VPN Jurisdiction: Where VPN Companies Are Based and Why It Matters

A VPN's jurisdiction is the country where the company behind the service is legally registered, and it determines whose courts and agencies can compel that company. It matters, though far less than marketing implies: under VPNRadarLab's scoring, the home country shifts a service by a maximum of 0.4 points on the ten-point scale.

What the registration country controls

Three questions hinge on where the business is incorporated: can the state order it to retain data, can officials demand what it already has stored, and can it be barred from disclosing a request. That last one, a gag order, is the reason certain providers run a warrant canary: a statement they keep publishing while no secret request has arrived, so a lapsed or missing update hints that one did.

The server's location is a separate question. The hardware sits under the law of whichever country it stands in, while the account, payment and logs policy belong to the company at home. Britain's Investigatory Powers Act 2016, section 87, puts retention on paper: the Secretary of State can require a telecommunications operator to hold communications data, a Judicial Commissioner must approve the notice, and nothing may be kept longer than 12 months under it. Europe went the opposite way when the Court of Justice annulled the EU Data Retention Directive in April 2014, in the Digital Rights Ireland case.

Five, Nine and Fourteen Eyes without the folklore

Five Eyes grew out of the UKUSA signals-intelligence agreement between London and Washington, signed on 5 March 1946 (originally BRUSA); the NSA has published the declassified UKUSA documents. Later, Canada, Australia and New Zealand were added to that circle. The nine- and fourteen-country lists are not treaties: they come from leaked documents and privacy guides describing intelligence sharing. Nine Eyes adds Denmark, France, the Netherlands and Norway; Fourteen Eyes adds Belgium, Germany, Italy, Spain and Sweden. Calling all three circles identical surveillance oversells them; these are sharing arrangements of different tightness.

How the country counts in the privacy score

Privacy carries 30% of a service's overall score, and the surveillance-alliance criterion is one line inside it: 2 of 15 possible privacy points. Outside all alliances earns the full 2, Fourteen Eyes 0.8, Nine Eyes 0.6, Five Eyes 0. A company that publishes no country gets nothing, on a par with a Five Eyes base.

The weighting explains why one criterion cannot decide everything. An independent no-logs audit is worth 3 points, a no-logs policy 2, not storing the connection IP 1.5, signing up without an email 1.5, and a stored connection IP costs 1.5 plus a −3 penalty. Compare LunoVPN and Proton VPN: LunoVPN is registered in the USA, collects zero alliance points, and still reaches a privacy score of 7.7 on the strength of an audit, no stored IPs or session times, email-free sign-up, a warrant canary and a transparency report. Proton VPN sits in Switzerland with full alliance points but scores 6.0, because its policy is recorded as partly storing the connection IP and registration requires an email.

Where the 377 ranked services sit

The biggest group is the 117 services that publish no registration country; among named countries the USA is first with 92 of 377, ahead of the UK with 16 and Hong Kong with 15.

The top 10 of the ranking holds 7 services outside the alliances, 2 in Five Eyes and 1 in Nine Eyes; the top 50 has 28 outside, 10 with no stated alliance, 8 in Five Eyes, 3 in Fourteen Eyes and 1 in Nine Eyes. The privacy gap between the outside group (3.7) and the Five Eyes and not-stated groups (both 1.3) is wider than the two-point criterion alone explains. For one country in detail, the most searched page in this section covers VPN companies registered in India and the IT Act and CERT-In rules that reach them.

Why the logging policy comes before the flag

Only 35 of the 377 ranked services have had an independent auditor check their no-logs promise. That number points to where you should look first: if nothing is stored, there is nothing to surrender under any law, while a provider that keeps connection IPs can be compelled to hand them over by the authorities of its home country. Our no-logs VPN ranking sets out what each policy confesses to collecting.

FAQ

Does connecting to a server abroad change the jurisdiction?

No. The exit server's location changes your visible IP, but the company holding your account answers to its home courts regardless.

Is a VPN based in a Fourteen Eyes country unsafe?

Not automatically. Alliance membership costs a fraction of the score, and a no-logs record verified from the outside weighs more.

What if a VPN never says where it is registered?

VPNRadarLab scores "not stated" like a Five Eyes base. Ask the provider directly before paying.

Short answer

Jurisdiction means the registration country whose laws your VPN company answers to; retention statutes there can force it to keep data it would otherwise drop, and a gag order can stop it from telling you. The Eyes alliances describe intelligence sharing, rooted in the 1946 UKUSA agreement, and cost a service at most 2 of 15 privacy points, or 0.4 of the overall 10. Read the policy first, then look for an audit, and only then weigh the country.