A VPN brand name does not necessarily tell you which legal entity provides the service, which company or group sits above it, or which law applies to the contract. Those layers can point to different organizations and jurisdictions.
BearVPN reviewed 12 consumer VPN brands using current terms and privacy notices, company announcements, corporate group pages, and regulatory filings. The table below provides the quick answers. The brand notes then explain what the evidence supports, where it stops, and why a simple “owner + country” label can be misleading.
The findings describe publicly verifiable corporate and legal relationships as of the review date. They are not a ranking of the products and do not determine whether a VPN is safe, private, or technically secure.
Publisher disclosure: This report was produced by BearVPN, a VPN provider. BearVPN was not included in the 12-brand sample. The report maps publicly documented corporate and legal relationships; it does not rank the products or assess their technical security.
Key Findings at a Glance
- 10 of 12 named a service entity in current terms we could verify. For two brands, we confirmed an operating company or corporate relationship from other first-party or regulatory sources but could not independently verify the equivalent field in a current product-specific terms page.
- 10 of 12 had a confirmed parent, major shareholder, acquisition, or group relationship. This category includes several kinds of corporate evidence and does not mean that every brand disclosed the same depth of ownership information.
- 6 of 12 reached a clearly named top or near-top control layer. Under our strict definition, the public record had to identify an ultimate holding company, major shareholder, public-company parent, founder ownership, or acquisition consortium.
- 5 of 12 were connected to one of two multi-brand relationships represented more than once in the sample. Three appeared in Kape’s current brand portfolio, while NordVPN and Surfshark have an officially announced group relationship.
- 2 of 9 directly comparable brands selected governing law outside the service entity’s home jurisdiction. The denominator is nine because both fields could not be verified directly for the other three brands.
These figures describe a purposive sample of 12 VPN brands, not the worldwide VPN market. A group relationship does not by itself show that brands share user data, infrastructure, employees, or privacy practices.
Quick Answer: Who Owns the 12 VPN Brands?
The table separates the company named in the service terms from the parent, shareholder, acquisition, or group relationship we could confirm. “Not publicly confirmed” means the official sources we reviewed did not identify a higher parent; it does not prove that no such entity exists.
Evidence checked: October 24, 2026
The table is a summary, not a corporate family tree. In particular, “group relationship” can describe a different legal arrangement from direct ownership, and a historical acquisition does not necessarily identify every entity in the current chain.
Evidence status: “Cross-confirmed” means that at least two types of first-party or regulatory evidence support the core relationship. “Partially confirmed” means that the group or operating relationship is documented but a key legal field or full chain was not directly verified. “Operator confirmed” means that the operating company is identified but no higher parent was confirmed in the official sources reviewed. Additional qualifiers in the table identify the specific field that was incomplete or conflicting.
What “Who Owns a VPN?” Can Mean
The question sounds simple, but at least five different fields can matter:
- Brand: the product name users recognize.
- Service or contracting entity: the company on the other side of the service terms.
- Data controller or privacy entity: the organization identified as responsible for personal-data processing.
- Parent, shareholder, or group relationship: the organization or ownership layer above the operating entity, where publicly documented.
- Governing law: the law selected for the contract, which may not match the service entity’s home jurisdiction.
These fields can overlap, but they are not interchangeable. ExpressVPN, for example, is provided by Express Technologies Ltd., while its privacy policy names Kape Technologies PLC as the ultimate holding company. Mullvad VPN is provided by Mullvad VPN AB, whose parent is Amagicom AB. Surfshark B.V. is established in the Netherlands, while its current terms choose British Virgin Islands law.
A parent or group relationship does not, on its own, establish that two VPN products share customer data or technical infrastructure. That requires separate evidence from privacy notices, technical documentation, audits, or other relevant records. Readers interested in a different part of that question can also review what free VPN apps say they collect in iOS privacy labels.
A VPN brand, its service entity, data controller, corporate group, and governing law can refer to different legal layers.
Who Owns Each VPN? Brand-by-Brand Findings
Who Owns Proton VPN?
Proton VPN is provided by Proton AG, a company based in Switzerland. Proton’s own ownership explanation identifies the nonprofit Proton Foundation as the major shareholder of Proton AG, while other shares remain with employees, the Swiss foundation FONGIT, and users or community members through Proton’s crowdfunding history.
