Owner
Two brands, both acquired rather than built: ExpressVPN in September 2021 and Private Internet Access in December 2019. Integrity is the dominant risk channel on both records, and R11 is why an audit older than those dates does not count for the buyer.
Who the operating company answers to, from M15_owner_group. The corporate groups are the ones named in methodology.groups; independent is a value of the field rather than one of them, and it means the provider answers to nobody on this list.
This is the one taxonomy where a sibling can move a score. R02_cluster_contagion carries a finding against one brand into the integrity channel of another in the same group — scaled by whether they share infrastructure, and never applied to a finding that predates the acquisition. R11_evidence_voiding works the other way: an audit dated before control changed hands does not count for the company that holds the brand now. Both need M16_control_since, which is why the date matters more here than the ownership does.
What a page here does not show is how much risk was carried: the magnitude lives in security.breakdown.cluster and is not published on a record. Group membership, brand role and the date are.
Kape Technologies
More owner groups
Where M15 is unknown the record appears under no owner at all (five on file). That is the honest state rather than a gap: such a provider is often reported to sit inside a larger group, and publishes it nowhere anyone can cite. Independence is a fact about ownership and says nothing about quality on its own — the term holds records at both ends of the register.
Coverage91countries
Paying monthly$11.95monthly
Paying yearly$47.88yearly total
Free tierNopaid plans only
Devicesunlimitedat once
Security
Usability
Coverage91countries
Paying monthly$12.99monthly
Paying yearly—no yearly plan
Free tierNopaid plans only
Devices7at once
Security
Usability
Coverage106countries
Paying monthly$14.99monthly
Paying yearly$59.85yearly total
Free tierNopaid plans only
Devices10at once
Security
Usability