SOURCE-BACKED VPN COMPARISONSClear prices. Informed choices.
stealthvpn. Shortlist 0

OPEN-SOURCE PRIVACY INTELLIGENCE

Follow the jurisdiction.
Question the claims.

The company, the country, the corporate group, and the data it retains. A source-backed starting point for your own threat model.

Jurisdiction Ownership Retention Evidence
THE IDEA, MAPPEDJurisdiction has several layers.
  1. 01

    Service operator

    Your contracting entity and its declared country.

  2. 02

    Parent company

    Ownership and control can sit elsewhere.

  3. 03

    Infrastructure

    Servers and subprocessors add other locations.

Five, Nine and Fourteen Eyes classify country groups, not VPN companies. Location is context, not a standalone safety rating.

Countries belong to intelligence-sharing groups. VPN companies do not.

We classify the service operator’s declared jurisdiction, then show ownership and UK territory relationships separately. Five Eyes is nested inside Nine Eyes, which is nested inside Fourteen. A label alone establishes neither logging nor safety.

START WITH THE MEANING

Two terms, in plain English.

THE INTELLIGENCE RELATIONSHIP

What are the “Eyes”?

Names for groups of countries that cooperate on intelligence, including signals intelligence: information gathered from communications and related data.

The numbers count countries. They are not security ratings, and a country’s membership does not mean every VPN based there shares customer records.

ODNI: Five Eyes oversight council (opens in a new tab) · Daniel Byman / CSIS: Improving U.S. Intelligence Sharing with Allies and Partners, January 2025, p. 11 (PDF p. 15) (opens in a new tab)

THE LEGAL AUTHORITY

What is jurisdiction?

Jurisdiction means the authority to apply law and decide legal matters. For a VPN, ask which company contracts with you, where it is based, and which laws and authorities can reach it or its data.

Several countries can be relevant. The operator, parent, physical server, account systems and your own location can differ. Choosing a server flag does not relocate the whole company.

US Courts: legal glossary, jurisdiction (opens in a new tab) · ExpressVPN privacy policy (opens in a new tab) · Proton VPN privacy policy (opens in a new tab)

01Who has authority?

Identify the operator and relevant legal connections.

02What could be requested?

Review the applicable process, safeguards and disclosure history.

03What records exist?

Separate activity history, connection metadata and account data.

Intelligence sharing and a legal demand to a company are different mechanisms. The Eyes label alone does not show that a particular request is lawful or that useful records exist.

THE RECORD BEHIND THE REPUTATION

What happened when
the claims met reality?

Legal demands, disclosed data, seized servers and the people behind the companies. Read dated case files with sources, responses and the questions still open.

Explore the investigations
What data was handed over?NordVPN’s acknowledged 2024 disclosureWho worked for the company?ExpressVPN’s 2021 employment controversyWhat history sits behind the brand?Kape, Crossrider and the adware concern

10 PROVIDERS. TRACEABLE SOURCES.

The jurisdiction dossier.

Research reviewed 2026-11-06
Service jurisdiction, country grouping, and ownership are separate evidence fields
ProviderService operator / locationCountry groupingOwnership / group contextEvidence
CyberGhost RomaniaCyberGhost S.R.L.Outside listed 14Declared service jurisdictionKape TechnologiesUnited KingdomSources & context Reviewed 2026-11-06
ExpressVPN British Virgin IslandsUK Overseas TerritoryExpress Technologies Ltd.Outside listed 14Declared service jurisdictionKape Technologies PLCUnited KingdomSources & context Reviewed 2026-11-06
hide.me MalaysiaeVenture LtdOutside listed 14Declared service jurisdictioneVenture Ltd; ultimate controlling ownership not establishedParent jurisdiction not established hereSources & context Reviewed 2026-11-06
NordVPN Panamanordvpn S.A.Outside listed 14Declared service jurisdictionNord Security / shared holding group with SurfsharkParent jurisdiction not established hereSources & context Reviewed 2026-11-06
PrivadoVPN IcelandPrivado Networks ehfOutside listed 14Declared service jurisdictionPrivado Networks entities; controlling owner not establishedParent jurisdiction not established hereSources & context Reviewed 2026-11-06
Private Internet Access United StatesPIA Private Internet Access, Inc.Five EyesDeclared service jurisdictionKape Technologies PLCUnited KingdomSources & context Reviewed 2026-11-06
PrivateVPN SwedenPrivateVPN Global ABFourteen EyesDeclared service jurisdictionMiss Group — acquisition announced June 2022SwedenSources & context Reviewed 2026-11-06
Proton VPN SwitzerlandProton AGOutside listed 14Declared service jurisdictionProton Foundation (primary shareholder)SwitzerlandSources & context Reviewed 2026-11-06
PureVPN British Virgin IslandsUK Overseas TerritoryGZ Systems Private LtdOutside listed 14Declared service jurisdictionGZ Systems / PureSquare portfolio; ultimate control not establishedParent jurisdiction not established hereSources & context Reviewed 2026-11-06
Surfshark NetherlandsSurfshark B.V.Nine EyesDeclared service jurisdictionShared holding group with Nord SecurityParent jurisdiction not established hereSources & context Reviewed 2026-11-06

“Outside listed 14” refers only to this country list. BVI and Gibraltar have constitutional UK links. A server’s location, your residence, payment processors, and other legal connections may create additional exposure.

