NordVPN

Six Deloitte or PwC no-logs assurance checks since 2018, an obfuscation protocol for restrictive networks, and a 2018 server breach it disclosed in 2019.

Facts checked November 2026. Sources are listed at the end.

Company: nordvpn s.a. (parent company Nord Security)
Based in: Panama
Latest audit of note: Deloitte no-logs assurance, 2025 (published 2026)
Free plan: No (7-day trial in some countries)
Money-back window: 30 days

Visit NordVPN

Who it suits

People who want a large mainstream provider with a long run of repeated third-party no-logs checks, and an obfuscation protocol for networks that block VPNs.

Less suited to: Anyone who wants a free plan, or who weighs heavily how slowly the 2018 breach was disclosed.

Jurisdiction

NordVPN says it is based in and operates under the jurisdiction of Panama. Its parent company, Nord Security, is based in the Netherlands.^[1]

Audits

Deloitte Lithuania · Late 2025 (published February 2026)
Sixth no-logs assurance engagement, under the ISAE 3000 (Revised) standard. It covered standard VPN, Double VPN, Onion Over VPN and obfuscated servers and concluded that NordVPN's systems were in line with its no-logs statement.^[2]
Deloitte Lithuania · November to December 2024
Fifth no-logs assurance engagement (ISAE 3000), covering standard, Double VPN, Onion Over VPN, obfuscated and P2P servers.^[4]
PwC · 2018 and 2020
NordVPN's first two no-logs assurance engagements were carried out by PwC.^[5]

Notable incidents and changes

2018, disclosed October 2019
An attacker accessed one NordVPN server at a data center in Finland in March 2018 through an insecure remote-management system left by the data-center provider, and an expired internal private key leaked. NordVPN said the server held no user activity logs. The breach became public about a year and a half later.^[6]
2022
Nord Security and Surfshark announced a merger. Both said they would continue to operate autonomously, with separate infrastructure and product roadmaps.^[7]

Protocols

NordLynx (NordVPN's WireGuard-based protocol, the default in most of its apps), OpenVPN over UDP or TCP, and NordWhisper, built for networks that block VPNs.^[8]

Free plan, refunds and price

No free plan. New customers in some countries, including the US, UK, Canada and Australia, can get a 7-day trial on 1- and 2-year plans.^[9]

30-day money-back guarantee on new subscriptions, not renewals. Apple App Store and Amazon Appstore purchases are refunded by those stores, and retailer purchases by the retailer; Google Play purchases can be refunded through NordVPN support.^[10]

Prices change often and depend on plan length, so check NordVPN's site for current pricing.

Read the terms on NordVPN's own site before you buy.