Regarding your “dual jurisdiction” assessment. Yes we operate in two jurisdictions, that’s a legal fact, but the majority of our operations (including operations of Gibraltar company and core VPN service) are not affected by Swiss laws. The basis of my argument was that Swiss authorities cannot directly compel the Gibraltar company to log or hand over data, just as they could not directly compel Mullvad to hand over data or change their infrastructure to support a logging mandate through a Swiss operated white label. You could say this means IVPN has “dual jurisdictions”, I would rather characterise it as IVPN Limited, a Gibraltar based service having a Swiss sister company (what a weird term) that handles the distribution of its open-source Android app in an app store, which is a severely limited mandate and implies a different threat model for the business and the customers.
While I won’t provide specifics here, all requests to the Gibraltar company have been treated in accordance with the legal guidelines linked above. If a legally enforceable order comes to the GmbH that prevents us from honoring our privacy policy (still limited to the Android application published in the Play Store), we would use all available avenues to fight it, and if that’s not possible we would stop publishing the Android app under the GmbH. That hasn’t happened yet and it’s not a material threat as the current Swiss legal framework is favorable to VPNs and there is no statutory requirement for retaining traffic logs (currently, and we are closely monitoring the VÜPF ordinance and its fate).
To reiterate, we have stated many times regarding Gibraltar, if we were to get into any situation where our promises cannot be kept, we’d move jurisdictions in compliance with exit obligations (sans logging data). If that’s not possible we would shut down the business before compromising our customers. Same applies to the Android app (jonah’s scenario), and we feel that’s a sufficient guarantee.
I think that’s a fair request and my key takeaway here. We will find a way in alignment with the actual potential impact on users ie. mention on the Android app page vs. modifying legal guidelines which are not impacted by it.