Who Really Owns Your VPN?
The VPN industry has quietly consolidated. Here's what that means for your privacy.
🔍 Key Findings
- • Kape Technologies owns ExpressVPN, CyberGhost, PIA, and Zenmate (4 of top 10 VPNs)
- • Nord Security owns NordVPN, Surfshark, and Atlas VPN
- • Ziff Davis (j2 Global) owns IPVanish, StrongVPN, and Encrypt.me
- • Only a handful of major VPNs remain independently owned
When you sign up for a VPN, you're trusting that company with your entire internet traffic. But do you know who actually owns that company?
The VPN industry has undergone massive consolidation over the past five years. Companies that appear to compete are often owned by the same parent corporation. "Independent" reviews frequently promote VPNs owned by the same company that owns the review site.
This isn't necessarily bad — consolidated companies can have better resources — but transparency matters. Here's what every VPN user should know.
Kape Technologies: The Biggest Player
Kape Technologies PLC
Headquarters: Isle of Man (UK) | Public: LSE: KAPE
VPNs Owned:
Acquired 2021
Acquired 2017
Acquired 2019
Acquired 2018
The Crossrider Controversy
Kape Technologies wasn't always in the privacy business. Before 2018, it was called Crossrider — a company that made money from browser extensions that injected ads and collected user data. Some security researchers classified their software as malware.
In 2018, Crossrider rebranded to Kape Technologies and pivoted to "digital security." They acquired CyberGhost (2017), then PIA (2019), then ExpressVPN (2021) for a staggering $936 million.
What This Means
The company's past doesn't automatically mean their VPNs are compromised today. PIA and ExpressVPN have both passed third-party audits post-acquisition. However, if your threat model includes concern about corporate history, this is worth knowing.
Kape Also Owns Review Sites
Perhaps more concerning: Kape owns vpnMentor and Wizcase, two of the most popular VPN review websites. These sites consistently rank Kape-owned VPNs at the top — without always disclosing the ownership relationship prominently.
This creates an obvious conflict of interest. When a "review" site consistently recommends products owned by its parent company, those recommendations aren't independent.
Nord Security: The Northern Consolidator
Nord Security
Headquarters: Panama (Lithuania operations) | Private
VPNs Owned:
Founded 2012
Merged 2022
Acquired 2021
Nord Security's situation is different from Kape's. NordVPN built its reputation from scratch and has maintained a cleaner track record. The 2022 Surfshark merger combined two already-respected VPNs.
However, the merger means NordVPN and Surfshark — which appear to compete — are actually sister companies. When a review site recommends "NordVPN or Surfshark," they're essentially recommending the same parent company twice.
Our Take
We still recommend NordVPN and Surfshark. Both have been independently audited multiple times, maintain strong no-logs policies, and have no history of privacy violations. The merger is worth knowing about, but it doesn't change our assessment of the products themselves.
Ziff Davis (j2 Global): The Media Giant
Ziff Davis Inc.
Headquarters: New York, USA | Public: NASDAQ: ZD
VPNs Owned:
Via StackPath/Highwinds
Via StackPath
Via StackPath
The IPVanish Logging Incident
In 2016, IPVanish — then owned by Highwinds — provided logs to the Department of Homeland Security that helped identify a criminal suspect. The problem? IPVanish claimed to have a "zero logs" policy at the time.
This incident is well-documented through court records. When j2 Global acquired IPVanish through StackPath, they inherited this history. They've since commissioned audits and claim to have implemented a true no-logs infrastructure.
Our Position
We can't recommend IPVanish to privacy-conscious users. Once a VPN has been caught logging despite claiming otherwise, trust is broken. Whether they've truly reformed is unknowable. Better options exist.
