5 Eyes, 9 Eyes, 14 Eyes — Explained
These are intelligence-sharing agreements between countries that allow member governments to share surveillance data with each other. The key implication for VPN users: if a VPN is based in a member country, authorities could compel it to hand over user data — and share that data with allied nations.
| Alliance | Members | Risk for VPN Users |
|---|---|---|
| 5 Eyes | 🇺🇸 USA · 🇬🇧 UK · 🇨🇦 Canada · 🇦🇺 Australia · 🇳🇿 New Zealand | Highest — full intelligence sharing, strongest legal compulsion |
| 9 Eyes | 5 Eyes + 🇩🇰 Denmark · 🇫🇷 France · 🇳🇱 Netherlands · 🇳🇴 Norway | Elevated — secondary sharing partners |
| 14 Eyes | 9 Eyes + 🇩🇪 Germany · 🇧🇪 Belgium · 🇮🇹 Italy · 🇸🇪 Sweden · 🇪🇸 Spain | Moderate — tertiary sharing, less active |
| Outside | 🇵🇦 Panama · 🇨🇭 Switzerland · 🇧🇻 British Virgin Islands · 🇮🇸 Iceland | Lowest — no obligation to share, strong privacy laws |
Where Are VPNs Based?
| VPN | Jurisdiction | Alliance | Privacy Risk |
|---|---|---|---|
| NordVPN | 🇵🇦 Panama | None | ✅ Low — outside all alliances |
| ProtonVPN | 🇨🇭 Switzerland | None | ✅ Low — Swiss neutrality, no EU sharing |
| ExpressVPN | 🇻🇬 British Virgin Islands | None | ✅ Low — British Overseas Territory, separate laws |
| Mullvad | 🇸🇪 Sweden | 14 Eyes | ⚠️ Member, but no-logs proven in 2023 police raid |
| Surfshark | 🇳🇱 Netherlands | 9 Eyes | ⚠️ Member, but no-logs verified by Deloitte |
| CyberGhost | 🇷🇴 Romania | None | ✅ Low — Romania not in any alliance |
Does Jurisdiction Really Matter?
Jurisdiction matters but it's not the whole picture. Here's a realistic view:
- A no-logs VPN outside 5 Eyes is ideal — NordVPN (Panama), ProtonVPN (Switzerland), ExpressVPN (BVI) tick this box.
- A no-logs VPN inside 5 Eyes is still safe — if the no-logs policy is independently audited. With nothing stored, there's nothing to hand over regardless of jurisdiction.
- Jurisdiction protects against mass surveillance — if your government is a 5 Eyes member and wants broad access to VPN data, a VPN outside the alliance can legally refuse.
- No jurisdiction protects against your own mistakes — logging into personal accounts, browser fingerprinting, and cookie tracking bypass VPN jurisdiction entirely.
Not necessarily. If the VPN has a verified no-logs policy (audited by an independent firm), there's no data to share even if compelled. NordVPN (Panama) is outside 5 Eyes AND audited — best of both worlds.
Panama (NordVPN), Switzerland (ProtonVPN), British Virgin Islands (ExpressVPN), and Iceland are considered the most privacy-friendly jurisdictions — strong privacy laws, outside intelligence alliances.
Poland is not a member of the 5 Eyes, 9 Eyes, or 14 Eyes alliances. Polish residents have relatively good jurisdictional protection — and Polish law doesn't require VPNs to retain user logs.
The Netherlands is a 9 Eyes member. However, Surfshark's no-logs policy was verified by Deloitte in 2023. A law enforcement request would yield zero user data regardless of the Dutch legal framework.