VPNInfobaseJurisdiction means which country’s law can compel a VPN company. It is a real factor, but the incident record below suggests it decides less than what the provider actually holds: in the cases we found, the outcome depended on whether records existed, and authorities acted in several countries, including ones the provider was not based in. “Five Eyes”, “Nine Eyes” and “Fourteen Eyes” are lists of countries that share intelligence. Whether a VPN company sits in one of them is a fact you can check; what it means for you is an argument, and we lay out both.
The alliance lists
According to Wikipedia’s article on Five Eyes (read 29 Sep 2026), the original Five Eyes are Australia, Canada, New Zealand, the United Kingdom and the United States, tracing to the UKUSA Agreement of 5 March 1946. Nine Eyes adds Denmark, France, the Netherlands and Norway. Fourteen Eyes (SIGINT Seniors Europe) adds Belgium, Germany, Italy, Spain and Sweden. These are intelligence-sharing groupings, not a single law that obliges a VPN company to keep logs. How the lists are known differs: Wikipedia describes the UKUSA Agreement (1946) as a treaty whose text the UK government released in 2010, while the Nine Eyes and Fourteen Eyes are described there as informal arrangements with no published agreement. No government publishes a membership list for them, so treat those two as secondary-source lists, not official ones.
Where each provider says it is based
The base is the vendor’s stated location from its own pages, as recorded on the register. The last column is our lookup against the lists above, not a claim by the vendor.
| Provider | Stated base (vendor page) | On the alliance lists? (our lookup) |
|---|---|---|
| ExpressVPN | British Virgin Islands (privacy policy) | Not a listed country |
| PureVPN | British Virgin Islands (about page) | Not a listed country |
| IVPN | Gibraltar (privacy page) | Not a listed country |
| NordVPN | Panama for the service; parent Nord Security in Lithuania (vendor pages) | Neither listed |
| Proton VPN | Switzerland, Geneva (terms) | Not listed |
| Trust.Zone | Seychelles (terms) | Not listed |
| hide.me | Malaysia (legal page) | Not listed |
| Astrill | Liechtenstein (terms) | Not listed |
| CyberGhost | Romania (imprint) | Not listed |
| Surfshark | Netherlands, Amsterdam (about page) | Nine and Fourteen Eyes |
| Mullvad | Sweden, Gothenburg (about page) | Fourteen Eyes |
| PrivateVPN | Sweden (privacy policy) | Fourteen Eyes |
| Windscribe | Canada, Ontario (terms) | Five Eyes |
| TunnelBear | Canada, Toronto (about page) | Five Eyes |
| IPVanish, PIA, VyprVPN | United States (privacy or about pages) | Five Eyes |
Hotspot Shield and StrongVPN (no base found) and AirVPN (Italy, from a secondary source only) are left out because the register has no reliable base for them. British Virgin Islands and Gibraltar are British overseas territories; neither is itself a listed member, and whether UK law or UK cooperation reaches a company there is a legal question this page does not answer.
What happened when authorities did ask
From the incidents timeline, the entries where a legal process reached a VPN:
| Provider | Stated base | Where authorities acted | What the source says |
|---|---|---|---|
| IPVanish | United States | United States | Under a DHS summons in 2016, after a first reply that it did not log usage information, the then-operator gave investigators a subscriber’s account details, real IP address and connection times, per TorrentFreak’s reading of court documents (TorrentFreak, 5 June 2018); the article also quotes the later operator, StackPath, saying IPVanish does not log or store users’ logs |
| PureVPN | British Virgin Islands | United States | An FBI complaint said PureVPN records let investigators tie two IPs to one customer, per The Register (8 Oct 2017); the article does not say how the FBI obtained the records or include a PureVPN response |
| Mullvad | Sweden | Sweden | Police came with a search warrant on 18 April 2023; Mullvad says no customer data existed and police left without taking anything (Mullvad’s account) |
| Windscribe | Canada | Ukraine, Netherlands, Greece | Servers seized in Ukraine in 2021 and the Netherlands in 2026; a Greek case against a co-founder dismissed in April 2025. Windscribe says no user data existed to hand over (its account); in Ukraine an OpenVPN key was exposed because the servers were not encrypted at rest (its account) |
What the two tables do and don’t show
- A company can be reached in a country it is not based in. PureVPN’s stated base is the British Virgin Islands, yet a United States complaint used its records. Windscribe’s servers were seized in countries other than Canada. So the base is one place the law can reach, and the server location is another.
- The outcomes differ by what existed, not by list membership. Mullvad, in a Fourteen Eyes country, and Windscribe, in a Five Eyes one, both say there was nothing to hand over; IPVanish and PureVPN are reported to have supplied records. That is provider accounts and press reports of court papers, four cases in all, and does not test a rule.
- Privacy Guides makes a narrower point. In its VPN overview it says providers will not cooperate with oppressive regimes, “especially if you choose a VPN provider outside your own jurisdiction” (read 29 Sep 2026). That is about your own government, not alliance lists.
- Logging and audits matter alongside it. What a company retains is covered by the no-logs policy explainer and the audit tracker, and the owner behind the brand is on who owns your VPN.
Method
Bases are each vendor’s own stated location, from pages recorded on the register on 28 September 2026 (with the source per row there); alliance membership is Wikipedia’s, read 29 September; incident rows are provider accounts or press reports, as marked. This page does not give legal advice. Reviewed every 180 days. Full method: how we pick VPNs.
For how UK age-check law treats VPNs, see the Online Safety Act and VPNs.
For US rules that mention VPNs, see the US state VPN laws tracker.