Follow the Tunnel: Why Your VPN's Exit Server Could Sit in a Jurisdiction Your Clients Never Agreed To
Photo: Federal Office of Topography, Attribution-Swisstopo, via Wikimedia Commons
When a CPA evaluates a VPN, the marketing materials usually emphasize encryption strength, device support, and price. What rarely comes up in the sales pitch — and almost never in vendor demos — is the question of where the tunnel ends. Yet for a professional bound by Circular 230 responsibilities and state-level confidentiality rules, the physical and legal location of a VPN's exit server deserves the same scrutiny you'd give a third-party service organization's SOC 2 report.
The Exit Node Is the New Filing Cabinet
Think of a VPN connection as a sealed envelope. Encryption protects the envelope in transit, but the envelope has to be opened somewhere. That somewhere is the exit server, and it exists in a specific country, under a specific legal regime, subject to specific compelled-disclosure powers.
If your firm is in Des Moines but your VPN provider routes your session through a data center in a jurisdiction with broad surveillance authority, the practical confidentiality posture of that session is defined by the destination's laws — not yours. Client tax documents, engagement letters, and payroll files traversing that tunnel are, at the moment of decryption, exposed to whatever legal framework governs that server.
Most commercial VPNs don't tell you which server a session will use until you're connected. Fewer still publish their server footprint in a form that lets you map traffic paths against data sovereignty concerns.
Five Eyes, Explained Without the Jargon
The term "Five Eyes" gets thrown around in VPN marketing, usually as a scare tactic or a badge of honor. Stripped of the spycraft language, it's straightforward.
Five Eyes is an intelligence-sharing arrangement among the United States, the United Kingdom, Canada, Australia, and New Zealand. Its members agree to collect signals intelligence and, critically, to share it. Two expanded circles — Nine Eyes and Fourteen Eyes — add countries such as France, Germany, Sweden, Spain, and the Netherlands.
For a US accountant, the uncomfortable implication is this: choosing a VPN headquartered in a "privacy-friendly" European country doesn't necessarily remove your data from American reach if that country participates in these alliances. Conversely, a US-headquartered provider is already subject to US legal process — subpoenas, national security letters, gag orders — regardless of where its servers sit.
The point isn't that these arrangements make every VPN unsafe. It's that the common pitch of "we're outside US jurisdiction" is often legally hollow. Data flows, corporate domicile, and intelligence-sharing pacts don't respect the tidy boundaries vendors imply.
Corporate Domicile vs. Server Location: Two Different Questions
There are two separate geographies at play, and conflating them is a common evaluation error:
- Server location — where your traffic exits the tunnel and gets decrypted.
- Corporate domicile — whose courts can compel the company to hand over records, source code, or transparency-report data.
A provider incorporated in Panama with servers in Frankfurt is governed by Panamanian legal process but operates exit nodes under German law. A provider incorporated in Delaware with servers in Toronto is subject to US process while its traffic exits under Canadian rules. Neither configuration is automatically better; both demand a reading of the actual legal exposure rather than the flag on the homepage.
When we evaluate VPNs for finance professionals, we ask three questions most reviews skip:
- Does the vendor publish a warrant canary, and has it been updated?
- Has the provider ever disclosed what legal requests it has received, by jurisdiction?
- Can users manually select exit servers in countries with favorable retention laws, and does the provider honor that selection at the routing level?
A vendor that can't answer the third question clearly is asking you to trust its routing decisions blindly — the same way you'd never let a client trust your workpapers to an unnamed third-party processor.
What This Means for Taxpayer Data
IRS Publication 4557 lays out baseline safeguards for protecting taxpayer information, and the FTC Safeguards Rule extends obligations to firms preparing returns professionally. Neither document says the word "VPN," but both require reasonable protections for client data in transit and at rest. Routing that data through a jurisdiction with mandatory retention requirements — where providers may be legally required to log connection metadata — is difficult to reconcile with any defensible "reasonable safeguards" standard.
The practical guidance is unglamorous:
- Prefer providers with transparent, documented server footprints.
- Favor exit servers in the United States for US client work, unless a specific engagement requires otherwise — keeping data within the same legal framework that governs your engagement is the simpler compliance story.
- Document your VPN selection rationale. If a peer review or a cyber insurance underwriter asks why you chose a vendor whose traffic exits in a Fourteen Eyes country, "it had good reviews" is not an answer.
The Bottom Line
Encryption protects data in motion. Jurisdiction governs data at rest. A VPN that excels at the first and ignores the second offers a false sense of security — one that a careful adversary, or a diligent regulator, can see straight through. Where your tunnel terminates is a governance decision. Treat it like one.
