{ "schema_version": 1, "interpretation": "Selected evidence, not a privacy rating or exhaustive history.", "providers": [ { "provider": "expressvpn", "reviewed_on": "2026-11-06", "operator": { "name": "Express Technologies Ltd.", "country_code": "VG", "country": "British Virgin Islands", "source_ids": [ "express-policy" ] }, "ownership": { "label": "Kape Technologies PLC", "country_code": "GB", "group_id": "kape", "note": "The privacy policy names a UK holding company and says the BVI operator controls personal data. That is a provider claim, not a finding that UK links are irrelevant.", "source_ids": [ "express-policy" ] }, "uk_territory": true, "context": "BVI is a UK Overseas Territory and is not separately listed in the commonly cited 14-country set. Territory status and the UK parent are additional context; this is not a finding of legal isolation.", "collection_summary": "Collects coarse connection-day/location information and per-user transfer totals, while denying activity and precise connection logs.", "collection_source_ids": [ "express-policy" ], "evidence_status": "Provider statements and published research; not an independent legal or technical audit.", "logging_reviewed_on": "2026-11-08" }, { "provider": "nordvpn", "reviewed_on": "2026-11-06", "operator": { "name": "nordvpn S.A.", "country_code": "PA", "country": "Panama", "source_ids": [ "nord-terms" ] }, "ownership": { "label": "Nord Security / shared holding group with Surfshark", "country_code": null, "group_id": "nord-surf", "note": "The shared holding relationship is documented by Surfshark. The complete holding-company chain and its jurisdiction were not established in this review.", "source_ids": [ "nord-surf-owner" ] }, "uk_territory": false, "context": "The contracting entity in the reviewed terms is Panamanian. Corporate-group relationships and the locations of servers or staff are separate questions.", "collection_summary": "Temporary session controls and a 90-day service-use flag sit alongside its no-activity-logs claim.", "collection_source_ids": [ "logging-nord-vpn", "logging-nord-account" ], "evidence_status": "Provider statements and published research; not an independent legal or technical audit.", "logging_reviewed_on": "2026-11-08" }, { "provider": "pia", "reviewed_on": "2026-11-06", "operator": { "name": "PIA Private Internet Access, Inc.", "country_code": "US", "country": "United States", "source_ids": [ "pia-policy", "pia-about" ] }, "ownership": { "label": "Kape Technologies PLC", "country_code": "GB", "group_id": "kape", "note": "Kape lists PIA as a group brand and identifies its group headquarters in London, UK. PIA and ExpressVPN remain different service operators.", "source_ids": [ "kape-brands" ] }, "uk_territory": false, "context": "The United States belongs to Five Eyes and therefore also appears in the broader Nine and Fourteen country sets. That is a jurisdiction signal, not proof of monitoring.", "collection_summary": "Denies browsing, DNS, IP, timestamp and bandwidth logs; account/payment information and optional reports remain separate.", "collection_source_ids": [ "pia-policy" ], "evidence_status": "Provider statements and published research; not an independent legal or technical audit.", "logging_reviewed_on": "2026-11-08" }, { "provider": "protonvpn", "reviewed_on": "2026-11-06", "operator": { "name": "Proton AG", "country_code": "CH", "country": "Switzerland", "source_ids": [ "proton-terms" ] }, "ownership": { "label": "Proton Foundation (primary shareholder)", "country_code": "CH", "group_id": "proton", "note": "Proton identifies the Swiss nonprofit foundation as its primary shareholder. This does not mean the VPN operator itself is a nonprofit foundation.", "source_ids": [ "proton-terms", "proton-owner" ] }, "uk_territory": false, "context": "Switzerland is not listed in the Five, Nine or Fourteen Eyes country sets. This does not rule out Swiss legal requests or other international cooperation.", "collection_summary": "VPN-session claims differ from optional Proton Account login-IP logging and anti-abuse checks.", "collection_source_ids": [ "proton-policy", "logging-proton-logs", "logging-proton-account" ], "evidence_status": "Provider statements and published research; not an independent legal or technical audit.", "logging_reviewed_on": "2026-11-08" }, { "provider": "surfshark", "reviewed_on": "2026-11-06", "operator": { "name": "Surfshark B.V.", "country_code": "NL", "country": "Netherlands", "source_ids": [ "surf-policy" ] }, "ownership": { "label": "Shared holding group with Nord Security", "country_code": null, "group_id": "nord-surf", "note": "Surfshark describes shared ownership with Nord Security and independent operation. Complete ultimate ownership and parent jurisdiction are not established here.", "source_ids": [ "nord-surf-owner" ] }, "uk_territory": false, "context": "The Netherlands is in Nine Eyes and the broader Fourteen group, outside the Five Eyes subset. NordVPN’s Panama jurisdiction does not transfer to Surfshark.", "collection_summary": "Temporary VPN connection identifiers are distinct from longer-lived account, billing and support records.", "collection_source_ids": [ "surf-policy" ], "evidence_status": "Provider statements and published research; not an independent legal or technical audit.", "logging_reviewed_on": "2026-11-08" }, { "provider": "cyberghost", "reviewed_on": "2026-11-06", "operator": { "name": "CyberGhost S.R.L.", "country_code": "RO", "country": "Romania", "source_ids": [ "cyberghost-policy" ] }, "ownership": { "label": "Kape Technologies", "country_code": "GB", "group_id": "kape", "note": "Kape lists CyberGhost, ExpressVPN, PIA and its publishing business among its brands. Shared control is relevant context, not proof of customer-data access.", "source_ids": [ "kape-brands", "cyberghost-policy" ] }, "uk_territory": false, "context": "Romania is outside the listed Fourteen Eyes set. The Romanian operator, UK parent and server jurisdictions remain separate considerations.", "collection_summary": "Denies identifiable VPN logs but describes aggregate connection events and optional support diagnostics.", "collection_source_ids": [ "cyberghost-policy" ], "evidence_status": "Provider statements and published records; no independent legal or technical audit by StealthVPN.", "research": [ { "kind": "provider", "title": "Deloitte assurance: provider summary obtained", "period": "Q4 2025 report; checked November 6, 2026", "summary": "CyberGhost describes a third Deloitte Audit Romania assurance engagement under ISAE 3000 (revised), covering VPN configuration, management systems and token-based Dedicated IP.", "limits": "The underlying assessor report has not been obtained here. This is CyberGhost’s account of assurance, not our verification of the assessor’s full scope or results.", "source_ids": [ "cyberghost-q4-2025" ] }, { "kind": "provider", "title": "Legal requests: a self-reported outcome", "period": "October–December 2025", "summary": "The provider lists police requests of one in October, zero in November and one in December, and reports that no user data was handed over.", "limits": "No corresponding court records were obtained. A self-reported quarter does not establish the absence of all historical disclosures.", "source_ids": [ "cyberghost-q4-2025" ] } ], "logging_reviewed_on": "2026-11-08" }, { "provider": "hideme", "reviewed_on": "2026-11-06", "operator": { "name": "eVenture Ltd", "country_code": "MY", "country": "Malaysia", "source_ids": [ "hideme-legal", "hideme-jurisdiction" ] }, "ownership": { "label": "eVenture Ltd; ultimate controlling ownership not established", "country_code": null, "group_id": "eventure", "note": "The provider identifies its Malaysian operator. This review does not independently establish the full beneficial-ownership chain.", "source_ids": [ "hideme-jurisdiction" ] }, "uk_territory": false, "context": "The provider identifies Labuan, Malaysia as its service jurisdiction. It is outside the listed Fourteen Eyes countries, which does not establish immunity from legal process.", "collection_summary": "Temporary troubleshooting records and monthly traffic counters qualify its broad no-session-logs statement.", "collection_source_ids": [ "logging-hide" ], "evidence_status": "Provider statements and published records; no independent legal or technical audit by StealthVPN.", "research": [ { "kind": "research", "title": "Securitum report: container-image review", "period": "Assessment March 19–June 6, 2024; product state March 15, 2024", "summary": "The provider-commissioned report describes policy review, interviews, deployment review and inspection of a provider-supplied example LXC VPN container. Securitum found no activity or traffic logs in that sample and relied on a common-image deployment model.", "limits": "This was not continuous inspection of every live host, app or billing system. No configuration-change alarm was found; the report describes read-only templates and redeployment as mitigation. These dated findings do not establish the current state.", "source_ids": [ "hideme-securitum-2024" ] }, { "kind": "unresolved", "title": "Ownership and disclosure gaps", "period": "Research checked November 6, 2026", "summary": "The Malaysian operator is identified, but a complete current beneficial-ownership chain and a court-record-backed disclosure history have not been established in this research.", "limits": "An unresolved field is not evidence of misconduct or proof that no legal requests occurred.", "source_ids": [ "hideme-jurisdiction", "hideme-legal" ] } ], "logging_reviewed_on": "2026-11-08" }, { "provider": "purevpn", "reviewed_on": "2026-11-06", "operator": { "name": "GZ Systems Private Ltd", "country_code": "VG", "country": "British Virgin Islands", "source_ids": [ "purevpn-policy" ] }, "ownership": { "label": "GZ Systems / PureSquare portfolio; ultimate control not established", "country_code": null, "group_id": "gz-systems", "note": "The policy identifies the BVI operator. PureSquare lists PureVPN in its brand portfolio. These statements do not establish the complete current beneficial-ownership chain.", "source_ids": [ "purevpn-policy", "pure-square" ] }, "uk_territory": true, "context": "BVI is a UK Overseas Territory, not a separately enumerated member of the country sets. The current BVI operator should not be projected backward onto the 2017 incident.", "collection_summary": "Denies activity logs but describes connection dates, ISP information and bandwidth totals, with add-on exceptions.", "collection_source_ids": [ "purevpn-policy" ], "evidence_status": "Provider statements and published records; no independent legal or technical audit by StealthVPN.", "research": [ { "kind": "research", "title": "KPMG letter: seven sampled servers", "period": "Assessment February 16–22, 2023; validation March–April 2023", "summary": "The provider-commissioned April 17 letter covers seven servers and supporting infrastructure in six countries. KPMG concluded that four assessed claims concerning origin IPs, assigned IPs, connection times and VPN activity were met by the end of the engagement.", "limits": "The letter expressly excludes a cybersecurity assessment and a full privacy assessment. It is a dated letter, not the full work papers or evidence of continuous compliance in 2026. It also restricts third-party reliance.", "source_ids": [ "purevpn-kpmg-2023" ] }, { "kind": "provider", "title": "Current portfolio and historical logging are separate", "period": "Portfolio checked November 6, 2026", "summary": "PureSquare lists PureVPN alongside PureDome, PureWL and PureLabs. The current policy