That means it would be inaccurate to describe the Proton Foundation as owning 100% of Proton AG or to describe the entire company as wholly nonprofit. Proton’s current terms select Swiss law, while also setting out separate provisions for U.S. consumers.
Sources: Proton Terms of Service, Who owns Proton VPN?, Proton VPN Privacy Policy, and About Proton VPN.
Who Owns NordVPN?
NordVPN’s current terms name nordvpn S.A., with a Panama address, as the contracting entity. NordVPN’s About page says that Nord Security owns NordVPN, but the official pages reviewed did not provide the complete legal shareholding chain above the service entity.
There is also a current wording conflict worth preserving rather than resolving by assumption. NordVPN’s About page describes Nord Security as headquartered in Lithuania, while a NordVPN support page says the parent company is located in the Netherlands. The service terms themselves choose Panama law, subject to mandatory consumer protections that may apply in a user’s country.
Sources: Nord General Terms of Service, NordVPN About, Where is NordVPN based?, and Nord Security About.
Who Owns Surfshark?
Surfshark’s current service and privacy entity is Surfshark B.V., a company established in the Netherlands. Surfshark and Nord Security announced that they completed a merger agreement and formed a group, while saying the companies would continue to operate autonomously and maintain separate brands and infrastructure.
The reviewed announcements confirm the group relationship, but they do not set out a complete legal shareholding chain in the level of detail needed to label Nord Security as a directly verified 100% parent. Surfshark’s current terms choose British Virgin Islands law, so the service entity’s home jurisdiction and the selected governing law are different fields.
Sources: Surfshark Terms of Service, Surfshark Privacy Policy, Surfshark and Nord Security merger announcement, and Nord Security’s announcement.
Who Owns ExpressVPN?
ExpressVPN is provided by Express Technologies Ltd., a British Virgin Islands company. Its current privacy policy names Kape Technologies PLC as its ultimate holding company, and both ExpressVPN and Kape have published materials documenting the completed acquisition and current brand relationship.
ExpressVPN’s privacy policy also says that control over account data remains with ExpressVPN and is not transferred to Kape. That is a relevant first-party statement, but ownership information alone cannot independently establish how every technical or operational system is separated. Both the service entity and governing law point to the British Virgin Islands.
Sources: ExpressVPN Terms, ExpressVPN Privacy Policy, ExpressVPN joins Kape, and Kape’s current brands.
Who Owns CyberGhost VPN?
CyberGhost VPN is operated by CyberGhost S.R.L., a company registered in Romania. CyberGhost’s current privacy policy identifies Kape Technologies PLC as the ultimate holding company, and Kape lists CyberGhost in its brand portfolio.
The current CyberGhost terms select English law even though the service entity is Romanian. For U.S. residents, the terms also include arbitration provisions; for non-U.S. users, they identify courts in London. A different governing law does not by itself show that a company is avoiding regulation or that the product is less safe.
Sources: CyberGhost Terms, CyberGhost Privacy Policy, CyberGhost Imprint, and Kape’s current brands.
Who Owns Private Internet Access?
Private Internet Access is provided by PIA Private Internet Access, Inc. Its terms and privacy policy identify the U.S. operating entity, and Kape’s current corporate materials list PIA in its brand portfolio. Kape also states that it acquired PIA in 2019.
The reviewed PIA pages support the group relationship but do not separately map every intermediate holding entity in the chain. PIA’s terms select Colorado law and identify Denver courts for relevant disputes. The service entity, rather than Kape’s brand page, remains the company presented to users in the service terms.
Sources: PIA Terms of Service, PIA Privacy Policy, Kape’s current brands, and Kape About.
Who Owns IPVanish?
IPVanish is a Ziff Davis brand. Regulatory and current store records identify IPVanish, Inc., but we could not verify the contracting entity directly from the current product terms. Ziff Davis lists the product in its current security portfolio, while a U.S. Securities and Exchange Commission subsidiary exhibit identifies IPVanish, Inc. within the group. Current U.S. App Store information also names IPVanish, Inc. as the developer.
The ownership relationship is therefore cross-confirmed, but the current IPVanish product terms and privacy-policy text did not render directly in our collection environment. We have not filled that gap with a third-party summary, and we do not publish a specific governing-law or current data-controller conclusion here. A Ziff Davis regulatory filing lists IPVanish, Inc. in Florida.
