Who Owns Your VPN? The 2026 Ownership Map

NordVPN is owned by Nord Security, the group behind NordPass and NordLayer, and is operated by nordvpn S.A., which lists a registered office in Panama City; its founders are Tom Okman and Eimantas Sabaliauskas. Surfshark joined the same group through a merger announced in February 2022. ExpressVPN, Private Internet Access and CyberGhost all belong to Kape, which Teddy Sagi's Unikmind took private in 2023.

That handful of facts covers most of what people search for, but the more useful question is what else these owners control. Two of the groups that own big VPN brands also own the review sites that rank them. This page maps the ownership of the main providers with sources and dates, shows which owners also publish VPN reviews, and ends with our own disclosure. It is for anyone weighing a VPN, or a VPN review, on who stands behind it.

The short answer for the big names

A word on the review-site column: “not that we could verify” means we did not find ownership of review sites in the sources we read, not that none exists. Where we name review sites, the sites themselves disclose the link.

The ownership tree

Most consumer VPN brands sit inside a small number of groups. The diagram shows the ones that matter for the providers above. Each line is sourced in the sections that follow.

Nord Security: NordVPN and Surfshark

NordVPN's support centre says it was created by Tom Okman and Eimantas Sabaliauskas and is owned and operated by nordvpn S.A.; Nord Security's own website lists NordVPN among the group's products. On 2 February 2022 Nord Security announced a merger agreement with Surfshark, saying both brands would continue to operate independently with their own infrastructure and products. Surfshark does not appear among the products on Nord Security's website, which shows NordVPN, NordPass, NordLayer, NordLocker, NordStellar, Coveron and Saily. Calling it a sister company under one holding structure is more precise than calling it a Nord product. For a buyer, the point is simple: NordVPN and Surfshark are not independent alternatives to each other.

Kape: ExpressVPN, PIA and CyberGhost

Kape's own brands page lists ExpressVPN, Private Internet Access, CyberGhost VPN, the Mac security firm Intego, Webselenese and holiday.com, with headquarters in London. The group bought CyberGhost in 2017, merged with Private Internet Access in a deal announced in November 2019, and bought ExpressVPN in 2021 for a reported $936 million. In 2023 Unikmind Holdings, owned by the Israeli businessman Teddy Sagi, made a cash offer for Kape's shares; the offer was declared unconditional on 26 April 2023 and Kape left London's AIM market. Kape is now private, which means far less public financial disclosure than before.

Ziff Davis: IPVanish

In its Form 10-K for the 2025 financial year, Ziff Davis places IPVanish in its cybersecurity unit, and the same filing names CNET, PCMag, Mashable, Lifehacker, Spiceworks and ZDNET as its technology publishers. IPVanish's privacy policy names Ziff Davis, Inc. with a New York address. IPVanish came to the group in 2019, after the events of 2016 described in our court cases guide, when its then owner handed identifying data to US investigators.

Aura, Pango and Hotspot Shield

Hotspot Shield's site footer names Anchorfree, LLC. AnchorFree became Pango, which the identity-protection company Aura bought in 2020. Aura's own company timeline says that in 2024 it split into two companies, Aura and Point Wild, formerly known as Pango. Point Wild's homepage does not name Hotspot Shield, and some account links on Hotspot Shield's site still point to Aura, so we describe the current owner as the former Pango business rather than naming a parent with confidence.

McAfee, Gen Digital and the antivirus brands

McAfee completed its purchase of TunnelBear in March 2018, according to McAfee's announcement at the time; TunnelBear's own privacy policy names only TunnelBear LLC. Gen Digital, which names Norton and Avast among its consumer brands, sells VPNs under those names as Norton VPN and Avast Premium VPN (formerly SecureLine). These are less often discussed as “VPN owners”, but antivirus suites are one of the most common ways people end up with a VPN.

Owners who also run VPN review sites

This is the part of the ownership map that matters most to readers, and the part most comparison pages leave out. When the company that owns a VPN also owns the site that ranks it, the ranking deserves a second look. Two groups in our map do this openly.

Kape's review sites say so themselves. vpnMentor's about page names Kape Technologies PLC, which also owns ExpressVPN, CyberGhost, Intego and Private Internet Access, and says the site is “in the same ownership group as some of the products reviewed on this site”. Wizcase carries a similar statement, saying those four brands are owned by its parent company. Kape reportedly acquired these sites through Webselenese in 2021. A third, SafetyDetectives, is widely reported to be part of the same deal, though its page did not show a disclosure when we read it.