identifies GZ Systems Private Ltd; the 2017 connection-record case concerns an earlier period.", "limits": "A brand portfolio does not identify every beneficial owner. The current consumer policy and separate white-label arrangements should not be treated as one uniform logging promise. Read the linked investigation for the historical court evidence.", "source_ids": [ "pure-square", "purevpn-policy" ] } ], "logging_reviewed_on": "2026-11-08" }, { "provider": "privadovpn", "reviewed_on": "2026-11-06", "operator": { "name": "Privado Networks ehf", "country_code": "IS", "country": "Iceland", "source_ids": [ "privado-terms", "privado-policy" ] }, "ownership": { "label": "Privado Networks entities; controlling owner not established", "country_code": null, "group_id": "privado", "note": "Current documents distinguish the Icelandic contracting entity from US and Swiss payment affiliates. Those payment roles do not establish the complete ownership chain.", "source_ids": [ "privado-terms", "privado-policy" ] }, "uk_territory": false, "context": "The terms transferred service contracts from the Swiss company to the Icelandic company effective May 1, 2026. Older Swiss labels in reviews are historical. Iceland is outside the listed Fourteen Eyes set.", "collection_summary": "Denies VPN traffic, DNS and session-IP logs while retaining account/plan bandwidth counters and other account data.", "collection_source_ids": [ "privado-policy" ], "evidence_status": "Provider statements and published records; no independent legal or technical audit by StealthVPN.", "research": [ { "kind": "unresolved", "title": "Technical audit report not obtained", "period": "Research checked November 6, 2026", "summary": "No independently authored technical audit report has been obtained for this dossier. The privacy policy remains a provider statement; published reviews are not substitutes for an infrastructure assessment.", "limits": "This is a gap in the evidence collected here, not a claim that an audit has never happened or a security verdict.", "source_ids": [ "privado-policy" ] }, { "kind": "provider", "title": "Read the current contracting entity", "period": "Transfer effective May 1, 2026", "summary": "Current terms transfer service contracts from Privado Networks AG in Switzerland to Privado Networks ehf in Iceland. Payment affiliates in Switzerland and the US have separate described roles.", "limits": "Older reviews’ Swiss labels are historical. The ultimate ownership chain and a court-record-backed disclosure history remain unestablished here.", "source_ids": [ "privado-terms", "privado-policy" ] } ], "logging_reviewed_on": "2026-11-08" }, { "provider": "privatevpn", "reviewed_on": "2026-11-06", "operator": { "name": "PrivateVPN Global AB", "country_code": "SE", "country": "Sweden", "source_ids": [ "privatevpn-terms", "privatevpn-policy" ] }, "ownership": { "label": "Miss Group — acquisition announced June 2022", "country_code": "SE", "group_id": "miss-group", "note": "Miss Group announced its acquisition in 2022. That dated company announcement is not a fresh beneficial-ownership registry check or proof that a parent receives VPN traffic.", "source_ids": [ "privatevpn-acquisition" ] }, "uk_territory": false, "context": "The contracting terms apply Swedish law. Sweden belongs to the listed Fourteen Eyes set but not the Five or Nine subsets; this does not itself establish user logging.", "collection_summary": "Denies VPN activity, IP, timestamp and bandwidth logs; billing processors and support still handle identifying data.", "collection_source_ids": [ "privatevpn-policy" ], "evidence_status": "Provider statements and published records; no independent legal or technical audit by StealthVPN.", "research": [ { "kind": "unresolved", "title": "Technical audit report not obtained", "period": "Research checked November 6, 2026", "summary": "No independently authored technical audit report has been obtained for this dossier. Logging denials in the policy are attributed to the provider.", "limits": "The gap does not establish that no audit exists. A court-record-backed disclosure history has also not been established in this research.", "source_ids": [ "privatevpn-policy" ] }, { "kind": "provider", "title": "Acquisition announcement: a dated ownership lead", "period": "June 17, 2022", "summary": "Miss Group announced the PrivateVPN acquisition and described Perwyn as its majority investor at that time. The service terms identify PrivateVPN Global AB.", "limits": "The announcement is not a current registry audit. It does not establish today’s complete beneficial-ownership chain or parent-company access to VPN traffic.", "source_ids": [ "privatevpn-acquisition", "privatevpn-terms" ] } ], "logging_reviewed_on": "2026-11-08" } ], "assessments": [ { "id": "proton-securitum-2025", "provider": "protonvpn", "title": "Securitum no-logs assessment", "kind": "commissioned_audit", "source_ids": [ "audit-scope" ], "period": "Report: 18 August–19 September 2025; on-site work: 18–20 August 2025", "commissioner": "Proton AG", "scope": "Production VPN-server no-logs controls, using a representative sample and guided live-system review.", "reported_result": "Securitum reports that the examined production environment adhered to the assessed no-logs policy.", "limits": "Excludes CI/CD, formal source review, account/accounting systems and binary analysis. Not an unsupervised forensic investigation or inspection of every server.", "locator": "Report pp. 2–4: engagement scope, exclusions and limitations.", "checked_on": "2026-11-07" }, { "id": "hideme-securitum-2024", "provider": "hideme", "title": "Securitum no-log compliance audit", "kind": "commissioned_audit", "source_ids": [ "hideme-securitum-2024" ], "period": "Work: 19 March–6 June 2024; product state: 15 March 2024", "commissioner": "hide.me