Sources: Ziff Davis — IPVanish, Ziff Davis SEC subsidiary exhibit, Ziff Davis subsidiary list, and IPVanish’s U.S. App Store listing.
Who Owns Hotspot Shield?
Hotspot Shield is part of Pango, which is now within the Point Wild corporate structure. That answer requires a timeline because older descriptions are no longer sufficient. Hotspot Shield previously announced that it had become part of Aura, but Aura announced a split from Pango in 2024. Pango later merged with Total Security, and the combined company was renamed Point Wild.
Current Pango privacy materials cover Hotspot Shield and name relevant Pango entities in the United States and Switzerland. However, Pango’s website terms say that products are governed by separate product terms, and we did not independently verify the current Hotspot Shield product-specific contracting entity and governing law from those terms. For that reason, this report does not simply reuse an old Pango agreement or state that Aura is the current owner.
Sources: Pango Privacy Policy, Pango VPN Products Privacy Notice, Pango Website Terms, Aura’s 2024 split announcement, and Point Wild rebrand announcement.
Who Owns TunnelBear?
TunnelBear is provided by TunnelBear LLC and is part of the McAfee corporate group. McAfee disclosed its 2018 acquisition of the TunnelBear business, a historical SEC subsidiary list identifies TunnelBear LLC as a Delaware entity, and McAfee’s current legal page continues to reference TunnelBear products and marks.
McAfee itself was taken private in 2022 by an investor group rather than one newly listed operating-company owner. TunnelBear’s privacy policy emphasizes Canadian operations, data storage, and Canadian legal requirements, while the historical corporate filing identifies Delaware registration. These describe different legal facts. The current TunnelBear terms reviewed did not expressly select a governing law, so TunnelBear was not included in our nine-brand governing-law comparison.
Sources: TunnelBear Terms of Service, TunnelBear Privacy Policy, McAfee consumer legal page, McAfee 2020 Form 10-K, McAfee subsidiary exhibit, and McAfee privatization completion.
Who Owns Windscribe?
Windscribe is owned and operated by Windscribe Limited, a company registered in Ontario, Canada, according to its current terms. Windscribe says it is fully self-funded and has not taken venture-capital funding.
Self-funding is not the same as a complete ownership statement, however. It does not reveal exact founder shareholdings or independently prove that no higher legal entity exists. The official materials we reviewed did not identify a higher parent company, so that is the limit of our conclusion. Windscribe’s terms select Ontario law and courts in Toronto.
Sources: Windscribe Terms, Windscribe Privacy Policy, and Windscribe Ethics and Philosophy.
Who Owns Mullvad VPN?
Mullvad VPN is operated by Mullvad VPN AB, whose parent company is Amagicom AB. Mullvad’s current ownership explanation says both companies are 100% owned by the two founders, Fredrik Strömberg and Daniel Berntsson.
This is one of the most explicit ownership statements in the sample because it identifies the service entity, parent, and individual founder-ownership layer. The relevant companies are Swedish, and Mullvad’s terms select Swedish law and the Gothenburg District Court as the court of first instance.
Sources: Mullvad About, Mullvad FAQ, Mullvad Terms of Service, and Mullvad Privacy Policy.
Who Owns Urban VPN?
Urban VPN’s current terms and privacy policy identify Urban Cyber Security Inc. as the company behind the service. The current legal pages provide a New York contact address, and the terms select New York law and courts in Manhattan.
The official pages we reviewed did not identify a higher parent company. That does not prove that no parent or shareholder structure exists; it means we did not find sufficient first-party or regulatory evidence to publish one. We therefore did not adopt third-party claims connecting Urban VPN to BIScience as an established ownership fact.
Sources: Urban VPN Terms, Urban VPN Privacy Policy, Urban VPN CCPA Notice, and Urban Cyber Security About.
What the 12-Brand Sample Shows
Service Entities Were Usually Easier to Verify Than Complete Ownership Chains
Ten of the 12 VPNs named a service or contracting entity directly in current terms we could verify. We also found a first-party or regulatory source confirming a parent company, major shareholder, acquisition, or group relationship for 10 brands. Those two results measure different questions.
For IPVanish and Hotspot Shield, company or group evidence was available, but we could not independently verify the equivalent current product-specific terms field in our collection environment. That does not mean the brands lack legal entities or terms. It means the particular field did not meet this study’s direct-verification rule.
