NordVPN is a legit VPN from Nord Security, running since 2012, and its no-logs policy has been checked by PwC and later Deloitte in several audits. It isn't flawless: a server it rented in Finland was breached in 2018 and it was criticised for slow disclosure, and UK ad regulators have ruled against some of its marketing claims.
NordVPN is everywhere: YouTube sponsorships, podcasts, browser pop-ups. When something's that heavily advertised, I always want to know what's behind the marketing. Here's what the public record says about who runs it, how its privacy promises have been checked and where it's slipped up.
Who runs NordVPN
According to Wikipedia, NordVPN was founded in 2012 by Eimantas Sabaliauskas and Tomas Okmanas and is developed by Nord Security. It's described as a Lithuanian VPN service incorporated in Panama, with offices in Lithuania, the UK, Panama and the Netherlands.
The Panama incorporation is part of its privacy pitch, since VPN companies like to sit outside countries with heavy data-retention rules. The company behind it, though, is a large, well-known business rather than an anonymous app.
What a VPN like NordVPN does and doesn't do
A VPN encrypts the traffic between your device and the VPN's server and hides your IP address from the sites you visit. It's useful on public Wi-Fi, when travelling, or when you'd rather your internet provider didn't see every site you open.
It doesn't make you anonymous, it doesn't stop you being tracked by accounts you're logged into and it isn't antivirus. That last point matters because of the ad rulings below.
NordVPN's no-logs audits
A VPN's most important promise is that it doesn't keep logs of what you do. You can't check that yourself, so independent audits matter. Wikipedia says PricewaterhouseCoopers verified NordVPN's no-logs policy in 2018 and audited it again in 2020, and Deloitte carried out no-logs audits in 2022, 2023 and 2024.
Repeat audits by big firms are a good sign. They're snapshots, though, not round-the-clock monitoring, so they reduce the risk rather than remove it.
| What I checked | What the record shows |
|---|---|
| Who makes it? | Nord Security; founded in 2012 |
| Where is it incorporated? | Panama, with offices in several countries |
| Has the no-logs policy been audited? | Yes, by PwC and Deloitte in several years |
| Has it been breached? | A rented server in Finland was compromised in 2018 |
| Any ad rulings? | Yes, the UK ASA ruled against claims in 2019 and 2023 |
The NordVPN server breach
In 2018, Wikipedia says, a NordVPN server in Finland was compromised through a weakness in the remote management system of the data centre it rented from. The data centre told NordVPN in 2019, and it became public later that year after a security researcher raised it on Twitter.
Critics said NordVPN was slow to tell customers. Experts quoted on Wikipedia said no user credentials or billing details appeared to have been compromised. It's a useful reminder that even big providers rely on third-party data centres.
NordVPN's advertising and the ASA
The UK's Advertising Standards Authority has stepped in twice. In 2019 it told NordVPN not to repeat claims that using public Wi-Fi is like handing out your personal information, noting that HTTPS already provides a significant layer of security. In 2023 it ruled against an advert claiming NordVPN could switch off malware, which the company hadn't backed up.
So take the scarier marketing with a pinch of salt. A VPN is a privacy tool, not a shield against every threat.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
NordVPN and law enforcement requests
In 2022, according to Wikipedia, NordVPN said it would comply with law enforcement requests when local legal authorities required it, while keeping its no-logs policy. Some privacy advocates raised concerns. In practice, a no-logs VPN can only hand over what it keeps, which is why the audits matter.
NordVPN versus free VPN apps
Part of the reason people ask whether NordVPN is safe is that the VPN world is full of free apps with no clear owner. A free VPN still has to fund its servers somehow, and some do it by collecting and selling data or showing heavy advertising. A paid service with a named company, published policies and repeat outside audits is easier to hold to account. That doesn't mean every paid VPN is trustworthy, but it does give you something to check rather than a promise on an app store page.
Using NordVPN safely
- Download it only from NordVPN's official website or official app stores; fake VPN apps are common.
- Use a strong, unique password and turn on two-step verification for your account.
- Keep the app updated.
- Don't treat it as antivirus; keep your device's security tools running.
- Read the cancellation and refund terms before you buy a long plan.
If you're comparing providers, my Surfshark versus NordVPN comparison sets the two side by side. For locking down the rest of your accounts, my look at two popular password managers covers password managers, which do more for most people's day-to-day security than any VPN.
So, is NordVPN safe?
NordVPN is a legit, established VPN with repeated independent no-logs audits, which puts it ahead of many free VPN apps. Its 2018 breach and its advertising rulings are worth knowing about, and its marketing overstates what any VPN can do. Use it for privacy, keep your other defences in place and buy it from the official site.
Frequently asked questions
Who owns NordVPN?
NordVPN is developed by Nord Security. It was founded in 2012 by Eimantas Sabaliauskas and Tomas Okmanas, according to Wikipedia.
Has NordVPN's no-logs policy been audited?
Yes. Wikipedia says PwC audited it in 2018 and 2020, and Deloitte carried out audits in 2022, 2023 and 2024.
Was NordVPN hacked?
A server NordVPN rented in Finland was compromised in 2018 through a data centre weakness. Experts said no user credentials or billing details appeared to be affected.
Does NordVPN protect against malware?
Not in the way antivirus does. The UK ASA ruled against a NordVPN ad in 2023 that claimed it could switch off malware without backing it up.
Where is NordVPN based?
Wikipedia describes it as a Lithuanian VPN service incorporated in Panama, with offices in Lithuania, the UK, Panama and the Netherlands.