engagement; the report describes provider-supplied systems and interviews", "scope": "No-log questions, configurations, deployment process and an example LXC VPN-container snapshot supplied by hide.me.", "reported_result": "Securitum reports no identified container issue compromising the assessed no-log policy; a startup log was distinguished from user-activity logs.", "limits": "A supplied example container is not an independent inspection of every running node, account system or later release.", "locator": "Report p. 2: scope, example container and product-state date.", "checked_on": "2026-11-07" }, { "id": "purevpn-kpmg-2023", "provider": "purevpn", "title": "KPMG technical privacy assessment letter", "kind": "commissioned_assessment_letter", "source_ids": [ "purevpn-kpmg-2023" ], "period": "Assessment: 16–22 February 2023; validation: March–April 2023; letter: 17 April 2023", "commissioner": "PureVPN", "scope": "Four specified logging claims on seven VPN servers and supporting infrastructure in six countries.", "reported_result": "The letter reports compliance with the four assessed policy claims at the engagement’s conclusion.", "limits": "Summary letter, not a full cybersecurity or privacy assessment. The letter restricts distribution/use and disclaims third-party reliance; we link the provider-hosted document rather than reproduce it.", "locator": "One-page letter: objective, approach and limitations.", "checked_on": "2026-11-07" }, { "id": "cyberghost-deloitte-provider-summary", "provider": "cyberghost", "title": "CyberGhost account of Deloitte assurance", "kind": "provider_statement", "source_ids": [ "cyberghost-q4-2025" ], "period": "Provider report covering Q4 2025", "commissioner": "CyberGhost describes a Deloitte engagement; underlying engagement terms not inspected here", "scope": "The provider’s transparency report describes its third Deloitte no-logs assurance engagement.", "reported_result": "An attributed provider account; this matrix does not present it as an independently inspected assurance report.", "limits": "Full assessor scope, sample, qualifications and report were not reviewed here. The police-request tables on this source disagree; no aggregate request total is inferred.", "locator": "Transparency report: Deloitte spotlight; compare the two police-request tables.", "checked_on": "2026-11-07" } ], "events": [ { "id": "nordvpn-2024-disclosure", "providers": [ "nordvpn" ], "category": "legal", "title": "NordVPN disclosed account and payment information", "event_date": "2024-10", "scope": "NordVPN account data; Panamanian criminal investigation", "evidence": "Provider disclosure; warrant not reviewed", "findings": { "text": "NordVPN says a binding warrant from Panama’s prosecutor required it to provide the user data it held. Its statement was updated on October 29, 2024.", "source_ids": [ "nord-disclosure" ] }, "data_outcome": { "text": "The company reports providing payment-related information and confirming the existence of an account tied to an email supplied by the authorities.", "source_ids": [ "nord-disclosure" ] }, "response": { "text": "NordVPN says it had no traffic, connection or online-activity logs to provide.", "source_ids": [ "nord-disclosure" ] }, "limits": "This is an acknowledged account-data disclosure, not evidence here of browsing-history disclosure. The underlying warrant, exact payment fields and case outcome were not reviewed. A no-activity-logs policy does not eliminate account identification.", "reviewed_on": "2026-11-06" }, { "id": "pia-2016-subpoena", "providers": [ "pia" ], "category": "legal", "title": "PIA’s historical subpoena response in an FBI complaint", "event_date": "2016-03-08", "scope": "London Trust Media / PIA, before Kape ownership", "evidence": "Court filing; third-party mirrored copy", "findings": { "text": "An FBI criminal complaint describes a subpoena to London Trust Media, then doing business as Private Internet Access. Paragraph 33 records the response.", "source_ids": [ "pia-complaint" ] }, "data_outcome": { "text": "The affidavit says the company could identify only the US East Coast IP-address cluster and describe accepted payment methods. It does not report a user-to-IP identification from PIA.", "source_ids": [ "pia-complaint" ] }, "response": { "text": "PIA’s current transparency page describes its historical responses as support for its no-logs policy.", "source_ids": [ "pia-current-transparency" ] }, "limits": "The complaint is an investigator’s sworn account, not a judicial certification of every logging practice. The reviewed copy is mirrored on Scribd, not obtained directly from the court docket. This 2016 episode predates the current ownership structure.", "reviewed_on": "2026-11-06" }, { "id": "proton-vpn-2025-requests", "providers": [ "protonvpn" ], "category": "legal", "title": "Proton VPN reports no identifying data supplied for 2025 orders", "event_date": "2025", "scope": "Proton VPN; calendar-year transparency totals", "evidence": "Provider transparency report", "findings": { "text": "Proton VPN’s report lists 59 orders and 59 denied orders for 2025. It says the requests sought to identify users connected to particular VPN servers at particular times.", "source_ids": [ "proton-transparency" ] }, "data_outcome": { "text": "Proton says it could not provide the requested identifying information because the necessary VPN logs were not kept.", "source_ids": [ "proton-transparency" ] }, "response": { "text": "The report distinguishes Swiss-approved legal process from foreign requests. That legal description is Proton’s position.", "source_ids": [ "proton-transparency" ] }, "limits": "These are self-reported totals for a defined period, not independently inspected court files. They concern VPN connection identification and do not establish that