Your IP: 216.73.217.176 Your ISP: Amazon.com, Inc. Your Status: Protected
When you shop around for a VPN, reading reviews, comparing feature lists, picking between five or six seemingly different options, you're very often comparing products that ultimately answer to the same handful of parent companies. That matters. Who owns a VPN shapes how it responds to a legal request, what incentives shape its product decisions, and, as it turns out, whether the "unbiased" review you just read was written by someone with a financial stake in the outcome.
| VPN | Parent company | Jurisdiction / HQ | Eyes alliance | Notes |
|---|---|---|---|---|
| NordVPN | Nord Security | Operates as nordvpn S.A. in Panama; Nord Security has Lithuanian roots | Not aligned | Same corporate group as Surfshark since their 2022 merger |
| Proton VPN | Proton Foundation | Switzerland | Not aligned | Converted to non-profit foundation ownership in 2024, no outside investors |
| ExpressVPN | Kape Technologies | ExpressVPN entity is British Virgin Islands; Kape is UK-registered | BVI: Not aligned UK parent: Five Eyes |
Kape acquired it in 2021 for $936 million |
| Private Internet Access | Kape Technologies | UK | Five Eyes | Same parent as ExpressVPN and CyberGhost |
| Surfshark | Nord Security | Netherlands (Amsterdam) | Nine Eyes | Merged with Nord Security in 2022, brands operate separately |
| CyberGhost | Kape Technologies | UK | Five Eyes | Kape's first VPN acquisition, bought in 2017 |
| ZenMate | Kape Technologies | UK | Five Eyes | Kape's fourth VPN brand, not on most "top 10" lists but same parent as the three above |
| Hide.me | eVenture Ltd | Malaysia | Not aligned | Independent, not part of a multi-brand VPN group |
| IPVanish | Ziff Davis | United States | Five Eyes | Ziff Davis also owns PCMag and Mashable; under prior ownership, handed over user logs to the FBI in 2016 despite marketing a no-logs policy at the time |
| TunnelBear | McAfee | United States | Five Eyes | |
| Hotspot Shield | Point Wild | United States | Five Eyes | Formerly Pango/Aura, originally AnchorFree |
| HideMyAss (HMA) | Gen Digital | HMA operates under UK jurisdiction; parent Gen Digital is US-based (Tempe, AZ) | Five Eyes | Not to be confused with Hide.me above, a different, unrelated company. Gen Digital also owns Norton VPN, Avast SecureLine VPN, and AVG Secure VPN, three more VPN brands under the same parent |
"Eyes alliance" refers to Five Eyes, Nine Eyes, and Fourteen Eyes, intelligence-sharing agreements between member countries. A company incorporated in a member country can be legally compelled to log and hand over customer data, regardless of what its privacy policy promises. It's the same standard we hold ourselves to on our About Us page.
Six of these twelve brands collapse down to two actual owners, Kape Technologies alone accounts for four of them (ExpressVPN, PIA, CyberGhost, and ZenMate). Nine of the twelve operate inside of a Five or Nine Eyes country, or are controlled by a parent company that does, even when the VPN entity itself is marketed as being somewhere else. IPVanish, TunnelBear, Hotspot Shield, and HideMyAss each sit inside a larger US security or media conglomerate of their own, Ziff Davis, McAfee, Point Wild, and Gen Digital respectively. Proton VPN and Hide.me are the only two on this list that are both independently owned and outside the Eyes alliances entirely.
Jurisdiction matters because it determines what a company can be legally forced to do, not what it promises to do voluntarily. A no-logs policy is a choice a company makes. Whether that choice survives a court order is a question of law, and the answer depends entirely on where the company is incorporated, where its data lives, and where its money moves. A VPN based in the US, the UK, or another Five Eyes country can be legally compelled to log activity and hand over user data, sometimes under a gag order that prevents the company from ever telling its users it happened. That's not hypothetical, it's happened, repeatedly, to VPN providers that marketed a no-logs policy right up until the day they were legally forced to break it.
Structuring a company outside those jurisdictions doesn't make privacy some kind of superpower, no single decision does that, and no company should claim otherwise. What it does is remove the direct legal mechanism that lets a government simply issue an order and expect compliance. That's the real difference between a policy and a structural fact, and it's why we built Lux VPN the way we did.
Read this article published CyberNews.com detailing the dangers of VPN and privacy companies located in "Eyes alliance" jurisdictions.
🚨 This isn't hypothetical. In 2016, IPVanish, then under different ownership than today, handed over user connection logs to the FBI as part of a criminal investigation, despite marketing a no-logs policy at the time. The company was legally based in the US, a Five Eyes country, and the request was legally enforceable. A no-logs policy is a promise. Jurisdiction determines whether that promise can be legally overridden.
This is the part most comparison articles leave out. Kape Technologies, the parent company behind ExpressVPN, CyberGhost, and Private Internet Access, also owns vpnMentor, Wizcase, and Safety Detectives, three sites that publish VPN reviews and rankings, including reviews of Kape's own products. Ziff Davis, which owns IPVanish, also owns PCMag and Mashable, both of which publish VPN buying guides.
None of this automatically means a given review is dishonest. Some of these outlets disclose the relationship, and disclosure isn't nothing. But when the company grading the test also owns one of the students, that's worth knowing before you trust a ranking, especially a "top 10" list where a company's own product sits right alongside its competitors.
Lux VPN isn't a brand sitting inside a larger holding company with three other "competing" VPNs, and it isn't reviewed by a site its own parent company owns. We're incorporated in the Seychelles, bank in Hong Kong, and host our data in Iceland and Switzerland, all deliberately outside the US, UK, and EU, and all decisions answer to the people paying for the service, not a private equity firm optimizing for an exit.
Read the full breakdown of our structure and jurisdiction on our About Us page.
Login