A no-logs policy is a promise made by a company. Which company, and who owns that company, determines how much the promise is worth — and this is the part of VPN due diligence that almost nobody does.
Why ownership matters at all
Audits almost never cross the corporate boundary. A report can confirm that the VPN subsidiary stores no user data while saying nothing about what a parent company does with billing records, support tickets or analytics held elsewhere in the group. If the parent also runs advertising or data businesses, that gap is worth understanding.
The consolidation nobody announced
The consumer VPN market has consolidated substantially. Several brands that market themselves as independent competitors sit under the same holding companies, which is why you sometimes see near-identical apps, shared server infrastructure and coordinated pricing across supposedly rival products.
Two of the providers in our top ten — CyberGhost and ExpressVPN — are both owned by Kape Technologies, a company with a history that privacy advocates routinely flag. Private Internet Access is also part of that group. That is three of our ten under one roof.
What to look for yourself
- The legal entity named in the terms of service, which is often not the brand name.
- The registered address and jurisdiction of that entity, which may differ from the marketed one.
- Whether a parent company is named anywhere, and what else it does.
- Whether published audits name the parent or only the subsidiary.
The providers that make this easy
Mullvad and Proton VPN are the two clearest cases in our top ten. Both are independently owned, both publish open-source clients, and both submit to repeated audits. Proton sits under the same Swiss company as Proton Mail, which is a known and stated relationship rather than a discovered one.
You are not choosing whether to be observed. You are choosing who observes you. Knowing who that actually is seems like a reasonable minimum.
Does this mean avoid the big groups?
Not automatically. CyberGhost and ExpressVPN both performed extremely well in our testing and both passed every leak and kill-switch test we ran. Corporate ownership is a factor to weigh, not a disqualification, and we rank both in our top six on measured performance.
But if the reason you are buying a VPN is a genuine privacy requirement rather than streaming convenience, independent ownership is worth paying attention to — and Mullvad is the cleanest answer available.