no account or billing data exists.", "reviewed_on": "2026-11-06" }, { "id": "proton-mail-2021-order", "providers": [ "protonvpn" ], "category": "legal", "title": "The 2021 Proton logging controversy involved Mail", "event_date": "2021-09-06", "scope": "Proton Mail; related company, different product", "evidence": "Provider response; other product", "findings": { "text": "Proton’s September 2021 response says Swiss authorities issued a binding order in the case of a French activist, and explains targeted IP logging obligations for Mail accounts.", "source_ids": [ "proton-mail-order" ] }, "data_outcome": { "text": "The episode concerns targeted account/IP information in Proton Mail. It is not a documented Proton VPN traffic-log handover.", "source_ids": [ "proton-mail-order" ] }, "response": { "text": "Proton said it could not appeal that request and distinguished the legal treatment of Mail and VPN. The page includes a subsequent court-ruling update.", "source_ids": [ "proton-mail-order" ] }, "limits": "The underlying order and resulting disclosed dataset were not reviewed. The response does not support treating every Proton product as having identical obligations, or treating its 2021 legal explanation as a permanent statement of law.", "reviewed_on": "2026-11-06" }, { "id": "expressvpn-gericke-2021", "providers": [ "expressvpn" ], "category": "ownership", "title": "ExpressVPN’s 2021 Daniel Gericke employment controversy", "event_date": "2021-09-14", "scope": "A documented employee relationship; earlier UAE hacking work", "evidence": "DOJ-hosted court agreement + company response", "findings": { "text": "Daniel Gericke is a signatory to a September 2021 US deferred prosecution agreement concerning hacking-related work for the UAE. The agreement acknowledges the truth of its attached factual statement and resolves charges subject to its terms.", "source_ids": [ "gericke-dpa" ] }, "data_outcome": { "text": "This record concerns prior hacking work. It does not document an ExpressVPN customer-data disclosure.", "source_ids": [ "gericke-dpa" ] }, "response": { "text": "ExpressVPN confirmed hiring him in December 2019, defended his defensive-security expertise, said it did not condone Project Raven and announced more frequent audits.", "source_ids": [ "express-gericke" ] }, "limits": "A deferred prosecution agreement is not a conviction. This is a dated employment relationship, not a claim that he currently works there. Current employment and later procedural disposition were not established here. Neither his nationality nor previous work alone establishes access to VPN customer data.", "reviewed_on": "2026-11-06" }, { "id": "kape-crossrider-history", "providers": [ "expressvpn", "pia", "cyberghost" ], "category": "ownership", "title": "Kape’s Crossrider history and the adware concern", "event_date": "2018-03-07", "scope": "Historical parent-company business; current VPN brands are distinct", "evidence": "Company filing + original security research", "findings": { "text": "A March 2018 regulatory announcement documents Crossrider’s renaming as Kape. Separately, Malwarebytes identifies PUP.Optional.Crossrider as adware and describes bundling and browser-hijacking behavior.", "source_ids": [ "kape-name", "crossrider-detection" ] }, "data_outcome": { "text": "These sources establish historical corporate and software concerns, not that current ExpressVPN or PIA apps contain that adware or sell VPN traffic.", "source_ids": [ "kape-name", "crossrider-detection" ] }, "response": { "text": "The 2018 announcement describes a strategic shift toward consumer security and privacy. Kape now lists ExpressVPN and PIA among its brands.", "source_ids": [ "kape-name", "kape-brands" ] }, "limits": "The detection classification concerns particular software; the name-change filing concerns a company. They do not establish that every platform customer behaved alike or that Kape intentionally authored every unwanted payload. Current VPN systems require their own evidence.", "reviewed_on": "2026-11-06" }, { "id": "kape-control-and-publishing", "providers": [ "expressvpn", "pia", "cyberghost" ], "category": "ownership", "title": "Kape: controlling shareholder history and review publishing", "event_date": "2023-02-13", "scope": "Ownership and potential commercial conflicts", "evidence": "Regulatory announcement + current company brand list", "findings": { "text": "Unikmind’s February 2023 offer announcement identifies it as wholly owned by Teddy Sagi and already holding about 54.8% of Kape at that date. Kape’s current brand page lists ExpressVPN, PIA and content publisher Webselenese.", "source_ids": [ "kape-control", "kape-brands" ] }, "data_outcome": { "text": "This establishes dated ownership and a shared commercial group. It does not show that the owner receives VPN user records.", "source_ids": [ "kape-control", "kape-brands" ] }, "response": { "text": "Kape describes Webselenese as a publisher of privacy and security comparison content. Shared ownership is relevant when evaluating commercial incentives.", "source_ids": [ "kape-brands" ] }, "limits": "The 2023 percentage is historical, not a current cap table. This entry makes no personal-misconduct allegation against Sagi and does not infer that any particular review was manipulated. Current beneficial-ownership records and editorial controls need separate investigation.", "reviewed_on": "2026-11-06" }, { "id": "nordvpn-2018-server-incident", "providers": [ "nordvpn" ], "category": "security", "title": "NordVPN’s 2018 Finland server incident, disclosed in 2019", "event_date": "2018-03", "scope": "One third-party-hosted server in Finland", "evidence": "Provider incident disclosure", "findings": { "text": "NordVPN’s October 2019 response dates unauthorized access to a Finland server to March 2018, and says it