CyberGhost
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Romanian-operated VPN (CyberGhost S.R.L., 2011) under Kape Technologies (UK; ex-Crossrider) → Unikmind/Teddy Sagi (IM) since 2023; listed as a warning.
CyberGhost is a European service hosted in Romania, with at most minor, transient US exposure under the CLOUD Act. It is listed under VPN.
Assessment notes
CyberGhost is operated by CyberGhost S.R.L. in Bucharest, Romania (founded 2011). But the entire ownership chain sits well outside the EU: parent Kape Technologies plc (UK, AIM-listed until May 2023) acquired CyberGhost for €9.1M in 2017, and on 19 May 2023 Kape was taken private by Unikmind Holdings Limited (an Isle of Man vehicle controlled by Israeli businessman Teddy Sagi) at a ~£1.25-1.51bn valuation, delisting from AIM on 31 May 2023; Kape was originally Crossrider, an Israeli ad-tech / browser-extension business with a documented adware history, and the same Kape group also owns VPN Mentor, a VPN review site (a structural conflict of interest) alongside ExpressVPN, PIA and Zenmate; the product itself has a Deloitte no-logs audit and accepts Bitcoin, but the combination of Romanian-operations + UK Kape parent + Isle-of-Man Unikmind + Crossrider history + review-site conflict means CyberGhost carries no EU-ownership or no-CLOUD-Act-exposure signals: it is listed as a warning rather than a recommendation.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About CyberGhost
CyberGhost is operated by CyberGhost S.R.L., headquartered in Bucharest, Romania, with the product itself dating to 2011. It is included in this directory primarily because of its Romanian operations and historical brand recognition in the privacy-VPN category, but the ownership chain is the editorial story, and it is the reason this listing carries an ownership-watch warning.
The chain runs as follows. In 2017 CyberGhost was acquired for €9.1M by Kape Technologies plc, an AIM-listed UK holding company that has since become the largest VPN consolidator in the consumer market. Kape's portfolio also includes ExpressVPN, Private Internet Access (PIA), Zenmate, and the VPN review site VPN Mentor, the last of which is a structural conflict of interest, since a holding company that owns multiple VPN services should arguably not also own the most-trafficked review/comparison site for that same category. Kape Technologies began life as Crossrider, an Israeli ad-tech and browser-extension business with a well-documented adware history; the rebranding to "Kape Technologies" was a deliberate distancing move. On 19 May 2023 Unikmind Holdings Limited (an Isle of Man-registered vehicle controlled by Israeli businessman Teddy Sagi) secured ~98.5% of Kape's shares in a take-private deal valuing the company at approximately £1.25-1.51bn, and Kape delisted from AIM on 31 May 2023.
Against that backdrop, the product-level signals look reasonable in isolation: an independent Deloitte audit confirmed no user-data storage; AES-256 encryption with kill-switch and DNS-leak protection; NextGen 10-Gbps servers across 100+ countries; 24+ supported platforms; 20+ UI languages; Bitcoin payment via BitPay; a 45-day money-back guarantee. Pricing on the 26-month plan reaches €2.19 per month (€56.94 for the first 26 months), among the cheapest entry prices in the category, which is itself a Kape-pricing pattern; the intro term then renews at €56.94 annually, roughly €4.75 per month, the sharpest intro-to-renewal step in this category.
None of those product strengths offset the structural concerns of the ownership chain for a directory whose value proposition is sovereignty + auditable corporate trust. CyberGhost is therefore listed as a warning rather than a recommendation, with the full Crossrider-Kape-Unikmind-Sagi history surfaced in the rationale, which is exactly the kind of editorial scoop no other EU directory currently makes visible. EU buyers wanting a clean Romanian VPN should look outside the Kape stable; sovereignty buyers should prefer Mullvad, ProtonVPN, IVPN or AirVPN.
Sub-processor map · none disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of CyberGhost
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Italy · €7/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Sweden · €3.75/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Finland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
AirVPN
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
€7/mo |
AzireVPN
Sweden
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
€3.75/mo |
F-Secure VPN
Finland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€4/mo |