A Confirmed Group Relationship Did Not Always Reveal the Top Control Layer
A brand can be publicly connected to a corporate group without every company in the legal chain being listed. Under our stricter definition, six brands reached an explicitly named top or near-top control layer: an ultimate holding company, major shareholder, public-company parent, complete founder-ownership statement, or investor consortium at the top of a completed private acquisition.
The six were Proton VPN, ExpressVPN, CyberGhost, IPVanish, TunnelBear, and Mullvad. For the remaining six, the reviewed sources did not reach that layer; this should not be interpreted as evidence of concealed ownership. Public disclosure duties vary, and phrases such as “joined forces,” “part of a group,” or “self-funded” do not necessarily identify the final legal control layer.
How far the reviewed public evidence reached for each VPN brand. This is not a safety, transparency, or trustworthiness score.
Five Sampled Brands Were Connected to Two Repeated Group Relationships
Five of the 12 brands were connected to one of two corporate relationships that appeared more than once in the sample. Kape’s current portfolio includes ExpressVPN, CyberGhost, and Private Internet Access. NordVPN and Surfshark have an officially announced group relationship, while the companies said they would continue to operate autonomously.
This is a description of a selected 12-brand sample—not a measure of worldwide VPN ownership or market share. It also does not show that the five brands share user data, infrastructure, staff, code, or privacy practices. Each product’s legal pages and technical evidence must be assessed separately.
Governing Law Can Differ From the Service Entity’s Home Jurisdiction
We could directly compare both the current service entity and governing law for nine brands. Two selected a governing law outside the service entity’s home jurisdiction: Netherlands-based Surfshark B.V. chose British Virgin Islands law, while Romania-based CyberGhost S.R.L. chose English law.
IPVanish, Hotspot Shield, and TunnelBear were excluded from this denominator because the necessary current fields could not both be verified directly. Selecting a different governing law does not by itself prove regulatory avoidance or make a VPN unsafe. It is one legal field users may want to understand alongside the operating company, privacy policy, and dispute terms.
Corporate jurisdiction is also a different question from whether VPN use is legal in a particular country. Our source-checked guide to VPN laws in 12 countries examines that separate question.
Why VPN Ownership Information Changes
Corporate ownership pages can become outdated after an acquisition, private-equity transaction, business split, or internal reorganization. Hotspot Shield illustrates the problem. It was historically described as part of Aura, but Aura announced the separation of Aura and Pango in 2024. Pango later combined with Total Security, and the merged business was renamed Point Wild.
The product name remained familiar while the group context changed. In other cases, a brand can be acquired while the original service entity continues to appear in the terms. A public company can also be taken private by a consortium, adding another ownership layer without changing the consumer-facing brand.
That is why this report includes an evidence date and links to the underlying sources. A search-result snippet or older review may accurately describe a historical relationship but no longer answer the current question.
How We Researched the 12 Brands
Sample Selection
This is a purposive sample, not a random survey or market-share ranking. We selected consumer VPNs with U.S. search interest around brand ownership or location and included different structures: multi-brand groups, a foundation as major shareholder, founder ownership, a privatized corporate group, and operators for which no higher parent was identified in the reviewed official sources.
The sample was locked before the results were counted. Urban VPN replaced hide.me before full-sample statistics were calculated because it had a direct U.S. ownership query in the keyword data and added a distinct evidence pattern: a clearly named operating company with no higher parent confirmed in the official pages reviewed.
Source Priority
We prioritized sources in this order:
- current service terms and privacy notices;
- official company pages, corporate group portfolios, and transaction announcements;
- regulatory filings, including SEC subsidiary records;
- current app-store developer information for cross-checking;
- third-party coverage for discovery only, not as the final basis for an ownership claim.
When a current product-specific field could not be read directly, we marked it as not independently verified rather than filling it from an old agreement or an unsourced summary.
Coding Rules
For each brand, we recorded whether current terms directly named a service entity; whether a parent, major shareholder, acquisition, or group relationship could be confirmed; whether the public evidence reached a clearly named top or near-top control layer; whether the brand belonged to a multi-brand relationship represented more than once in the sample; and whether the service entity’s home jurisdiction differed from the selected governing law.
Evidence statuses distinguish cross-confirmed facts, single-source confirmation, partially confirmed relationships, conflicting official wording, and a higher parent not publicly confirmed in the sources reviewed. “Not publicly confirmed” is an evidence result, not a claim about what legally exists outside the public record.