learned of it in April 2019.", "source_ids": [ "nord-breach" ] }, "data_outcome": { "text": "The company reports stolen TLS keys, no affected user credentials and no signs of traffic monitoring. Its report says the server contained no activity logs.", "source_ids": [ "nord-breach" ] }, "response": { "text": "NordVPN says it terminated the hosting relationship and began a broader service audit.", "source_ids": [ "nord-breach" ] }, "limits": "A provider incident account is not an independent reconstruction. A historical key exposure is different from a court-ordered production of logs; absence of reported monitoring is not proof that every possible impact was excluded.", "reviewed_on": "2026-11-06" }, { "id": "nord-surf-shared-group", "providers": [ "nordvpn", "surfshark" ], "category": "ownership", "title": "NordVPN and Surfshark share a holding group", "event_date": "2022", "scope": "Shared corporate group; separate service operators", "evidence": "Company ownership statement", "findings": { "text": "Surfshark’s company page dates its merger with Nord Security to 2022 and describes shared holding-company ownership.", "source_ids": [ "nord-surf-owner" ] }, "data_outcome": { "text": "The relationship establishes common corporate control, not evidence that the services share VPN traffic logs.", "source_ids": [ "nord-surf-owner" ] }, "response": { "text": "Surfshark says the services operate independently. Our jurisdiction dossiers continue to show the distinct service operators.", "source_ids": [ "nord-surf-owner" ] }, "limits": "The complete holding-company chain, beneficial ownership and internal data-access arrangements were not established. A group relationship does not transfer NordVPN’s Panamanian operator jurisdiction to Surfshark.", "reviewed_on": "2026-11-06" }, { "id": "purevpn-2017-connection-records", "providers": [ "purevpn" ], "category": "legal", "title": "A 2017 affidavit describes identifying connection records", "event_date": "2017-10-03", "scope": "PureVPN at the time of the Ryan Lin investigation; historical connection metadata", "evidence": "DOJ-hosted criminal complaint and sworn FBI affidavit", "findings": { "text": "Paragraph 52 says PureVPN records helped associate the same customer with originating IP addresses at a home and workplace.", "source_ids": [ "purevpn-lin-affidavit" ] }, "data_outcome": { "text": "The described evidence concerns originating IP/account correlation. This passage does not establish disclosure of browsing history or content.", "source_ids": [ "purevpn-lin-affidavit" ] }, "response": { "text": "PureVPN’s current policy denies activity and identifiable connection logs, while describing other account and service data. It is a current policy statement, not a contemporaneous response to the 2017 filing.", "source_ids": [ "purevpn-policy" ] }, "limits": "An affidavit supporting a complaint records the agent’s sworn assertions, not a StealthVPN technical finding. Historical practices do not establish current behavior; current policies do not erase the historical record.", "reviewed_on": "2026-11-06" }, { "id": "privadovpn-2026-operator-transfer", "providers": [ "privadovpn" ], "category": "ownership", "title": "PrivadoVPN’s contract moved from Switzerland to Iceland", "event_date": "2026-05-01", "scope": "Contracting entity and payment-processing roles; not a data-handover case", "evidence": "Provider terms and privacy policy", "findings": { "text": "The terms say Privado Networks ehf assumed service agreements from the Swiss company effective May 1, 2026.", "source_ids": [ "privado-terms" ] }, "data_outcome": { "text": "The policy identifies US and Swiss payment affiliates processing billing data on the Icelandic operator’s behalf. This is not evidence of VPN activity-log disclosure.", "source_ids": [ "privado-policy" ] }, "response": { "text": "The transition clause says existing subscription periods, pricing and accrued rights are unaffected.", "source_ids": [ "privado-terms" ] }, "limits": "These are attributed legal documents, not corporate-registry verification. The complete controlling-ownership chain and operational system locations have not been independently established.", "reviewed_on": "2026-11-06" }, { "id": "privatevpn-2022-acquisition", "providers": [ "privatevpn" ], "category": "ownership", "title": "Miss Group announced its acquisition of PrivateVPN", "event_date": "2022-06-17", "scope": "Historical corporate acquisition and management transition", "evidence": "Acquirer’s dated press release", "findings": { "text": "Miss Group’s June 2022 announcement describes acquiring the Swedish VPN provider and transferring day-to-day management to its team.", "source_ids": [ "privatevpn-acquisition" ] }, "data_outcome": { "text": "The announcement establishes a claimed corporate transaction, not access to customer traffic or a legal-request disclosure.", "source_ids": [ "privatevpn-acquisition" ] }, "response": { "text": "Current reviewed terms name PrivateVPN Global AB and Swedish governing law; the privacy policy separately describes account and payment data.", "source_ids": [ "privatevpn-terms", "privatevpn-policy" ] }, "limits": "The acquisition announcement is historical and does not independently verify every later ownership change or establish the current beneficial-ownership chain.", "reviewed_on": "2026-11-06" } ], "sources": [ { "id": "fiorc", "title": "ODNI: Five Eyes oversight council", "url": "https://archive.dni.gov/index.php/who-we-are/organizations/icig/icig-partnerships/icig-fiorc", "kind": "government", "reviewed_on": "2026-11-06" }, { "id": "csis", "title": "Daniel Byman / CSIS: Improving U.S. Intelligence Sharing with Allies and Partners, January 2025, p. 11 (PDF p. 15)", "url": "https://csis-website-prod.s3.amazonaws.com/s3fs-public/2025-01/250128_Byman_Intelligence_Sharing.pdf", "kind": "research", "reviewed_on": "2026-11-06" }, { "id": "territories", "title": "UK