Servers in country

VPNs with servers in Kazakhstan

The law in Kazakhstan puts a VPN provider with servers in the country under obligations to the state — keeping records about its users, registering, or giving the authorities access. On record here: national security certificate and retention obligations.

Some of the providers listed here say they removed their physical servers and serve the country from hardware elsewhere; each row carries the provider’s own answer.

17 providersOrdered by securityUpdated 14 September 2026No company registered here

The HushFleet teamRegister of 26 September 2026

Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.

An exit here is under a retention mandate. National security certificate and retention obligations. From the contract's country table — the same field that marks a country on a record's own list.

Using a VPN is not itself an offence in Kazakhstan, but the authorities block VPN services, and an exit standing here stands under a two-year retention rule and a law written to open encrypted traffic.

Under the Law on Communications and its rules on service information, operators collect and store their subscribers' service data for two years, and they must install and pay for SORM equipment that gives the security services access to the line.

What the law requires of a provider standing here

Amendments that took effect in 2016 added a national security certificate through which operators were to pass encrypted traffic. Attempts to impose it on users in 2019 and 2020 ended when browser makers refused to trust it; OONI still measured interception of a handful of sites between 2021 and 2024.

What is restricted

Article 41-1 of the Law on Communications lets the authorities suspend networks and block resources — the National Security Committee without a court order — and the Prosecutor General may order services shut down when networks are “used for felonious aims”. The internet was cut nationwide during the protests of January 2022.

An October 2024 OONI study found 73 circumvention-tool sites and at least 17 news sites blocked, alongside petition and human rights sites.

Whether posting can be prosecuted

Yes. Criminal Code article 274, spreading “knowingly false information”, is the usual charge against journalists, bloggers and activists, and since December 2025 several prominent independent journalists have been placed under house arrest on it.

A VPN changes none of that. The case starts from the account and the publication, not from the network it was posted over.

What it means for the rows below

An exit in Kazakhstan is an exit under that retention rule, on a line the operator must keep open to SORM. Seventeen of the 77 records publish an exit here.

The register marks the mandate on a record's own country list, and the order of the rows is the security score — reach is a usability fact, not a recommendation.

Kazakhstan

Ranked by security

Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.

A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.

Each of the seventeen providers with an exit here names this country under a mandate in its own record (C09_mandate_countries).

What moved

Changes to the country lists and mandate postures of the providers listed here

Every row is the record’s own history[], filtered to U02_server_countries and P04_mandate_response; the whole log holds every field.

Acceptable
1
Insufficient
2
Insufficient
3
Insufficient
4
Insufficient
5
Insufficient
6
Not recommended
7
Not recommended
8
Not recommended
9
Not recommended
10
Not recommended
11
Not recommended
12
Not recommended
13
Not recommended
14
Not recommended
15
Not recommended
16
Not recommended
17

Private Internet Access

Commercial VPNUnited StatesKape TechnologiesPulled its servers out rather than comply

Coverage91countries

Paying monthly$11.95monthly

Paying yearly$47.88yearly total

Free tierNopaid plans only

Devicesunlimitedat once

25 out of 100

Security

73 out of 100

Usability

VPNs with servers in Kazakhstan

Ranked by security

The other 179 countries

Changes to the country lists and mandate postures of the providers listed here