Proton VPN's Cuba Servers – Findings and Privacy Analysis
On September 11, ProtonVPN announced the addition of servers in four new countries: Cuba, Honduras, Dominican Republic, and Guatemala.
I'm publishing this report because I'm Cuban, I lived most of my life in Cuba, have my own VPN service, and a big concern for privacy. This is why I took time to research into.
Given the situation in Cuba, where all internet infrastructure is owned and operated by ETECSA, a state-run company controlled by the military, this raises an important question:
Are these servers physically located in Cuba, and if so, what does this mean for user privacy?
Investigation Findings
I subscribed to ProtonVPN and connected to all 29 servers listed under Cuba.
From there, I collected their IP addresses and performed WHOIS lookups.
These addresses belong to M247 Europe SRL, a major global infrastructure provider based in Romania and Spain. M247 is not listing "Cuba" as a location on their network, which might indicate that the range of IPs they rent for that location is reserved to specific corporative clients like Proton VPN, or are the results of agreements with carriers which own Cuban-geolocated IP addresses.
The IP range is described as “M247 – Cuba”, which means it is geolocated as Cuban, but does not confirm physical presence in the country.
M247 is known for providing geo-located IP blocks (or virtual locations), enabling traffic to appear as if it originates from a country where the server is not physically located. It remains unclear why Cuba is not listed.
Possible Explanations
1. Smart Routing / Virtual Location (Most Likely)
The servers are physically outside of Cuba, likely in Miami (as announced by Proton VPN here) or another nearby region, but are assigned IPs that appear Cuban.
This approach avoids reliance on Cuban state infrastructure, while still letting users appear as if they are connecting from Cuba.
2. Physical Servers in Cuba (Less Likely)
If the provider has indeed deployed hardware inside Cuba, that would mean:
- The servers are hosted through ETECSA or another state-controlled entity.
- Authorities could potentially audit, monitor, or even seize these servers.
- This would introduce a significant privacy risk for users, especially for politically sensitive activities.
Privacy Considerations
If Smart Routing is used: User traffic stays outside Cuban jurisdiction, reducing exposure to state surveillance.
If servers are inside Cuba: Users should be aware that their traffic could be monitored or logged by the regime, regardless of encryption, through network-level surveillance.
Conclusion
Based on the evidence collected, the most probable scenario is that these “Cuba” servers are not physically located inside Cuba, but are virtual locations using geolocated IPs.
This is a reasonable solution for users who simply need a Cuban IP address.
However, until there is full transparency from the provider, or third-party verification, the possibility of in-country servers cannot be fully ruled out.
For users concerned about privacy, it is wise to assume that any in-country infrastructure could be subject to monitoring by state authorities.