Parliament: Overseas Territories and their relationship with the UK", "url": "https://commonslibrary.parliament.uk/research-briefings/cbp-9706/", "kind": "government", "reviewed_on": "2026-11-06" }, { "id": "eff", "title": "EFF Surveillance Self-Defense: Choosing the VPN That’s Right for You", "url": "https://ssd.eff.org/module/choosing-vpn-thats-right-you", "kind": "civil_society_guidance", "reviewed_on": "2026-11-06" }, { "id": "express-policy", "title": "ExpressVPN privacy policy", "url": "https://www.expressvpn.com/privacy-policy", "kind": "provider_policy", "reviewed_on": "2026-11-06" }, { "id": "nord-terms", "title": "Nord Account terms: nordvpn S.A. contracting entity", "url": "https://my.nordaccount.com/legal/terms-of-service/", "kind": "provider_terms", "reviewed_on": "2026-11-06" }, { "id": "nord-surf-owner", "title": "Surfshark: shared holding company with Nord Security", "url": "https://surfshark.com/about-us", "kind": "company_statement", "reviewed_on": "2026-11-06" }, { "id": "pia-policy", "title": "PIA privacy policy", "url": "https://www.privateinternetaccess.com/privacy-policy", "kind": "provider_policy", "reviewed_on": "2026-11-06" }, { "id": "pia-about", "title": "PIA: United States base", "url": "https://www.privateinternetaccess.com/about-us", "kind": "company_statement", "reviewed_on": "2026-11-06" }, { "id": "kape-brands", "title": "Kape: group brands, including PIA and ExpressVPN", "url": "https://www.kape.com/our-brands/", "kind": "company_statement", "reviewed_on": "2026-11-06" }, { "id": "proton-terms", "title": "Proton terms: Swiss operating company and foundation", "url": "https://proton.me/legal/terms", "kind": "provider_terms", "reviewed_on": "2026-11-06" }, { "id": "proton-policy", "title": "Proton VPN privacy policy", "url": "https://protonvpn.com/privacy-policy", "kind": "provider_policy", "reviewed_on": "2026-11-06" }, { "id": "proton-owner", "title": "Proton Foundation: primary shareholder", "url": "https://proton.me/foundation", "kind": "company_statement", "reviewed_on": "2026-11-06" }, { "id": "surf-policy", "title": "Surfshark privacy policy", "url": "https://surfshark.com/privacy", "kind": "provider_policy", "reviewed_on": "2026-11-06" }, { "id": "jurisdiction-definition", "title": "US Courts: legal glossary, jurisdiction", "url": "https://www.uscourts.gov/glossary", "kind": "government", "reviewed_on": "2026-11-06" }, { "id": "fingerprinting", "title": "EFF: cookies and browser fingerprinting explained", "url": "https://coveryourtracks.eff.org/learn", "kind": "civil_society_guidance", "reviewed_on": "2026-11-06" }, { "id": "virtual-locations", "title": "ExpressVPN: physical and virtual server locations", "url": "https://www.expressvpn.com/support/knowledge-hub/virtual-server-locations/", "kind": "provider_documentation", "reviewed_on": "2026-11-06" }, { "id": "webrtc", "title": "IETF RFC 8828: WebRTC IP address handling", "url": "https://www.rfc-editor.org/rfc/rfc8828.html", "kind": "technical_standard", "reviewed_on": "2026-11-06" }, { "id": "reproducible", "title": "Reproducible Builds: what a reproducible build establishes", "url": "https://reproducible-builds.org/docs/definition/", "kind": "project_documentation", "reviewed_on": "2026-11-06" }, { "id": "proton-transparency", "title": "Proton VPN: legal-request transparency report", "url": "https://protonvpn.com/blog/transparency-report", "kind": "provider_report", "reviewed_on": "2026-11-06" }, { "id": "nord-disclosure", "title": "NordVPN: October 2024 disclosure statement", "url": "https://nordvpn.com/blog/nordvpn-introduces-transparency-reports/", "kind": "Provider statement", "locator": "Edit dated October 29, 2024", "reviewed_on": "2026-11-06" }, { "id": "audit-scope", "title": "Securitum: Proton VPN no-logs assessment, August–September 2025", "url": "https://www.securitum.com/public-reports/securitum-protonvpn-nologs-2025.pdf", "kind": "commissioned_audit", "reviewed_on": "2026-11-06" }, { "id": "kill-switch", "title": "Proton VPN: kill switch behavior and platform limitations", "url": "https://protonvpn.com/support/what-is-kill-switch", "kind": "provider_documentation", "reviewed_on": "2026-11-06" }, { "id": "cyberghost-policy", "title": "CyberGhost: privacy policy and Romanian operator", "url": "https://www.cyberghostvpn.com/privacypolicy", "kind": "provider_policy", "reviewed_on": "2026-11-06" }, { "id": "hideme-legal", "title": "hide.me: terms and privacy policy", "url": "https://hide.me/en/legal", "kind": "provider_policy", "reviewed_on": "2026-11-06" }, { "id": "hideme-jurisdiction", "title": "hide.me: operator, Malaysian jurisdiction and audit limits", "url": "https://hide.me/en/blog/is-hide-me-safe/", "kind": "provider_statement", "reviewed_on": "2026-11-06" }, { "id": "purevpn-policy", "title": "PureVPN: privacy policy and BVI operator", "url": "https://www.purevpn.com/privacy-policy", "kind": "provider_policy", "reviewed_on": "2026-11-06" }, { "id": "purevpn-about", "title": "PureVPN: corporate background", "url": "https://www.purevpn.com/about.php", "kind": "provider_statement", "reviewed_on": "2026-11-06" }, { "id": "privado-terms", "title": "PrivadoVPN: Icelandic terms and May 2026 entity transfer", "url": "https://privadovpn.com/terms-of-service/", "kind": "provider_terms", "reviewed_on": "2026-11-06" }, { "id": "privado-policy", "title": "PrivadoVPN: privacy policy and payment entities", "url": "https://privadovpn.com/privacy-policy/", "kind": "provider_policy", "reviewed_on": "2026-11-06" }, { "id": "privatevpn-terms", "title": "PrivateVPN: contracting entity and Swedish governing law", "url": "https://privatevpn.com/terms-of-use/", "kind": "provider_terms", "reviewed_on": "2026-11-06" }, { "id": "privatevpn-policy", "title": "PrivateVPN: