How is the location of a sensor/endpoint determined?

Hi Sophos,

On the Sensor Location pane of the dashboard I have an Endpoint showing as being in a country I wouldn't expect it to be.

I'm not immediately concerned with the above fact, but I'm interested in knowing how Sophos calculates the location of the device - or could this be an end-user sat behind a VPN, or perhaps even a bug in the interface?

Many Thanks