Servers in country
Where traffic leaves the tunnel — a different question from where the company is registered, and answered separately because the answers are different. Only providers that publish a country list appear: a claim of “100+ countries” with no list behind it puts nobody on any of these pages.
Browse
Each one opens a list of providers ranked by security. The number shows how many providers it holds today.
Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.
Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.
A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.
Retention mandates
From the contract's country table — the same field that marks a country on a record's own list.
| Country | Providers with an exit here | Legal basis |
|---|---|---|
| Türkiye | 33 | Law 5651 — traffic-data retention by access and hosting providers |
| United Arab Emirates | 28 | licensing and lawful-interception obligations |
| India | 27 | CERT-In direction 20(3)/2022 — five years of subscriber logs |
| Vietnam | 23 | Cybersecurity Law 2018 — data localisation and retention |
| Russia | 18 | Yarovaya package, SORM interception, VPN registry |
| Kazakhstan | 17 | national security certificate and retention obligations |
| Belarus | 8 | operator logging obligations |
| Iraq | 6 | operator retention obligations |
| China | 5 | Cybersecurity Law; operating a VPN requires a licence |
| Iran | 2 | mandatory registration and interception access |