Servers in country

VPNs with servers in India

The law in India puts a VPN provider with servers in the country under obligations to the state — keeping records about its users, registering, or giving the authorities access. On record here: CERT-In direction 20(3)/2022 — five years of subscriber logs.

Some of the providers listed here say they removed their physical servers and serve the country from hardware elsewhere; each row carries the provider’s own answer.

27 providersOrdered by securityUpdated 14 September 2026No company registered here

The HushFleet teamRegister of 26 September 2026

Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.

An exit here is under a retention mandate. CERT-In direction 20(3)/2022 — five years of subscriber logs. From the contract's country table — the same field that marks a country on a record's own list.

Using a VPN is legal in India. What changed in 2022 is what a provider that keeps hardware here has to hold about you.

CERT-In direction 20(3)/2022, in force since September 2022, requires VPN, cloud and data-centre operators to keep subscriber records for five years — names, addresses, contact details, the period of hire and the IP addresses allocated — and to report an incident within six hours.

What the law requires of a provider standing here

Read what that is and is not. It does not order anybody to log traffic. It orders them to be able to say who had this address on this date, which is precisely the record the retention axis of this register prices, and it is why several providers pulled their hardware out rather than keep it.

What is restricted

Blocking runs through section 69A of the IT Act and the IT Rules 2021: a ministry can order an intermediary to take content down or an access provider to block it, and the orders themselves are generally not published.

Adult material has been blocked at the access-provider level since 2018 under those powers, and the same machinery reaches news sites, apps and individual accounts.

Whether posting can be prosecuted

Yes. Criminal cases over social-media posts are ordinary here, brought under the IT Act and the penal code, and platforms are required to identify an account to the authorities on a valid order.

A VPN changes none of that. It hides which network you posted from; it does not hide an account you signed into, and the case starts from the account.

What it means for the rows below

An exit in India is an exit under that direction. Several providers withdrew their physical servers in 2022 and now serve the country from hardware elsewhere — a record that says so is telling you something a country count cannot.

The register marks the mandate on a record's own country list, so you can see which of a provider's exits stand in countries that oblige it to keep more than it says it keeps.

27 of the 77 records publish an exit here, and the order of the rows is the security score — reach is a usability fact, not a recommendation.

India

Ranked by security

Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.

A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.

29 Aug 20263 changes

ExpressVPNResponse to a national logging mandateP04_mandate_response

not on the record changed to withdrew_physical

NordVPNResponse to a national logging mandateP04_mandate_response

not on the record changed to withdrew_physical

SurfsharkResponse to a national logging mandateP04_mandate_response

not on the record changed to withdrew_physical

VPNs with servers in India

Ranked by security

The other 179 countries

Changes to the country lists and mandate postures of the providers listed here

Proton VPN

Private Internet Access

CyberGhost VPN

NordVPN

PrivateVPN

Surfshark

ExpressVPN

CactusVPN

AdGuard

ZoogVPN

StrongVPN

ClearVPN

Betternet

FlyVPN

Planet VPN

VeePN

VyprVPN

BTGuard

PrivadoVPN

Norton VPN

FastestVPN

Bitdefender

Browsec

Urban VPN

Turbo VPN

VPN Proxy Master

VPN Gate