or operational records under other laws.
5. Service and user nexus: some powers turn on where the provider offers service, where the target is located, or whether an overseas operator has a sufficient domestic connection.
6. Data actually held: a disclosure order can reach an existing billing record, support ticket or connection log; it cannot reveal a browsing history that was genuinely never created. Preservation and prospective retention are separate powers.

The strongest case against jurisdiction panic is important. Lawful orders are not proof that a provider is secretly logging everyone, and the major regimes below contain thresholds, scope limits, review mechanisms and routes to challenge at least some orders. A Swiss, Swedish or British Virgin Islands company is not automatically safe; a US or UK company is not automatically unsafe. Architecture, minimisation, audit scope and a provider's record of contesting overbroad demands can matter more than the flag.

What the CLOUD Act and similar laws actually do

As of 26 July 2026, the main cross-border mechanisms do not create one global surveillance jurisdiction. They create several routes by which a properly authorised demand may reach a provider or records outside the issuing country. The scope and safeguards differ.

A preservation demand is also not the same as a general retention mandate. US law, for example, can require specified records already in a provider's possession to be preserved temporarily while legal process is obtained. Canada likewise has preservation demands and production orders for computer and transmission data. Those tools can be significant, but they should not be paraphrased as a universal duty for every VPN to generate future browsing histories.

Ownership and legal exposure, group by group

This table is an assessment of legal exposure, not a claim that an order has been served. It joins the current ownership record to the legal routes that deserve provider-specific testing. Where the contracting entity, record control or ultimate owner is unresolved, the conclusion stays unresolved.

These are exposure routes, not provider verdicts. The evidential burden is practical: a provider should show its legal entities, regional contracts, data-flow diagram, list of processors, retention schedule, access controls, audit scope and aggregate request statistics. A warrant can only disclose what exists, but readers should not have to take the provider's word for what exists.

Does ownership actually matter?

Yes, though not the way a scare headline wants. Ownership is not destiny. A VPN owned by a public company can still run an audited no-logs policy, sit in a sound jurisdiction, and behave well, and several do. What ownership changes is incentives, and incentives are exactly what you are betting on when you trust a no-logs promise you cannot personally check.

A public company answers to shareholders, which is a steady pressure to monetise that an independent does not carry in the same form. An owner of several VPN brands has reasons to share infrastructure and data handling across them. An owner of both the VPNs and the sites reviewing them has an obvious reason to flatter its own. None of these is proof of anything. Each is a reason to weight the facts you can verify, an external audit, the jurisdiction, the published evidence, above the ones you cannot, the brand and the advert. That is the whole skill.

Ownership changes the questions, not the verdict

A parent company can influence budget, retention policy, legal strategy, advertising, cross-selling and the choice of infrastructure suppliers. It may also leave the VPN operator, code, servers and privacy programme substantially separate. The first case creates a direct operational dependency; the second creates a governance risk. Treating both as the same would be as misleading as ignoring the parent altogether.

This is why ownership sits beside, rather than above, the rest of our evidence matrix. The useful questions are concrete. Which entity invoices the subscriber? Which entity is the data controller? Who receives legal demands? Does the audit cover only the application or the production server estate? Are sister brands included in the same audit scope? Can account identifiers, support records or advertising audiences move across the group? Has the company published a transparency report since the acquisition? A logo cannot answer any of those questions. A current contract, audit and filing sometimes can.

What to do with this

Before you trust a VPN, find out who owns it, where they are, and what else they own. Then weight the audit and the jurisdiction over the logo. Our comparison tool carries the ownership data for every provider we grade next to the audit status and the score, so you see the company behind the brand in the same place you see the evidence, and the ranking is computed from that evidence rather than from who owns whom or who pays us.

The industry would much rather you shopped by brand. Shop by owner, audit and jurisdiction instead, and most of the marketing stops working on you. That is the entire point of a map.

A five-minute ownership check before you subscribe

1. Read the current terms and privacy policy. Record the legal entity, address and governing law rather than the country displayed in an advert.
2. Trace the parent and sister brands. Check the owner's site, filings and acquisition history, then note whether it also owns review or advertising businesses.
3. Trace possession and control. Ask which operator, parent, processor or regional representative can access account, support, payment and connection records.
4. Separate retention from preservation. Check what the provider routinely creates, what a targeted order could preserve, and whether local law could impose prospective retention on this type of operator.
5. Open the latest audit. Confirm its date, scope, auditor, findings and remediation. An app audit does not prove server-side non-retention.
6. Check the transparency record. Look for legal requests, incidents, ownership changes and whether the provider explains what it could and could not supply.
7. Match the evidence to your threat model. A traveller avoiding hotel Wi-Fi, a torrent user, a journalist and an employee accessing a corporate network do not need the same owner, jurisdiction or operational proof.

Our recommendation is not to reject every consolidated provider. It is to refuse the fiction that brand competition equals independent ownership, and to require stronger operational evidence when the same group controls several products or both the product and the recommendation surface. Use the legal tracker to inspect the country layer and read our country-by-country legal enforcement assessment, then return to the entity and data-flow evidence before drawing a provider conclusion. This article is general research, not legal advice.

Frequently asked questions