VPN

VPN (Virtual Private Network) services are tools designed to encrypt the connection between your device and a server operated by the VPN provider, and to present that server's IP address to the wider internet rather than yours. The practical effect is that your internet service provider, network operator, or anyone monitoring traffic at the network level sees a connection to the VPN server rather than to the sites and services you are actually reaching. The category covered here is consumer and business VPN services, not enterprise SD-WAN or remote-access infrastructure.

A VPN sits in the path of every byte you route through it, which is why the operating company's country of incorporation carries more weight here than in most categories. The laws of the country where the operator is incorporated set the baseline for what it can be compelled to retain or disclose, regardless of what its marketing says. Some jurisdictions impose mandatory data-retention obligations or broad lawful-access powers; others have narrower regimes. If the operator is a US-incorporated company, the CLOUD Act applies to the consolidated group, which can compel data production regardless of where servers are located. European-incorporated operators such as Mullvad (Sweden, EU-owned, CLOUD Act exposure: None) and AirVPN (Italy, EU-owned, CLOUD Act exposure: None) have no US parent company that can be compelled this way. This is a fact worth reading off the corporate register rather than the marketing: OVPN, long treated as a Swedish privacy VPN and still operated from Stockholm, states on its own press page that "the legal operating entity is OVPN Inc., incorporated in US", following its 2023 acquisition, so its CLOUD Act exposure is recorded as Material. Swiss operators such as Proton VPN (CLOUD Act exposure: None) operate under Swiss law, which has comparable or stronger privacy protections in practice.

No-logs claims are where VPN marketing and evidence most often diverge. Every VPN says it keeps no logs; the question is what evidence supports that claim. Independent technical audits of server infrastructure, published transparency reports, and documented records of legal requests that produced no usable data all strengthen the claim. Mullvad and Proton VPN have both published third-party infrastructure audits; IVPN maintains a transparency report. When comparing providers, weigh the assertion against the evidence offered for it rather than the wording of the policy page itself.