Limitations
This research has several important limits:
- The 12 brands form a purposive sample and do not represent the worldwide VPN market or market share.
- The research maps public legal and corporate documents; it is not a forensic beneficial-ownership investigation.
- Private companies may not publish a complete shareholding chain.
- Corporate structures, terms, and group relationships can change after the review date.
- Official pages may conflict, depend on JavaScript, omit a field, or retain historical wording.
- “Not publicly confirmed” does not mean that no parent company or ownership layer exists.
- A shared parent or group relationship does not prove shared user data, servers, code, staff, or privacy practices.
- Company jurisdiction or governing law cannot, by itself, determine whether a VPN is safe.
- We did not test the products’ security, speeds, logging behavior, or current app behavior.
The distinction between corporate structure and technical protection matters. For a separate explanation of those technical boundaries, see what a VPN hides—and what it does not.
What Users Should Check Before Choosing a VPN
Ownership is useful context, but it works best as part of a broader review. Before choosing a service, check:
- Who is named in the terms? This is normally the company that contracts with the user.
- Who is the data controller? The privacy notice may name the same company, another group entity, or different entities by region.
- Is a parent, major shareholder, or group relationship disclosed? Note the type of relationship rather than treating all group links as direct ownership.
- Which law and dispute forum apply? These may differ from the operating company’s most visible address.
- When were the pages last updated? Compare the legal-page dates with any recent acquisition, split, private transaction, or rebrand.
Ownership is not a substitute for checking privacy terms, independent security evidence, technical protections, and current product behavior. Price disclosures deserve separate attention as well, especially where an introductory offer later renews at a different amount; our VPN introductory and renewal price study examines that issue.
Frequently Asked Questions
This study cannot determine who owns most VPN companies worldwide. It reviewed 12 selected brands, not the complete market. Within this sample, five brands were connected to two multi-brand relationships represented more than once: ExpressVPN, CyberGhost, and PIA appeared in Kape’s portfolio, while NordVPN and Surfshark have an officially announced group relationship. That finding cannot be converted into a global market-share or market-control claim.
Not necessarily. The company in the terms is usually the entity providing or contracting for the service. A parent or holding company may sit above it. ExpressVPN’s terms name Express Technologies Ltd., while its privacy policy names Kape Technologies PLC as the ultimate holding company. Mullvad’s terms name Mullvad VPN AB, while Amagicom AB is its parent.
No such conclusion can be drawn from ownership alone. A shared parent or group relationship shows a corporate connection, not the exact design of data systems or operational access. To assess data handling, review each product’s privacy notice, data-controller language, technical documentation, audits, and other current evidence.
“Based in” can refer to several different places: an operating headquarters, the contracting entity’s registration, the privacy entity, a parent company’s location, or the law selected in the terms. Those fields may not match. A more useful answer names the specific field rather than assigning one unexplained country to the entire brand.
No. Jurisdiction can affect the legal context around a company and its contract, but it does not by itself establish product security, logging behavior, privacy protection, or corporate conduct. Those questions require policy review and technical evidence. For a broader evidence-based overview, see what independent research says about free VPN safety.
VPN brands can be acquired, moved within a corporate group, separated during a business split, or affected when a public parent is taken private. Legal pages may also update on a different schedule from corporate announcements. Hotspot Shield’s movement from a historical Aura relationship through the Pango split and later Point Wild structure shows why every ownership answer needs a date.
Sources, Reproducibility, and Update Policy
The findings are based on the official and regulatory sources linked in the brand notes above. We prioritized current terms, privacy notices, company announcements, group pages, and regulatory filings. Evidence was last checked on October 24, 2026.
If a company structure or legal page changes, the table, brand note, and affected counts should be updated together rather than changing only the narrative. Readers can report a correction through BearVPN’s official contact channel.
All brand-level sources are linked directly in the relevant findings above.
Conclusion
A VPN brand is only the first layer of the answer. The company in the terms, the privacy entity, the corporate group, and the governing law may not be the same.
In this sample, most brands had a public group or ownership link that could be verified, but the reviewed sources reached a clearly named top control layer for only six. That difference is useful context, not a trust score. Readers should treat ownership as one part of due diligence and examine it alongside privacy policies, independent security evidence, technical protections, pricing, and current product behavior.