privacy and payment records", "url": "https://privatevpn.com/privacy-policy/", "kind": "provider_policy", "reviewed_on": "2026-11-06" }, { "id": "privatevpn-acquisition", "title": "Miss Group: June 2022 PrivateVPN acquisition announcement", "url": "https://news.cision.com/miss-group-holdings-ltd/r/miss-group-acquires-fastest-growing-private-vpn-provider,c3587444", "kind": "company_statement", "reviewed_on": "2026-11-06" }, { "id": "hideme-securitum-2024", "title": "Securitum: hide.me no-log audit, June 2024", "url": "https://hide.me/downloads/Securitum_Hide.me_no-log-policy_20240607.pdf", "kind": "commissioned_audit", "reviewed_on": "2026-11-06" }, { "id": "purevpn-kpmg-2023", "title": "KPMG: PureVPN technical privacy assessment letter, April 17, 2023", "url": "https://www.purevpn.com/wp-content/uploads/2023/07/KPMG_PureVPN_TPA_Letter_2023-04-FINAL-2.pdf", "kind": "commissioned_assessment_letter", "reviewed_on": "2026-11-06" }, { "id": "cyberghost-q4-2025", "title": "CyberGhost: Q4 2025 transparency report and Deloitte assurance summary", "url": "https://www.cyberghostvpn.com/privacyhub/transparency-report-q4-2025/", "kind": "provider_transparency_report", "reviewed_on": "2026-11-06" }, { "id": "pure-square", "title": "PureSquare: current brand portfolio", "url": "https://www.puresquare.com/", "kind": "company_statement", "reviewed_on": "2026-11-06" }, { "id": "hideme-devices", "title": "hide.me: Premium connection limit", "url": "https://hide.me/en/why-hideme", "kind": "provider_features", "reviewed_on": "2026-11-06" }, { "id": "privado-devices", "title": "PrivadoVPN: simultaneous connections versus installed devices", "url": "https://www.privadovpn.com/features/access-on-multiple-devices/", "kind": "provider_features", "reviewed_on": "2026-11-06" }, { "id": "privatevpn-plans", "title": "PrivateVPN: explicit bills and connection limit", "url": "https://privatevpn.com/", "kind": "provider_pricing", "reviewed_on": "2026-11-06" }, { "id": "logging-nord-vpn", "title": "NordVPN privacy notice", "url": "https://my.nordaccount.com/legal/privacy-policy/nordvpn/", "kind": "provider", "reviewed_on": "2026-11-08" }, { "id": "logging-nord-account", "title": "Nord Account privacy policy", "url": "https://my.nordaccount.com/legal/privacy-policy/", "kind": "provider", "reviewed_on": "2026-11-08" }, { "id": "logging-proton-logs", "title": "Proton VPN logging explanation", "url": "https://protonvpn.com/support/no-logs-vpn", "kind": "provider", "reviewed_on": "2026-11-08" }, { "id": "logging-proton-account", "title": "Proton account privacy policy", "url": "https://proton.me/legal/privacy", "kind": "provider", "reviewed_on": "2026-11-08" }, { "id": "logging-hide", "title": "hide.me privacy policy", "url": "https://hide.me/en/privacy", "kind": "provider", "reviewed_on": "2026-11-08" }, { "id": "pia-complaint", "title": "US v. McWaters: criminal complaint, mirrored copy", "url": "https://www.scribd.com/doc/303226103/Fake-bomb-threat-arrest", "kind": "Court filing · third-party mirror", "locator": "S.D. Florida, 9:16-mj-08075-JMH, document 1, March 8, 2016; paragraph 33, pp. 13–14", "reviewed_on": "2026-11-06" }, { "id": "proton-mail-order", "title": "Proton: clarification about the 2021 Mail case", "url": "https://proton.me/blog/climate-activist-arrest", "kind": "Provider statement", "locator": "September 6, 2021; includes subsequent update", "reviewed_on": "2026-11-06" }, { "id": "gericke-dpa", "title": "US v. Baier, Adams and Gericke: signed deferred prosecution agreement", "url": "https://www.justice.gov/d9/press-releases/attachments/2021/09/14/dpa_0.pdf", "kind": "Court record · DOJ-hosted", "locator": "D.D.C. 21-CR-577 (CJN); paragraph 2 and attached factual statement", "reviewed_on": "2026-11-06" }, { "id": "express-gericke", "title": "ExpressVPN: official response about Daniel Gericke", "url": "https://www.expressvpn.com/blog/daniel-gericke-expressvpn/", "kind": "Company response", "locator": "September 16, 2021", "reviewed_on": "2026-11-06" }, { "id": "kape-name", "title": "Crossrider: change of name to Kape Technologies", "url": "https://www.lse.co.uk/rns/KAPE/change-of-name-to-kape-technologies-plc-h8679tkuis5a2yf.html", "kind": "Company regulatory announcement", "locator": "RNS 9029G, March 7, 2018", "reviewed_on": "2026-11-06" }, { "id": "crossrider-detection", "title": "Malwarebytes: PUP.Optional.Crossrider research", "url": "https://www.malwarebytes.com/blog/detections/pup-optional-crossrider", "kind": "Security researcher finding", "locator": "Short bio; type and source of infection", "reviewed_on": "2026-11-06" }, { "id": "kape-control", "title": "Unikmind: offer for Kape Technologies", "url": "https://www.lse.co.uk/rns/offer-for-kape-technologies-plc-flj345aovdhe8qt.html", "kind": "Company regulatory announcement", "locator": "RNS 6498P, February 13, 2023; ownership at announcement date", "reviewed_on": "2026-11-06" }, { "id": "nord-breach", "title": "NordVPN: response and timeline for the Finland breach", "url": "https://nordvpn.com/blog/official-response-datacenter-breach/", "kind": "Provider incident disclosure", "locator": "October 21, 2019; timeline and key facts", "reviewed_on": "2026-11-06" }, { "id": "pia-current-transparency", "title": "PIA: current transparency report", "url": "https://api.privateinternetaccess.com/transparency-report", "kind": "Provider transparency report", "locator": "Historical subpoena statements; quarterly reporting", "reviewed_on": "2026-11-06" }, { "id": "purevpn-lin-affidavit", "title": "US v. Ryan S. Lin: 2017 criminal complaint and FBI affidavit", "url": "https://www.justice.gov/opa/press-release/file/1001841/download", "kind": "Court filing · DOJ-hosted", "locator": "D. Massachusetts 17-MJ-4251-DHH, October 3, 2017; affidavit paragraph 52, PDF p. 23", "reviewed_on": "2026-11-06" } ] }