AzireVPN
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Swedish privacy VPN (Stockholm, est. 2012): Blind Operator, RAM-only, audited no-logs; acquired by Malwarebytes (US) 7 Nov 2024.
AzireVPN offers EU hosting in Sweden, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under VPN.
Assessment notes
AzireVPN was a top-tier privacy-pick Swedish VPN: founded Stockholm 2012, fully-owned diskless RAM-only servers, 'Blind Operator' security model that disables both remote and local access, monthly warrant canary, third-party-audited no-logs, regular transparency reports. But on 7 November 2024 it was acquired by Malwarebytes (Santa Clara, California, USA) and is now operated as part of a US-incorporated cybersecurity vendor; the Swedish operating entity and engineering team continue but the ultimate parent is now US, which puts CLOUD Act exposure at material and removes what had been an EU-ownership signal. Listed as a privacy-conscious option with a clear ownership-watch note rather than a sovereignty pick.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned This listing The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About AzireVPN
AzireVPN was founded in Stockholm, Sweden in 2012 and built a strong reputation in the privacy-VPN niche on three structural choices: it owned 100% of its server hardware, ran a diskless infrastructure with the OS in RAM, and developed the "Blind Operator" security model: a tool that disables both remote and local access to its servers, preventing any operator (including AzireVPN's own staff) from observing customer traffic. The no-logs policy was independently third-party-audited in 2026, the company published a monthly warrant canary (api.azirevpn.com/v3/warrantcanary), and maintained regular public transparency reports. By every structural measure that matters in the privacy-VPN category (EU-owned, EU-incorporated, owned hardware, diskless, audited no-logs, warrant canary), AzireVPN was a clean sovereignty pick before the acquisition.
The ownership story changed on 7 November 2024, when Malwarebytes (a Santa Clara, California cybersecurity company) announced that it had acquired AzireVPN. Financial terms were not disclosed. Malwarebytes' stated plan is to integrate AzireVPN's VPN technologies and the Blind Operator IP into its own product lines, and the AzireVPN brand continues to operate. But the corporate facts have shifted: the ultimate parent is now a US-incorporated company, which under this directory's rubric puts CLOUD Act exposure at material regardless of where the Swedish operating entity sits or where the servers physically live. AzireVPN's homepage now describes itself as "part of Malwarebytes, a global leader in real-time cyber protection."
AzireVPN remains in this directory because the underlying privacy engineering is genuinely strong and the user community values it, but it is listed as a privacy-conscious option with an ownership-watch flag, not as an EU-sovereignty pick. Buyers who specifically need a clean EU-or-Swiss ownership chain should now prefer Mullvad (founder-owned Swedish AB), ProtonVPN (Swiss Foundation), IVPN or AirVPN (Italian, founder-controlled), all elsewhere in this directory.
Pricing is €5.00 per month on the monthly term, €4.00 per month on three months (€12.00 in total) and €3.75 per month on twelve months (€45.00 in total), with a 7-day money-back guarantee on the longer terms. Payment runs through Cleverbridge by Visa, MasterCard, PayPal, Apple Pay or American Express; cash payments have been discontinued, which is a regression against the pre-acquisition privacy posture and against Mullvad and AirVPN, both of which still accept cash. UI is English-first.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of AzireVPN
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicewww.azirevpn.com/legal…
Alternatives in this category
-
Italy · €7/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Romania · €2.19/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Finland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
AirVPN
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
€7/mo |
CyberGhost
Romania
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€2.19/mo |
F-Secure VPN
Finland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€4/mo |