A no-logs claim needs a breakdown.

Compare browsing, DNS, IP addresses, temporary session records, bandwidth counters, diagnostics and account retention.

Explore the logging breakdown

UNDERSTAND THE SETS

What do Five, Nine and Fourteen mean?

Five Eyes is the core intelligence-sharing partnership. Nine Eyes includes those five countries, and Fourteen includes all nine. The numbers describe membership, not an ascending risk score.

Illustrated Nine Eyes emblem with 9 flag-filled eyes09

The broader Nine Eyes

Includes all five core countries.

  • Australia
  • Canada
  • New Zealand
  • United Kingdom
  • United States
  • Denmark
  • France
  • Netherlands
  • Norway
Explore matching jurisdictions
Illustrated Fourteen Eyes emblem with 14 flag-filled eyes14

The Fourteen Eyes set

Includes all nine countries in the broader set.

  • Australia
  • Canada
  • New Zealand
  • United Kingdom
  • United States
  • Denmark
  • France
  • Netherlands
  • Norway
  • Belgium
  • Germany
  • Italy
  • Spain
  • Sweden
Explore matching jurisdictions

Emblems are illustrative artwork supplied for StealthVPN, not official alliance insignia. Country lists below each illustration spell out the membership.

Country sets: ODNI: Five Eyes oversight council (opens in a new tab) · Daniel Byman / CSIS: Improving U.S. Intelligence Sharing with Allies and Partners, January 2025, p. 11 (PDF p. 15) (opens in a new tab). Nine and Fourteen are commonly used labels for wider cooperation; the CSIS report describes them as less institutionalized than Five Eyes. This is a published taxonomy, not a complete map of every intelligence relationship.

BEYOND THE COUNTRY LABEL

Ten more privacy questions.

Read the checklist

Use these questions alongside jurisdiction. Open a topic for the meaning, the concern and the evidence to seek. These are comparison criteria; they are not a claim that every provider has passed ten checks.

01Activity logs & connection metadataWhat is stored about your browsing, IP address and connection times?

What it means

Activity logs describe what you do online. Connection metadata can describe when you connect, your source IP, session length or bandwidth without listing the websites you visit.

Why it matters

A no-browsing-history claim can coexist with retained connection records. Retention periods and whether records can be linked to an account matter.

What to look for

Separate statements for browsing/DNS history, source IPs, timestamps, bandwidth, temporary memory and deletion schedules.

Surfshark privacy policy (opens in a new tab)

02Account, payment & support recordsHow easily can the account be linked to a real person?

What it means

A VPN may use an email login, a username or a generated account number. Payment processors and support conversations create a separate trail.

Why it matters

A provider can keep no activity history while still holding personal account or payment information. Cryptocurrency is not automatically anonymous.

What to look for

Required signup fields, payment-provider records, support retention, deletion rules and what is still kept after cancellation.

Proton VPN privacy policy (opens in a new tab) · ExpressVPN privacy policy (opens in a new tab)

04Audit scope, dates & follow-upWhich system was actually examined, by whom, and when?

What it means

An audit can cover an app, VPN servers, a no-logs claim, billing or a software updater. Those are different assessments.

Why it matters

A narrow or older audit does not establish the current privacy of the entire service. Read the report, findings and remediation scope.

What to look for

The auditor’s original report, assessment dates, exact versions and systems, limitations, findings, remediation and any retest.

Securitum: Proton VPN no-logs assessment, August–September 2025 (opens in a new tab)

05Leaks, kill switches & split tunnelingDoes traffic stay on the intended path when connections change?

What it means

A kill switch aims to block traffic when the VPN tunnel drops. DNS, IPv6 and WebRTC handling can expose information through paths users did not intend. Split tunneling deliberately excludes selected traffic.

Why it matters

Behavior can differ between operating systems, app versions and settings. A feature checkbox does not establish that a particular setup has been tested.

What to look for

Platform-specific tests during normal use, disconnects, app crashes, Wi-Fi changes and sleep/wake; document intentionally excluded apps.

Proton VPN: kill switch behavior and platform limitations (opens in a new tab) · IETF RFC 8828: WebRTC IP address handling (opens in a new tab)

06Physical servers, virtual locations & hostsWhere is the actual machine, and who operates it?

