Your IP: 216.73.216.149 Your ISP: Amazon.com, Inc. Your Status: Protected
When you shop around for a VPN, reading reviews, comparing feature lists, picking between five or six seemingly different options, you're often comparing products that ultimately answer to the same handful of parent companies. That matters. Who owns a VPN shapes how it responds to a legal request, what incentives shape its product decisions, and, as it turns out, whether the review you just read was published by a company with a financial stake in the outcome.
| VPN | Parent company | Jurisdiction / HQ | Eyes alliance | Notes |
|---|---|---|---|---|
| NordVPN | Nord Security | Operates under Panama jurisdiction (nordvpn S.A.); parent Nord Security was founded in Lithuania and is now based in the Netherlands [1] [2] | Panama: Not aligned Dutch parent: Nine Eyes |
Same corporate group as Surfshark since their 2022 merger [3] |
| Proton VPN | Proton AG (largest voting shareholder: the non-profit Proton Foundation) | Switzerland [4] | Not aligned | The Proton Foundation became its largest voting shareholder in June 2024, and Proton says it has no venture capital investors [4]. In 2025 Proton began moving some infrastructure to Germany and Norway over proposed Swiss surveillance rules, while staying a Swiss company [5] |
| ExpressVPN | Kape Technologies | ExpressVPN's operator, Express Technologies Ltd., is in the British Virgin Islands; Kape is incorporated in the Isle of Man and headquartered in London [6] [7] [8] | BVI: Not aligned London-based parent: Five Eyes |
Kape agreed to buy it in September 2021 for $936 million [9]. ExpressVPN's privacy policy still names Kape as its ultimate holding company as of October 2026 [6] |
| Private Internet Access | Kape Technologies | United States (Private Internet Access, Inc., Colorado) [10] | Five Eyes | Kape bought it in December 2019 [11]. Same parent as ExpressVPN and CyberGhost |
| Surfshark | Nord Security | Netherlands (Surfshark B.V., Amsterdam) [12] | Nine Eyes | Merged with Nord Security in 2022, brands operate separately [3] |
| CyberGhost | Kape Technologies | Romania (CyberGhost S.R.L., Bucharest); parent Kape is London-based [13] [8] | Romania: Not aligned London-based parent: Five Eyes |
Kape's first VPN acquisition, bought in 2017 when the company was still called Crossrider [14]. Kape also bought ZenMate in 2018 and folded it into CyberGhost in 2023 [15] [16] |
| Hide.me | eVenture Ltd | Malaysia (Labuan) [17] | Not aligned | We found no other VPN brands under the same owner |
| IPVanish | Ziff Davis | United States | Five Eyes | Ziff Davis also owns PCMag and Mashable [18]. It acquired IPVanish in 2019, when the company was still called j2 Global [19]. In 2016, under its previous owner Highwinds Network Group, IPVanish gave US Department of Homeland Security investigators identifying data on a customer despite marketing a no-logs policy at the time [20] |
| TunnelBear | McAfee | Founded in Toronto, Canada; owned by US-based McAfee [21] | Five Eyes | McAfee bought it in March 2018 [21] |
| Hotspot Shield | Point Wild | United States (Pango Group, Boston, part of Point Wild) [22] | Five Eyes | Originally an AnchorFree product. Aura bought Pango in 2020 and split Pango Group, including Hotspot Shield, back out in September 2024; Pango then merged with Total Security to form Point Wild in December 2024 [22] [23] [24] [25] [26] |
| HideMyAss (HMA) | Gen Digital | HMA is operated by Privax Limited (UK); parent Gen Digital is dual-headquartered in Tempe, Arizona and Prague [27] [29] [31] | Five Eyes | Not to be confused with Hide.me above, a different, unrelated company. AVG bought Privax in 2015, Avast bought AVG in 2016, and Avast merged with NortonLifeLock, which renamed itself Gen Digital, in 2022 [28] [29] [30]. Gen also sells VPNs under its Norton, Avast and AVG brands [31] |
"Eyes alliance" refers to Five Eyes, Nine Eyes, and Fourteen Eyes, intelligence-sharing agreements between member countries. A company based in a member country can be compelled by court order or government request to hand over customer data it holds, and in some cases to start collecting it, regardless of what its privacy policy promises. It's the same standard we hold ourselves to on our About Us page.
Five of these eleven brands collapse down to two actual owners. Kape Technologies accounts for three of them (ExpressVPN, PIA, and CyberGhost), and Nord Security for the other two (NordVPN and Surfshark). Kape has been privately held since mid-2023, when Unikmind, a company owned by its controlling shareholder Teddy Sagi, took it off London's AIM market [32] [33]. Nine of the eleven operate inside a Five or Nine Eyes country, or are controlled by a parent company that does, even when the VPN entity itself is registered somewhere else. IPVanish, TunnelBear, Hotspot Shield, and HideMyAss each sit inside a larger US-based security or media group, Ziff Davis, McAfee, Point Wild, and Gen Digital respectively. Proton VPN and Hide.me are the only two on this list that are independently owned and based outside the Eyes countries.
Jurisdiction matters because it determines what a company can be legally forced to do, not what it promises to do voluntarily. A no-logs policy is a choice a company makes. Whether that choice survives a court order is a question of law, and the answer depends largely on where the company is incorporated, where its data lives, and where its money moves. A VPN based in the US, the UK, or another Five Eyes country can be compelled by court order or government request to hand over data it holds, and in some cases to start collecting data it did not keep before, sometimes under a gag order that prevents the company from telling its users it happened. VPN providers that marketed no-logs policies have handed customer data to investigators before, as the IPVanish case below shows.
Structuring a company outside those jurisdictions doesn't make privacy some kind of superpower, no single decision does that, and no company should claim otherwise. What it does is mean a US or UK agency can't simply serve an order directly on the company and expect compliance; it has to go through the legal system where the company is actually based. That's the real difference between a policy and a structural fact, and it's why we built Lux VPN the way we did.
Read this article from Cybernews detailing the dangers of VPN and privacy companies located in "Eyes alliance" jurisdictions.
🚨 This isn't hypothetical. In 2016, IPVanish, then owned by Highwinds Network Group, answered a US Department of Homeland Security summons in a child-exploitation investigation with a customer's name, email address, real IP address and connection times, despite marketing a no-logs policy at the time [20]. The company was based in the US and the summons was legally enforceable there. A no-logs policy is a promise. What a company actually stores, and the laws it operates under, determine whether that promise holds.
This is the part many comparison articles leave out. Kape Technologies, the parent company behind ExpressVPN, CyberGhost, and Private Internet Access, also owns vpnMentor and Wizcase, two sites that publish VPN reviews and rankings, including reviews of Kape's own products. It got them by buying their parent company, Webselenese, in 2021 [34] [35] [8]. Ziff Davis, which owns IPVanish, also owns PCMag and Mashable, both of which publish VPN buying guides [18].
None of this automatically means a given review is dishonest. Some of these outlets disclose the relationship, and disclosure isn't nothing. But when the company grading the test also owns one of the students, that's worth knowing before you trust a ranking, especially a "top 10" list where a company's own product sits right alongside its competitors.
Lux VPN isn't a brand sitting inside a larger holding company alongside other VPN brands, and it isn't reviewed by a site its own parent company owns. We're incorporated in the Seychelles and bank in Hong Kong, both deliberately outside the US, UK, and EU. Customer data is hosted in Iceland. All decisions answer to the people paying for the service, not a private equity firm optimizing for an exit.
Read the full breakdown of our structure and jurisdiction on our About Us page.
Ownership changes often. Facts in the table reflect these sources as of October 2026.
Login