Ziff Davis is a different case. Its tech publishers are large general-interest brands, and VPN reviews are a small part of what they publish. The ownership link still exists, and it is worth knowing when you read their VPN coverage. If you rely on a review from any of these outlets, look for the ownership note and check the ranking against an independent source, or against the evidence itself: audits with dates, and legal tests. Our audit tracker collects that evidence by provider.

Does ownership matter? (jurisdiction, history)

Ownership is not a verdict on a VPN's privacy. Kape's ExpressVPN, PIA and CyberGhost all have recent independent no-logs reports, and PIA's no-logs record has been tested in US legal cases. What ownership tells you is where decisions are made, which laws can reach the company, and what its owners did before. Three points are worth weighing.

• Track record. A brand carries its history across owners. IPVanish's 2016 handover of identifying data happened under a previous owner, and it has since published audits under Ziff Davis. Ask what changed, and look for evidence after the change.
• Jurisdiction. The operating company's home, not the brand's marketing, decides which courts can compel it. NordVPN operates from Panama, Surfshark from the Netherlands, PIA from the United States and CyberGhost from Romania. Our guide to VPN jurisdiction and the 14 Eyes explains why this matters less than an audited no-logs design.
• Transparency after a takeover. When a public company goes private, as Kape did in 2023, investors and journalists lose its regular filings. Private ownership is common and lawful, but it means less public scrutiny.

The bigger risk is the free and unknown end of the market, not the famous brands. Opera's free browser VPN is a useful example of why ownership disclosure matters: Opera's 2025 annual report to the SEC says China-based Kunlun Tech indirectly owns about 68% of its shares. That is disclosed and lawful, but it is the kind of fact a buyer should know before routing traffic through a product.

Independent providers

A few well-known VPNs answer to no larger group. Mullvad VPN AB is owned by its parent Amagicom AB, which is entirely owned by its founders, Fredrik Strömberg and Daniel Berntsson, according to Mullvad's about page. Proton VPN belongs to Proton AG in Geneva, whose main shareholder is the non-profit Proton Foundation. Windscribe Limited is registered in Ontario, Canada, and IVPN Limited in Gibraltar.

Independence brings its own trade-offs. Smaller companies have fewer resources for audits and infrastructure, and a founder-owned firm can still be sold. What it does remove is the conflict of a parent that also sells the review. If that matters to you, two founder-run options are Mullvad and IVPN; neither has an affiliate scheme, so these links earn us nothing. If you prefer a larger provider with a non-profit controlling shareholder, Proton VPN is the clearest example; that link is an affiliate link.

How to check who owns a VPN yourself

Ownership changes, and this page will age. You can check any provider in a few minutes, and the method works for small apps as well as the famous names.

1. Read the terms of service. The legal entity that you contract with, and the law that governs the contract, are usually in the first or last section. ExpressVPN's terms, for example, name Express Technologies Ltd and British Virgin Islands law.
2. Read the privacy policy. It names the data controller, the company legally responsible for your data. IPVanish's names Ziff Davis, Inc.
3. Check the app store listing. The developer or seller name on Apple's App Store or Google Play is the company that published the app, which can differ from the brand.
4. Look up the parent. Public companies list their brands in annual reports; Ziff Davis's 2025 Form 10-K is where IPVanish appears. Private groups such as Kape list brands on their own websites.
5. Check the review site too. Before trusting a ranking, look for an ownership statement on the review site's about or disclosure page. vpnMentor and Wizcase publish one; many sites do not.

If none of these turns up a clear company name, that is itself an answer. A VPN that will not say who runs it is asking for a level of trust it has not earned, and our threat model explains why the provider, not your ISP, becomes the party that can see your traffic.

Our own disclosure

We should meet the standard we ask of others. Clearward is not owned or funded by any VPN company or by any of the groups on this page. We earn money through affiliate links to some providers: Proton VPN, NordVPN, Surfshark, Private Internet Access, ExpressVPN, CyberGhost and IPVanish. When you buy through one of those links we may receive a commission, which never changes the order of our tables. Mullvad and IVPN, which we recommend often, pay us nothing. The full terms are on our affiliate disclosure page.

If you are choosing between NordVPN and Surfshark on the assumption they are rivals, now you know they share an owner, and you can compare them on their own evidence instead. NordVPN's record of six independent no-logs engagements is summarised in our tracker, and if it suits you, NordVPN's plans are here, affiliate link disclosed.

Edge cases

• White-label apps. Many small VPN apps run on another company's servers or code. The name in the app store may not be the company that sees your traffic; check the privacy policy's legal entity.
• Changes after you subscribe. Ownership can change during a two-year plan. The privacy policy and terms usually name the new entity; it is worth reading them when you are notified of an update.
• Brand names that sound independent. A brand without a corporate name in its marketing can still belong to a group. The operating company in the terms of service is the reliable place to look.