Who Owns the VPN Customer: Reseller vs White-Label

Users do not parse vendor maps. They remember the icon, the charge, and the last person who answered. If those three names differ, they pick the one on the bank app and file a dispute. Your beautiful partner diagram does not get attached to the Visa case. I have watched teams lose a week of payouts because the descriptor said one company and the app said another, and nobody had a template ready for the processor.

If you plan to sell the brand, acquirers will ask for subscriber files, refund rates, store accounts, and processor history. They will not pay a multiple on 'we drove a lot of clicks to someone else's checkout.' Reseller revenue can be real. It is still a channel, not an asset with the same diligence packet.

Set the statement descriptor on purpose. If it is a legal entity the user never heard of, you will get 'fraud' tickets from honest people. If it is a cute brand that does not match the corporate name on the privacy policy, you will get the same tickets from a different angle. Match the names. Put the URL in the descriptor if the processor allows it. This is unglamorous and it saves more money than a new landing-page hero.

Dunning email — card expired, retry, cancel — comes from the merchant. If Klox is merchant, we own that sequence for reseller subscribers. If you are merchant, your dunning copy is part of your brand. Outsource the SMTP if you want. Do not outsource the tone to a template that says 'Dear Customer' and a dead help link. Churn hides in these emails more than in protocol choice.

If you sell iOS subscriptions through Apple, Apple is in the money path. You get a different refund process, a different tax story, and a user who thinks Apple Support is your support. Some brands keep web checkout as the source of truth and use the store only for the binary. That is a policy choice with tradeoffs. What you cannot do is ignore it and then act shocked when a user was refunded in App Store Connect and your own panel still shows paid.

If your macro says 'we do not keep connection logs' you had better know whether that 'we' is you, us, or both in different ways. Account records are not tunnel dumps. Billing records are not traffic records. Train people on the difference. A sloppy sentence in a ticket can become an exhibit.

Abuse, preservation requests, and rights requests (access, deletion) need a path that is not 'info@'. Name a role. Time-box a response. Know what you can actually look up. If you are a reseller, many of those requests belong to Klox as the service operator. If you are white-label controller, they belong to you, and the platform should process on your instruction. Mixing the two is how you either over-share or stonewall someone with a real right.

Tunnels fail at night. Hotel Wi-Fi fails at night. If you own the inbox, you own that clock or you publish hours and accept the reviews. If you do not own the inbox, do not advertise 'we are always here' on your affiliate page. Users will hold the name they paid.

Agencies that 'will submit for you' and keep the account in their name are a trap. People leave agencies. Apple will not care about your Slack thread. Put the account in the company that owns the brand, with two-factor on hardware keys, and a second admin who is not the founder on a single phone.

One-star reviews attach to the listing. On reseller, they attach to Klox. On white-label, they attach to you. That is the brand you wanted. It includes the ugly parts. Reply as the publisher. Do not reply as a confused middleman. Users can smell that.

Network Extension and Play VPN declarations live with the account that ships. If a partner 'temporarily' uses someone else's team ID, you will pay for that later in transfers, lost devices, and review questions. Do the paperwork once.

Digital goods, instant delivery, privacy-minded users who forget they subscribed. You will see 'I do not recognize this charge' from people who do. Representment works when your policy was clear and your emails landed. It fails when your checkout was a mystery box. Ownership means you care about that UX as much as handshake ciphers.

If dispute rates spike, the processor pauses you. Your ad account will keep spending unless you kill it. This is an ops runbook: threshold, pause ads, tighten checkout, require stronger auth. Reseller shifts this risk toward Klox. That is a feature of reseller. It is also why you do not own the subscriber file.

Rights requests, breach assessment, and lawful basis sit with the controller. If that is you, staff it. A weekend founder can still be a controller. The law does not care that you are tired. If that is unbearable, reseller is the more honest product: you are a channel.

Hosting, email, payments, crash reporting. Write them down. If you cannot explain why a crash reporter needs certain fields, turn fields off. TLS 1.3 on the control plane (see RFC 8446) does not erase the fact that a ticket contains a name and a device model.

If you do not have a SOC 2 report, do not talk like you do. If you have not commissioned an audit, do not imply one. Customer ownership includes the promises you make about the customer. False promises are a liability you do own, even on a licensed network.

Say who provides the service. Say what happens on abuse. Say the refund window. Say that a VPN does not make illegal things legal. If you are reseller, your own site terms should not pretend you operate the network. If you are white-label, do not point users at Klox terms as if that were their contract with you, unless that is actually the structure. Inconsistency here is how you lose both the user and the partner.

Owning a wordmark is not owning subscribers. I have seen people spend on trademark filings and skip processor KYC. Reverse that order. You cannot invoice the planet with a nice logo and a frozen Stripe account.

Users must install something, sign in again, or trust a transfer. Expect a 20–40% loss if you botch comms. Expect chargebacks if you cut service without notice. Ownership means you can message them. If you never held the email, you cannot message them. That is the reseller lesson in one line.

Some founders want source in escrow on day one. Sometimes that is rational for a source-license deal. For a hosted white-label on a shared network, escrow of our entire datapath is not a consumer-tier entitlement. If you need that, you are in enterprise conversation territory at /contact, and you should expect diligence both ways.

Onboarding videos, language-specific help, bundles with your hosting or MSP retainers. First-line support that does not invent protocol facts. A clear link to pricing and download. You can be excellent at this and make money. You cannot later pretend it was a brand acquisition story.

Custom privacy jurisdictions you do not control. Custom server cities on demand. Store features that are not in the Klox apps. If a prospect needs those, they are a white-label or enterprise conversation, not a reseller coupon.

Allowed: your brand, your prices, your support, apps the user installs under your name, WireGuard, OpenVPN, OpenConnect, and Shadowsocks in the clients we brand, a money-back policy you actually run. Not allowed: invented audits, invented city counts you did not confirm, 'we beat the big consumer brands in newsrooms.' We will not write that, and you should not either.

Klox consumer is from $2.83 a month. That is a reference for a finished consumer SKU, not a ceiling or a floor for your brand. If you own the customer, you own the price and the refund math that comes with it. There is a whole piece in this series on not racing to $1.99. Read it before you copy a discount culture you cannot staff.

Merchant of record. Store account ownership. Data roles. Abuse routing. Incident notice. Termination and export. Public claims you may make about the network. Refund interaction (who issues). That is a folder, not a vibe. If your 'agreement' is a WhatsApp thread, you own nothing.

Cyber and E&O policies care about who faces the user. If you are controller and merchant, ask your broker. If you are a reseller, do not assume you have zero exposure; your advice can still be negligent. I am not selling insurance. I am telling you the question exists.

Write answers to: Who refunds? Who is on the card? Who is the publisher? Who is the controller? Who deletes an account? Who answers a rights request? Who pulls a node after abuse? If two of you write different names, you are not ready to spend on ads.

On a call, I ask them to refund a fake user, file a fake rights request, and show me who can push a store hotfix. The teams that can do all three in one hour own the customer. The teams that say 'our vendor handles that' for all three own a slide. Practice the drill before you spend on a launch campaign. It is cheaper than discovering the gaps in week three when a real cardholder is shouting.

I also ask for the mailbox that receives processor mail. If that mailbox is a founder Gmail with 4,000 unread newsletters, we fix that before we talk about city lists. Chargeback deadlines do not wait for inbox zero.

Ownership without a cost model is still a toy. The companion piece on white-label versus building from scratch is about where cash goes. This piece is about where liability sits. You need both before you print a launch date.