A named Deloitte assurance report, a previously unreported Panamanian warrant, and where NordVPN’s evidence trail actually holds up
Can NordVPN’s central promise, that it does not keep the records that would let anyone reconstruct what a user did online, be trusted?
The evidence answers this in two different registers.
The technical core of that promise is backed by a named, scoped, independently produced Deloitte reasonable-assurance report, not by marketing language. The corporate and legal periphery of the same promise, who ultimately controls the company, and what happens when a government compels disclosure, rests largely on NordVPN’s own account of itself.
This investigation treats those two registers separately. Collapsing them into a single verdict would misrepresent what the evidence actually supports.
We evaluate NordVPN across the same five lenses used throughout STACK’s privacy investigations: what it says it collects (Privacy Model), what evidence supports those claims (Trust Architecture), how strong that evidence actually is (Evidence Architecture), where personal data touches the business beyond the VPN tunnel (Privacy Surface), and how the claims have held up under scrutiny (Criticisms).
Privacy model
A narrow, verifiable core
NordVPN’s privacy model is best understood as a narrow, verifiable core surrounded by a wider, unverified periphery.
NordVPN states it does not store internet traffic logs, connection logs, or online-activity information. Its transparency report confirms that when required to produce these categories, it had none to hand over, because it does not collect them.
The account data it does collect is limited and specific, as documented by Deloitte: email address, encrypted password, basic billing information, and order history.
Even the operational telemetry the service does retain is minimized. Authentication servers count successful connections only in aggregate, without IP addresses, identities, or activity, and session data is deleted within 15 minutes of a session ending.
That distinction matters: a privacy model built around not collecting data in the first place is structurally harder to compromise than one built around promising to protect data once it exists. The evidence reviewed supports placing NordVPN’s model in the first category, for the systems Deloitte examined.
Where the audited core ends
The audited scope excludes dedicated IP servers, SmartDNS, physical security testing, and the security measures protecting data and systems generally.
For any claim about those areas, a reader is relying on an unaudited company statement, rather than the same standard of evidence that supports the core.
Trust architecture
The most consequential fact in this investigation is that NordVPN’s central privacy claims do not rest on self-report alone.
A Deloitte reasonable-assurance report, a higher standard than limited assurance, names NordVPN S.A. specifically, states an audit period, and describes procedures and scope limitations in detail. That specificity is what elevates these claims above ordinary marketing copy: a reader, or a future auditor, has something concrete to check the claims against.
Reasonable assurance from a recognized firm is one of the few mechanisms available to a privacy company to make a “trust us” claim independently checkable. Deloitte’s report is the mechanism doing that work here. (See how VPN audits work for what reasonable-assurance engagements do and don’t establish.)
Two claims that remain unverified, not false
The Deloitte report is available only through a third-party mirror, not a confirmed Deloitte-hosted original. Its provenance has not been independently established, even though its content and structure are consistent with a genuine engagement.
The disclosed Panamanian warrant, under which NordVPN states it provided only payment-related data and confirmation that an account existed, is corroborated by no court record or independent legal source. It exists only as NordVPN’s own account of a legal-compulsion event.
Strategic incentives
Nord Security, NordVPN’s reported parent company, is described in Reuters-distributed reporting as having raised $100 million at a $1.6 billion valuation, giving it a commercial stake in protecting the no-logs reputation it has invested in validating.
That reinforces, without proving, the durability of these practices. The evidence available does not establish the full ownership and control chain above Nord Security, including any relationship to Tesonet raised in third-party commentary. The incentive picture above the parent company can’t be fully assessed from this evidence.
Evidence architecture
The strength of this investigation rests on treating its evidence in tiers, rather than as a single undifferentiated pool.
The Deloitte reasonable-assurance report is the strongest evidence available: commissioned by NordVPN, but specific, scoped, and procedurally described rather than a general endorsement.
Official NordVPN statements, its support pages and transparency report, are high-confidence first-party sources, but this investigation treats them as distinct from independent verification.
Independent journalism, Reuters on Nord Security’s funding, Engadget and The Verge on the 2018 Finland incident, corroborates that these events occurred, though it doesn’t independently verify NordVPN’s internal architecture.
Cybernews’s ownership commentary is treated here as explicitly non-authoritative, used only to flag that an ownership question exists, not to answer it.
The investigation’s conclusions, in the end, can only be as strong as the weakest evidence they lean on. Where this investigation reaches high confidence, it’s because the evidence tier supporting that claim is strong. Where it reaches only moderate confidence, or flags an unknown, the underlying evidence tier is weaker, and this investigation says so explicitly, rather than borrowing confidence from a stronger claim nearby.
What remains missing from the record
Corporate registry confirmation for NordVPN S.A. and Nord Security. A confirmed original hosting location for the Deloitte report. Independent legal records for the warrant. Any independent forensic account of the 2018 incident against which NordVPN’s own description could be checked.
Privacy surface
Data enters the system narrowly. Account creation collects only the fields Deloitte identified, and connecting to the VPN generates aggregated, non-identifying connection counts and short-lived session data.
How data is held
Data is held under conditions designed to minimize what could be exposed. NordVPN states it retains full infrastructure control and has not granted third-party access to user traffic. Deloitte’s report adds that VPN servers run on RAM, losing data immediately on power loss, with logging disabled at both the container and service level.