VPN Ownership Map
| VPN Brand | Parent Company | Jurisdiction | Concern Level |
|---|---|---|---|
| ExpressVPN | Kape Technologies | BVI / Isle of Man | Medium |
| CyberGhost | Kape Technologies | Romania / Isle of Man | Medium |
| Private Internet Access | Kape Technologies | USA / Isle of Man | Medium |
| NordVPN | Nord Security | Panama | Low |
| Surfshark | Nord Security | Netherlands | Low |
| IPVanish | Ziff Davis | USA | High |
| Mullvad | Independent (Amagicom AB) | Sweden | Lowest |
| ProtonVPN | Independent (Proton AG) | Switzerland | Lowest |
| IVPN | Independent (Privatus Ltd) | Gibraltar | Lowest |
Truly Independent VPNs
If corporate consolidation concerns you, these VPNs remain independently owned:
Mullvad
Swedish company Amagicom AB | Founded 2009
- ✓ No email required for signup
- ✓ Accept cash payments
- ✓ Open-source apps
- ✓ Consistently privacy-focused
We earn $0 from Mullvad — recommended anyway
ProtonVPN
Swiss company Proton AG | Founded 2017
- ✓ From ProtonMail creators
- ✓ Swiss privacy jurisdiction
- ✓ Open-source apps
- ✓ Strong free tier available
Affiliate program coming soon
IVPN
Gibraltar company Privatus Ltd | Founded 2009
- ✓ Transparent ownership
- ✓ Open-source apps
- ✓ No affiliate program (no conflict)
- ✓ Privacy-focused since founding
No affiliate program available
AirVPN
Italian company | Founded 2010
- ✓ Activist-founded
- ✓ Transparent operations
- ✓ Port forwarding support
- ✓ Community-driven development
Minimal affiliate program
Why Ownership Matters
1. Trust Concentration
If one company owns multiple VPNs, a single point of failure — whether technical, legal, or ethical — affects all of them. A vulnerability at Kape affects four major VPN brands simultaneously.
2. Regulatory Pressure
Larger companies face more regulatory scrutiny. A government subpoena to Kape could affect ExpressVPN, CyberGhost, and PIA users simultaneously. Smaller independent providers are lower-profile targets.
3. Review Integrity
When VPN companies own review sites, "independent" rankings become marketing. Kape's ownership of vpnMentor and Wizcase means those sites' recommendations should be viewed skeptically.
4. Privacy Philosophy
Independent VPNs founded by privacy advocates (Mullvad, IVPN) tend to have different priorities than VPNs owned by publicly-traded companies focused on shareholder returns. This affects long-term decision-making.
How We Handle This
We believe in transparency. Here's our approach:
- We disclose ownership — Every review mentions who owns the VPN
- We recommend Mullvad despite $0 commission — Editorial integrity over revenue
- We note when competitors are sister companies — NordVPN vs Surfshark = same owner
- We factor history into trust — IPVanish's logging incident affects our rating
- We prioritize audited no-logs claims — Verify, don't trust
Our Recommendations
If Corporate Ownership Concerns You
Choose Mullvad, ProtonVPN, or IVPN. These remain independently owned by privacy-focused organizations with transparent operations.
If You Want the Best Product
NordVPN and Surfshark remain excellent choices despite the Nord Security merger. Both have been independently audited and maintain strong track records.
Proceed with Caution
Kape-owned VPNs (ExpressVPN, CyberGhost, PIA) aren't necessarily bad, but the parent company's history and review site ownership warrant extra scrutiny. Verify claims independently.
Avoid
IPVanish — The 2016 logging incident broke trust. Whether they've truly reformed is unknowable, and better alternatives exist.
The Bottom Line
VPN industry consolidation isn't automatically bad, but transparency matters. When you entrust a company with your internet traffic, you deserve to know who they are, who owns them, and what their track record looks like.
Most review sites won't tell you this because they're either owned by VPN companies or dependent on affiliate revenue from the biggest players. We believe informed consumers make better choices.
Choose based on your threat model. For most users, audited VPNs from either Nord Security or independent providers like Mullvad are solid choices. Be skeptical of "independent" reviews, and always verify ownership claims.