What it means

The country advertised for a VPN IP address can differ from the server’s physical location. Hosting and account infrastructure can also sit outside the service operator’s country.

Why it matters

A country flag is not a complete jurisdiction map. Diskless or RAM-only design addresses some storage questions, but does not establish that no data can be observed or sent elsewhere.

What to look for

Physical versus advertised country, host and operator, own versus rented infrastructure, authentication/account systems and the scope of infrastructure audits.

ExpressVPN: physical and virtual server locations (opens in a new tab) · Proton VPN privacy policy (opens in a new tab)

07App telemetry, SDKs & permissionsWhat does the VPN app itself send or collect?

What it means

Diagnostics, crash reporting, analytics libraries and app permissions are separate from the handling of traffic inside the VPN tunnel.

Why it matters

Telemetry and identifiers can create an additional data trail even where a service says it does not store browsing activity.

What to look for

Defaults, opt-outs, transmitted fields, recipients, retention, platform permission explanations and app-level audit evidence.

Proton VPN privacy policy (opens in a new tab) · ExpressVPN privacy policy (opens in a new tab)

08Open source, updates & reproducible buildsCan someone inspect the code and relate it to the installed app?

What it means

Open source makes the covered code available for inspection. A reproducible build lets others recreate specified binaries from a defined source and build environment.

Why it matters

Published client code does not reveal every server practice or prove absence of bugs. Updates and verification of the distributed software remain important.

What to look for

Exact repositories and licenses, maintained release channels, signed packages, security notices, reproducibility instructions and independent code review.

Reproducible Builds: what a reproducible build establishes (opens in a new tab) · Securitum: Proton VPN no-logs assessment, August–September 2025 (opens in a new tab)

09Ownership & cross-border controlDo apparently separate services share a corporate group?

What it means

The VPN’s operator, parent company and related brands can be different legal entities with different countries and roles.

Why it matters

Different brand names do not necessarily diversify corporate control. A parent link is context, not proof that it receives a subsidiary’s customer data.

What to look for

Contracting entity, controlling group, legal notices, data-controller roles and documented changes of ownership.

ExpressVPN privacy policy (opens in a new tab) · Kape: group brands, including PIA and ExpressVPN (opens in a new tab) · Surfshark: shared holding company with Nord Security (opens in a new tab)

10Cookies, fingerprints & logged-in accountsCan the destination still recognize you after your IP changes?

What it means

Websites can recognize account logins, cookies, browser characteristics and information you supply. Those signals are different from an IP address.

Why it matters

A VPN does not separate your personal and research identities by itself, or protect a compromised device. The tool must fit the adversary and activity you are concerned about.

What to look for

A clear research threat model, account separation, browser privacy controls and limits of the VPN rather than promises of complete anonymity.

EFF: cookies and browser fingerprinting explained (opens in a new tab) · EFF Surveillance Self-Defense: Choosing the VPN That’s Right for You (opens in a new tab)

Guidance sources reviewed 2026-11-06. Platform features and provider statements require their own dated verification.

KNOW WHAT THE EVIDENCE ESTABLISHES

A claim, a report, or still unknown?

PROVIDER STATEMENT

What the company says

A policy, feature description or transparency report. Useful, attributable evidence of the company’s position; not our independent verification of its systems.

THIRD-PARTY REPORT

What was examined

A named assessor’s report with a date and scope. Read limitations, commissioning and follow-up. An app, updater and server audit answer different questions.

NOT REVIEWED

A visible evidence gap

We have not checked that property here. That does not mean a feature is absent or a provider failed; it means there is no finding to present.

Read the scope before the verdict.

Securitum’s 2025 Proton VPN report covers the production VPN server environment and its no-logs policy. It explicitly excludes other areas, including the CI/CD pipeline. Commissioned assessments answer defined questions about defined systems; they are not a blanket guarantee about every part of a service.

Securitum: Proton VPN no-logs assessment, August–September 2025 (opens in a new tab)

THE PRACTICAL QUESTION

What changes for your privacy?

Jurisdiction helps frame legal exposure. Retained records, account identity, ownership and infrastructure help determine what might actually be available.

Read the implications

01 Identify who you need protection from.

02 Separate activity logs from account and payment records.

03 Look at audit scope, dates and legal-response evidence.

04 Check the operator, the parent and the infrastructure.

LOOK THROUGH THE BRAND

Different names can share an owner.

Sources, research date & limits

Reviewed 2026-11-06. Provider documents are first-party statements. Country labels are our inference from the operator country and the listed sets. This is not a full corporate-registry investigation, legal opinion, real-time monitoring service or technical audit. Unknown ownership details stay unknown. Prices and metadata collectors do not refresh this research.