This matters because an architecture that structurally cannot retain traffic data is a stronger privacy guarantee than a policy promise not to look at data that could technically be retained.
Two documented departures from the system
Data has left the system on at least two documented occasions, in different ways.
Under the binding Panamanian warrant, NordVPN states only payment-related data and account-existence confirmation were disclosed. In the 2018 Finland incident, a rented third-party server was compromised; NordVPN states it held no user activity logs, and independent reporting describes the incident as isolated or limited, though sources don’t offer identical technical detail on any potential monitoring.
Both events matter because they are the closest this investigation comes to a real-world test of the privacy model, rather than a description of intended behavior.
What remains unverified
The unverified surface corresponds exactly to what sits outside the Deloitte scope: dedicated IP servers, SmartDNS, physical security, and any product beyond the audited core.
Criticisms
No material criticism in the evidence reviewed contradicts NordVPN’s core privacy claims. The criticisms that do apply are about the limits of verification, and they’re legitimate on the evidence supplied.
Ownership remains incompletely mapped
Official sources stop at Nord Security. Non-authoritative third-party commentary raises a further Tesonet layer without resolving it.
A reader cannot currently determine the complete chain of control above the entity that operates the service. (Readers seeking a fuller treatment of this question can consult who owns NordVPN?)
The Deloitte report’s provenance is unconfirmed
It is the strongest evidence in this investigation, but it is accessed through a mirror, not a confirmed original source. Provenance, not just content, is part of what makes evidence independently verifiable.
The Panamanian warrant is unverifiable outside NordVPN’s own statement
This is precisely the kind of adversarial, real-world event where independent corroboration would carry the most weight, and none is available in the evidence reviewed for this investigation.
The 2018 incident’s technical impact is not fully resolved
NordVPN and independent reporting agree on the basic facts, but differ in technical granularity regarding potential traffic monitoring. This leaves a narrow but real gap between “this incident occurred and was contained” and “we know precisely what was and was not exposed.”
The audit’s scope is bounded
Dedicated IP servers, SmartDNS, physical security, and general data and systems security fall outside Deloitte’s review. This draws a hard line around how far the strongest evidence in this investigation can be extended.
STACK view
Across every layer of analysis, the evidence produces a consistent pattern: strength at the technical core, caution at the corporate and legal edges.
The architecture is the strongest layer, and it’s where this investigation can speak with the most confidence. RAM-only servers, disabled logging, minimal account-data retention, and short session lifetimes are independently described by Deloitte, not just claimed by NordVPN.
Above that sits a well-capitalized parent company. Nord Security’s reported $100 million raise at a $1.6 billion valuation reflects a business operating in a competitive privacy-technology market, though this investigation doesn’t extend into a full analysis of that market.
The incentive picture that raise implies is only partially resolved. A funded parent has clear commercial reason to protect a validated no-logs reputation, but the incomplete ownership chain above Nord Security means the full incentive structure can’t be assessed from the evidence available here.
Operational reality offers something more concrete than any of that: the company has actually been tested, twice, once by the 2018 breach, once by the 2024 warrant, and in both cases the basic facts of NordVPN’s own account are corroborated externally, even where full technical or legal detail is not.
And the way NordVPN communicates about itself has shifted over time, toward more specific, primary-derived documentation. This investigation treats that shift as a genuine strengthening of the evidentiary record, not a communications exercise.
Conclusion
The evidence justifies confidence in NordVPN’s core privacy claims: no traffic logging, no identity-linked connection logging, minimal account-data retention, RAM-only architecture, and disabled service-level logging are all supported by a named, scoped, independently produced assurance report, not by NordVPN’s word alone.
The no-logs and infrastructure-configuration claims sit on the strongest ground here, independently confirmed rather than simply asserted. The same confidence extends to the existence and basic facts of the 2018 Finland incident and to the transparency-report disclosures. The stated Panama jurisdiction and Nord Security parent relationship belong in this group too, though they remain company statements rather than independently verified facts.
Two things sit on thinner ground. The completeness of the ownership and control chain above Nord Security isn’t established by the evidence reviewed here, and the precise technical effect of the 2018 incident is harder to pin down, since NordVPN’s own account and independent reporting don’t offer identical granularity.
The evidence does not resolve, and this investigation does not claim to resolve, the full corporate ownership structure, the confirmed original source of the Deloitte report, any independent legal record of the Panamanian warrant, or the privacy and logging boundaries of products outside the audited core.
Readers whose primary concern is whether their VPN traffic and connection activity are logged have a strong, independently grounded basis for trust. Readers concerned with full corporate accountability, or with products beyond the core VPN service, are working with a materially thinner evidentiary base, and should treat NordVPN’s claims in those areas as company statements pending further verification.
Related investigations
Who owns NordVPN?
How VPN audits work
How RAM-only servers work
Is ExpressVPN private?
Is Proton VPN private?
Is Mullvad private?
Methodology
This investigation is based on a Deloitte reasonable-assurance report on NordVPN S.A.’s systems, NordVPN’s own privacy policy, support documentation and transparency report, independent journalism (Reuters, Engadget, The Verge), and third-party ownership commentary treated as non-authoritative.
Claims sourced solely to NordVPN’s own documentation, and the disclosed Panamanian warrant sourced only to NordVPN’s own account, are identified as such throughout.