Servers in country

VPNs with servers in Iraq

The law in Iraq puts a VPN provider with servers in the country under obligations to the state — keeping records about its users, registering, or giving the authorities access. On record here: operator retention obligations.

Some of the providers listed here say they removed their physical servers and serve the country from hardware elsewhere; each row carries the provider’s own answer.

6 providersOrdered by securityUpdated 14 September 2026No company registered here

The HushFleet teamRegister of 26 September 2026

Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.

An exit here is under a retention mandate. Operator retention obligations. From the contract's country table — the same field that marks a country on a record's own list.

No Iraqi statute makes using a VPN an offence. An exit standing here stands on a network whose operators hold their licences on conditions that include keeping records for the authorities.

Iraq has no data-protection law and no published retention statute. What an operator keeps, and what it must hand over, is set by the licence the Communications and Media Commission (CMC) issues and by its directives, whose security terms are not published in full. In the Kurdistan Region, Law No. 6 of 2008 requires SIM cards to be registered and user information to be given up on a judicial request.

What the law requires of a provider standing here

That is a licence obligation on the operator of the line, and it is the reason this country carries a mandate flag on every record page that lists it.

What is restricted

Blocks are ordered by the Ministry of Communications: Telegram for several days in August 2023, on national-security grounds, and IMDb and SoundCloud in November 2024 as hosting “immoral” content.

The ministry also switches the whole network off for the morning hours of the national school exams — in May and June of 2024 and 2025, and again in June 2026.

Whether posting can be prosecuted

Yes. With no federal cybercrime law in force, prosecutions over posts are brought under the Penal Code of 1969: article 226, insulting state institutions, with up to seven years, and article 403, material that violates public decency, the basis of the 2023 campaign against “indecent content”. A cybercrime bill first drafted in 2011 had its first reading in parliament in July 2026.

A VPN changes none of that: the case starts from the account.

What it means for the rows below

An exit in Iraq is an exit under those licence terms, and the register marks the mandate on a record’s own country list.

Six of the 77 records publish an exit here. That is a usability fact — reach — and it is not a recommendation: the order of the rows is the security score, and the mandate above sits on the provider, not on the reader.

Iraq

Ranked by security

Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.

A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.

What moved

Changes to the country lists and mandate postures of the providers listed here

Every row is the record’s own history[], filtered to U02_server_countries and P04_mandate_response; the whole log holds every field.

29 Aug 20261 changes

NordVPNResponse to a national logging mandateP04_mandate_response

not on the record changed to withdrew_physical

Acceptable
1
Proton VPN
Commercial VPNSwitzerlandPulled its servers out rather than comply
Coverage147countries
Paying monthly$9.99monthly
Paying yearly$53.88yearly total
Free tierYeslimited free plan
Devices10at once
70 out of 100
Security
78 out of 100
Usability
Visit Review
Insufficient
2
NordVPN
Commercial VPNPanamaNord SecurityPulled its servers out rather than comply
Coverage149countries
Paying monthly$14.99monthly
Paying yearly$139.08yearly total
Free tierNopaid plans only
Devices10at once
17 out of 100
Security
70 out of 100
Usability
Visit Review
Insufficient
3
X-VPN
Commercial VPNSingapore
Coverage96countries
Paying monthly$11.99monthly
Paying yearly$47.99yearly total
Free tierYeslimited free plan
Devices5at once
15 out of 100
Security
78 out of 100
Usability
Visit Review
Not recommended
4
ZoogVPN
Commercial VPNGreece
Coverage80countries
Paying monthly$9.99monthly
Paying yearly$39.99yearly total
Free tierYeslimited free plan
Devices10at once
11 out of 100
Security
74 out of 100
Usability
Visit Review
Not recommended
5
VeePN
Commercial VPNPanama
Coverage168countries
Paying monthly$10.99monthly
Paying yearly$39.84yearly total
Free tierYeslimited free plan
Devices10at once
7 out of 100
Security
86 out of 100
Usability
Visit Review
Not recommended
6
Turbo VPN
Commercial VPNSingaporeInnovative Connecting
Coverage80countries
Paying monthly$11.99monthly
Paying yearly$59.99yearly total
Free tierYesfree, no data cap
Devices10at once
1 out of 100
Security
67 out of 100
Usability
Visit Review

VPNs with servers in Iraq

Ranked by security

The other 179 countries

Changes to the country lists and mandate postures of the providers listed here

Proton VPN

NordVPN

X-VPN

ZoogVPN

VeePN

Turbo VPN