Commercial VPN vs Independent VPN
A VPN brand tells you little about who runs it. Three real ownership structures, what each can and cannot do, and why the name on the app is the least informative part.
The word on the app icon carries almost no information about the party holding your traffic. Some operators publish their full ownership structure and an owner’s directive. Others are divisions of a holding company with a dozen brands and a review site. Both appear in the same comparison tables, ranked on server count.
Short answer#
Independence is a question about who can compel an operator and who owns it, and it is answerable. Look for a named parent company, a stated ownership structure, and a published answer to at least one legal request. A brand name settles none of that.
The brand is not the company#
Two services can share every visible property and differ completely in what you are trusting.
One sells to the widest possible audience, runs affiliate partnerships and review campaigns, and answers to shareholders. Another has two named owners, publishes the directive those owners operate under, and has never taken outside investment. Both will offer a no-logs policy, an audit, and a kill switch. Only one of them has to answer to anyone but its founders.
This is why operator structure belongs ahead of feature lists in any comparison. The features are the easy part to copy.
Three structures that actually exist#
Independent operators in this market tend to cluster into three shapes. Each is real, and each has a documented example.
Founder-controlled and uninvested. Mullvad states that Mullvad VPN AB and its parent Amagicom AB are 100% owned by founders Fredrik Strömberg and Daniel Berntsson, both still active in the company, and it publishes an owner’s directive setting out how they are bound. There is no investor class with a return expectation attached.
Foundation-controlled. Proton is a Swiss for-profit, Proton AG, whose primary shareholder is the Proton Foundation, a Swiss non-profit that by law has no shareholders of its own. Employees hold the majority of the remaining shares, with the balance split between another non-profit foundation and users. No change of control can happen without the foundation’s consent, which is what lets it block a hostile takeover. The foundation was created in 2024, and Proton pledges 1% of net revenue to it.
A listed holding company with a portfolio. Kape Technologies, formerly Crossrider, floated on the London Stock Exchange in 2014 and is controlled by Teddy Sagi. It has since acquired CyberGhost, ZenMate, Intego, Private Internet Access and ExpressVPN, the last for $936 million in 2021. Each of those brands markets itself as an independent service.
What each structure can and cannot do#
Ownership shape determines which pressures can reach you, and each has a limit.
Founder control removes the shareholder, which is the most common source of pressure toward monetising data. It does not remove the possibility of a sale, a succession, or a change of mind by the owners themselves.
A foundation with a veto removes the takeover. It does not make the company well run, and it does not remove the need to make money: Proton’s own founder has said the for-profit entity stays in place precisely so the mission can be funded.
A listed parent removes the founder’s discretion over direction and can reshuffle brands, accounting, and infrastructure policy. It does not make the service untrustworthy on its own. Plenty of well-run companies are owned by shareholders.
None of the three touches the second question, which is the subject of the next article in this level: who owns the hardware, and who can reach the disk.
The consolidation problem#
The reason brand names mislead is that the market has consolidated hard, and the acquisitions are public record.
Kape’s own history page lists the sequence: CyberGhost in 2017, ZenMate and Intego in 2018, Private Internet Access in 2019, ExpressVPN in 2021. It also bought Webselenese, a VPN review site, in 2021. One parent owning five VPN brands and an independent-sounding review publication is the clearest illustration available that neither a VPN brand nor a review site carries structural information.
The company’s earlier name is worth knowing too. Crossrider built browser extension technology whose monetisation options, as CNET reported, were used by major ad injectors, and Google and UC Berkeley named the company in a 2015 study. CyberGhost’s own CEO put the contrast plainly in a blog post since removed from the site: “while CyberGhost focused on privacy and security from day one, Crossrider started out as a company that distributed browser extensions and developed ad tech products. Quite the opposite of what we did.”
None of that says anything about how the services currently handle data. It says the founding story is not a technical property, which is exactly the point.
Where “independent” stops meaning anything#
Small and founder-run describes ownership, not operations. A two-person company and a listed holding company both depend on rented hardware in buildings they do not own, staffed by people they did not hire.
That is why the ownership question is worth asking and is not sufficient on its own. Independent of whom, and running on what, are two different questions with two different answers.
Common misconceptions#
“A no-logs policy means independent.” A policy describes logging. It says nothing about who owns the company, and it can be published by any of these structures.
“A non-profit is stronger than a for-profit.” Foundation control removes one specific risk, namely a hostile sale. Proton still operates a commercial company because that is what funds the work.
“Small companies are private by nature.” Employee counts describe staffing. A founder-run service can be careless with the records it does hold.
“The brand name is a guarantee.” Five brands under one parent share accounting, legal exposure, and infrastructure decisions. The logo does not show you that, and the comparison table certainly will not.
Related#
- What Should You Look for in a VPN?: the decision procedure this article feeds
- What Is a VPN?: why the operator’s position in the path matters at all
- Privacy vs Anonymity: the difference ownership is trying to buy you
Sources
- About Mullvad
- Who owns Proton VPN? Proton
- The Proton Foundation Proton
- What is Kape Technologies? What you need to know about the parent company of CyberGhost VPN CNET
- About Us Kape Technologies
Last reviewed October 8, 2026. Corrections and additions are welcome.