Every VPN comparison mentions jurisdiction and almost none of them explain it. Here is what these alliances are, what they can actually compel, and how much the whole thing should weigh on your decision.
What the alliances are
- Five Eyes — Australia, Canada, New Zealand, the United Kingdom and the United States. A signals intelligence sharing agreement dating to the 1940s.
- Nine Eyes — the Five plus Denmark, France, the Netherlands and Norway.
- Fourteen Eyes — the Nine plus Belgium, Germany, Italy, Spain and Sweden.
These are intelligence-sharing arrangements between states, not laws that apply to companies. The relevance to a VPN is indirect: a provider based in a member country may be subject to legal process that compels data disclosure, and that data may then be shared with partner states.
The part that actually matters: data retention law
Alliance membership is a proxy for a more specific question — does the provider's jurisdiction compel them to retain user data? Some countries mandate retention regardless of what a company would prefer. Others do not, which means a genuine no-logs policy is legally sustainable.
This is why Panama, Switzerland, Romania, the British Virgin Islands and Malaysia appear so often in VPN marketing. None of them mandate retention for this kind of service.
The counter-argument: you cannot hand over what you do not have
The strongest response to jurisdiction concerns is a provider that genuinely holds nothing. Private Internet Access is based in the United States, squarely inside the Five Eyes, and has been subpoenaed more than once — and could not produce user data, because it had none. That is stronger evidence than any audit, because it was tested adversarially rather than commissioned.
IPVanish is also US-based with two independent audits confirming it stores no activity logs, connection times or DNS queries. Both providers demonstrate that jurisdiction alone does not settle the question.
A court order for data that does not exist produces nothing. Jurisdiction shapes the risk; architecture determines the outcome.
How much weight should you give it?
In our scoring, jurisdiction is one input into a privacy score worth 20% of the total — meaningful but not decisive. IPVanish scores 7.6 on privacy largely because of its US base, despite passing every technical test we ran. That feels like the right weighting to us.
If your threat model involves a nation state, jurisdiction matters enormously and you should be reading primary sources rather than VPN review sites. If your threat model is your ISP selling your browsing history, it matters considerably less than whether the provider has published a full audit.
The practical answer
Proton VPN in Switzerland gives you a favourable jurisdiction, open-source clients you can verify, and an audited no-logs policy — so you do not have to choose between the arguments. It finished first in our July cycle for broadly that reason.
