STEALTHVPN GUIDE

Five, Nine, Fourteen Eyes: what changes for your privacy?

Read jurisdiction alongside ownership, retained data and your threat model.

Five Eyes

Nine Eyes

Fourteen Eyes

What do Five, Nine and Fourteen Eyes mean?

Five Eyes is the intelligence-sharing partnership of Australia, Canada, New Zealand, the UK and the US. The commonly cited Nine Eyes set adds Denmark, France, the Netherlands and Norway; Fourteen adds Belgium, Germany, Italy, Spain and Sweden. The wider groupings are not equivalent to the core partnership in their level of institutionalization. ODNI: Five Eyes oversight council (opens in a new tab) · Daniel Byman / CSIS: Improving U.S. Intelligence Sharing with Allies and Partners, January 2025, p. 11 (PDF p. 15) (opens in a new tab).

What does jurisdiction mean?

It means legal authority: which courts or governments can apply law to a company, activity or request. For VPNs, the service operator’s country is a starting point. Parent companies, servers, account systems and your own location can bring other legal connections into the picture. An exit-server flag is not the same as the company’s jurisdiction.

US Courts: legal glossary, jurisdiction (opens in a new tab) · ExpressVPN privacy policy (opens in a new tab) · Proton VPN privacy policy (opens in a new tab)

What are the possible repercussions?

Intelligence cooperation can enable information gathered by one partner to reach others. A provider may also face legal demands under the laws that apply to its operator and infrastructure. Whether a particular request can obtain records, require assistance or concern future collection depends on the applicable law and facts; an alliance label does not establish that power in a specific case.

The practical question is what data exists and who can legally or technically reach it. Account email, billing records, support messages and temporary connection data are different from browsing history. We show those distinctions as attributed provider statements where reviewed. Surfshark privacy policy (opens in a new tab) · Proton VPN privacy policy (opens in a new tab).

A country label is one part of a threat model.

A Five Eyes location does not prove that a company shares customer activity, and a location outside the listed sets does not prove privacy. The cooperation map is incomplete and countries outside it still have laws and intelligence relationships. A provider’s no-logs statement needs evidence about the actual systems, the data covered and the period reviewed.

Separate four locations.

1. Service operator: the contracting company and its stated jurisdiction.
2. Parent or owner: controlling corporate relationships, which can cross borders.
3. Infrastructure: VPN endpoints, authentication, account systems and payment processors may sit elsewhere.
4. You: your residence and circumstances can affect the laws and risks relevant to you.

For example, ExpressVPN’s policy identifies a BVI operator and a UK parent. Proton’s VPN policy describes account infrastructure in Switzerland, Germany and Norway while its terms identify a Swiss operator. Neither can be summarized by a server flag alone. ExpressVPN privacy policy (opens in a new tab) · Proton terms: Swiss operating company and foundation (opens in a new tab) · Proton VPN privacy policy (opens in a new tab).

Handle the UK territories explicitly.

British Virgin Islands and Gibraltar are not separately enumerated members of the country sets shown here. They are UK Overseas Territories with constitutional relationships to the UK. We show both facts, rather than treating them as a clean privacy exemption or automatically equating their legal systems with the UK’s. UK Parliament: Overseas Territories and their relationship with the UK (opens in a new tab).

Ask for the evidence behind “no logs”.

Check whether an audit covers VPN traffic, connection metadata or only an app; its date; any exclusions; and the underlying report. Review legal-response disclosures and account/payment retention separately. A point-in-time audit does not guarantee future behavior, and the absence of retained historic activity does not by itself answer questions about future obligations.

Our first pass reviews jurisdiction, ownership links and selected policy statements. It does not independently audit no-logs claims or mark any provider immune to surveillance. Open the provider dossiers .

What else should I check?

Logging detail, signup/payment identity, legal-response reports, audit scope, leak protection, physical server locations, telemetry, open-source builds, ownership and browser identity can all matter. Use the ten-question privacy checklist .

A VPN does not make an OSINT session anonymous.

A VPN changes network routing and the IP address seen by a destination. Logged-in accounts, cookies, browser fingerprints and identifiers you supply can still link research activity to you. For sensitive research, define the adversary, keep personal and research identities separate, and choose tools around that threat model. EFF Surveillance Self-Defense: Choosing the VPN That’s Right for You (opens in a new tab).