VPN Reseller Margins in 2026

A pitch deck shows commission compounding. Real books show month-one refunds inside the 7-day window, a failed card you already paid affiliate on, and a WhatsApp thread where you explained split tunnel at midnight because you like being helpful. Helpful is a cost center.

I want a one-line definition: contribution margin per active sub = commission earned − (payment fees you eat, if any) − (refunds/chargebacks you eat) − (support minutes × your cost per minute) − (ad spend attributed to that sub). If you cannot fill the terms, you do not have margins. You have hope.

I will not publish a rate. I will publish how to interrogate one. Is it on retail, on net, on first month, on every month? Does annual prepay pay you up front or monthly? Do refunds reverse commission at gross or net of fees? How fast do you get paid? What happens if the sub downgrades from yearly to monthly?

Write those answers in the contract. If the AE says 'standard,' ask for the PDF. Standard is how people invent 70% in a tweet. I have watched partners sign on a call and then argue the rate in month two. The PDF wins. The tweet does not.

Technical cannot-connect, protocol choice, iOS permission sheets — Klox support on the reseller motion, per the program. Sales questions, 'why does the icon say Klox,' invoice confusion, your bundle extras — you. If you answer tech anyway because you are proud, you are volunteering a wage.

Tickets per 1,000 users is its own article. Steal the idea: a few dollars to low tens per contact is a planning range, not a promise. Even a 2% contact rate on 'who is Klox' will eat a thin commission.

Klox consumer money-back is 7 days. Reseller refunds follow program rules you confirm with sales. The economic hit is the same shape: you spent CAC, you maybe paid support, commission reverses. Trip-use buyers (airport, one week, refund) will find you if your ads say 'risk free' louder than the product.

Annual prepay looks rich. It also concentrates refund risk. If commission paid up front on annual, a day-6 refund is a hole. Ask how reversals work before you spend on yearly push.

Brand on your landing page is not ownership. Merchant, publisher, controller, inbox. On reseller, subscribers are typically Klox subscribers unless a contract says otherwise. You can still have a relationship. You may not have portability. If you leave the program, the revenue stream can stay with the provider. There may be no asset to sell.

If that sentence is unacceptable, you are in white-label. Pay for it with store review, billing, and tickets. Do not try to have both in one Slack channel.

Paying for ads against a brand you do not own is how you fund Klox's brand with your card. Sometimes that is the deal: you have a hosting audience, you attach Klox, CAC is an email. Sometimes you buy generic 'best VPN' terms and lose to people who own listings. Run the numbers. Generic VPN keywords in 2026 are a meat grinder.

If your ad says your agency name and the store says Klox, expect tickets. Those tickets are yours.

You have demand already. You do not want Apple Network Extension homework. You do not want to be merchant of record. You do not want to staff a helpdesk for cannot-connect. Your buyer accepts a Klox icon. Your attach sale is a conversation, not a performance-marketing war. Your exit plan is 'this is a commission line,' not 'this is a VPN company I will sell.'

That is a long list. It describes a lot of hosting companies, MSPs, and consultants. It does not describe a founder who already printed hoodies.

You need the icon. You need merchant of record. You need to set price without a framework. You need a business with sale value. You have the stomach for review, refunds, and tickets. Your niche (ISP, hotel, MSP) needs packaging Klox-the-brand cannot wear. Then pay for white-label and stop doing reseller math on a hoodie P&L.

The billing-and-churn article is the white-label margin story. Do not mix it into this spreadsheet. Different owner, different floor.

Columns: sell price, program cost or commission rate (from sales), refund rate you actually observe after 90 days, support minutes you still do, CAC. Rows: monthly attach, yearly attach, bundled MSP seat. Do not fill rates from this article. Fill from your contract and your books.

If contribution is negative after honest support minutes, you are buying a job. That can be a marketing job (VPN as a closer for hosting). Then book it as CAC for hosting, not as a VPN company.

Apply. Confirm commission, refund clawbacks, payout timing, support boundary, pricing framework. Write the handoff sentence. Decide whether your audience accepts a Klox icon. If they do not, do not join and then complain about the icon. Go to white-label and confirm that package with sales instead.

Bring a job list, not a dream rate. We will not quote SOC 2, a 99.x SLA, or API paths as if they were reseller terms. Technical support for tunnels is the point of the program. Your margin is the leftover after you stop doing that job for free.

Yearly looks like a bonus. Cash hits. Commission may hit. Then day 6 arrives and the traveler wants the year back. If clawback is full-year commission, your 'bonus' was a loan. Ask. Monthly is noisier and usually smaller per month, and it matches how people actually use a VPN they forget.

Klox consumer from $2.83/month is the yearly-equivalent public reference. Your reseller sell price may sit elsewhere inside the framework. Pushing yearly to juice this quarter without modeling refunds is how you have a bad Q2. White-label founders make the same mistake with their own Stripe. You can make it with someone else's merchant account too.

A hotel that wants the property name on the home screen is not a reseller buyer. An ISP that wants the add-on on their bill under their brand is not a reseller buyer. An MSP that needs the client to see the MSP's app in the store is not a reseller buyer. Send those to white-label. Taking their money as reseller is how you spend a year apologizing for an icon.

A hosting customer who already trusts you and does not care what the VPN app is called is the reseller buyer. Say that in onboarding. Qualify. A bad-fit logo fight is support you cannot hand to Klox, because it is not a tunnel bug.

Hosting: VPN as a line on the existing invoice. CAC is an email and a checkbox. Support boundary still matters; your NOC should not debug WireGuard handshake times if Klox owns that inbox. MSP: seat-based add-on at QBR. You already have the relationship. Commission is extra gross on work you were doing. Consultant: one-time setup plus a residual. The residual is the reseller motion. The setup fee is yours. Do not let the setup fee become unpaid lifetime support.

None of this needs a model-war with white-label. It needs a yes/no on the icon and a written handoff. If attach rate is 8% of a 2,000-customer hosting base, you have a book of residuals. If attach rate is 0.2% of cold ads, you have a hobby.

Ask when commission lands. Ask if there is a reserve against refunds. A 30-day lag plus a reserve can make a 'great' signup month cash-poor. Plan payroll on cash, not on dashboard GMV.

If you spend ads on day 1 against commission that arrives day 45, you are the bank. Fine if you meant to be. Fatal if you thought reseller meant no working capital.