Begin with documents that create obligations
Marketing pages often describe a brand, not the entity that contracts with you. Open the current terms of service and privacy policy and record:
- the entity providing the service or accepting the contract;
- the law and courts named for the agreement;
- the entity described as controller or processor for personal data;
- any separate entities for payments, support, apps or analytics; and
- the ultimate parent and any shared infrastructure disclosed by the group.
For example, ExpressVPN’s terms name a BVI company and describe the governing law. That is useful primary evidence for that contract. It does not, by itself, prove what every app or server records; those claims require separate technical or assurance evidence.
Use jurisdiction as context, not a score
The UK Secret Intelligence Service identifies the United Kingdom, United States, Canada, Australia and New Zealand as the Five Eyes partnership. That is a real intelligence relationship. It does not create one universal VPN-logging rule, and being outside it is not a safety certificate.
Law, corporate structure and technology interact. A useful review therefore states the entity and source date, then separately examines the privacy policy, audit scope, account requirements and technical controls. Avoid rankings such as “privacy-friendly country beats Five Eyes” unless a qualified legal analysis defines the precise law, product and user situation being compared.
Recheck when ownership or terms change
Acquisitions, reorganizations and policy updates can change which entity applies. Use the provider’s live documents before subscribing, and keep a dated copy if jurisdiction is important to your threat model.