VPNInfobaseWhat the register cannot tell you about NordVPN
NordVPN’s own pages give the facts above, but three things are missing from them, and we say so instead of filling them in. No individual owner is named on its pages: it identifies Nord Security as the parent. The sixth audit is not dated on the vendor pages we could read; press coverage of Nord’s announcement puts Deloitte’s fieldwork between 10 November and 12 December 2025, and we found no report link. And the vendor’s pages returned HTTP 403 to our automated reader on 29 September, so the price and audit figures here are those recorded on 28 September.
Price: the first term is not the price
The register records the Basic plan at $14.99 a month, $5.49 a month for a 12-month first term ($65.88) and $3.49 a month for 27 months ($94.23), with the vendor stating a renewal of $139.08 a year. Averaged over 36 months with our stated method, the two-year plan comes to about $5.52 a month and the one-year plan to about $9.56. The working is on the renewal price table, which also lists the 30-day refund window and its limit: initial purchases only, not renewals.
The audits, by what they examined
Two firms are named on NordVPN’s no-logs page: PricewaterhouseCoopers in Switzerland (2018, and an assurance report issued 28 May 2020 that added obfuscated, Double VPN and P2P servers to the scope) and Deloitte for the later reviews, including a fifth report from Deloitte Audit Lithuania in 2024 under ISAE 3000 (Revised). These are assurance engagements on the no-logs claim. The register records no separate published app or infrastructure penetration test for NordVPN, which is not the same as saying none exists. See the audit tracker for how this compares with providers that publish both kinds.
One incident on record
On 21 October 2019 NordVPN disclosed that a server at a third-party datacenter in Finland had been accessed in 2018, and that a TLS key had expired but was exposed. NordVPN’s account is that its network and user data were not affected. See the entry in the incidents timeline for how it compares with other providers’ disclosures.
Ownership and jurisdiction
The NordVPN service is stated to be based in Panama and Nord Security, its parent, in Lithuania. Nord Security and Surfshark announced a merger in February 2022; Surfshark’s announcement says both will continue as autonomous companies. The ownership table has the source for each. NordVPN is the one provider we earn a commission from, disclosed here; every fact on this page comes from the vendor’s pages, auditors’ reports or named outlets.
Who it fits, going by the register fields
- Pick it if an audit history from large accounting firms matters to you, you want RAM-only servers stated by the vendor, and you accept the published renewal price.
- Look at others if you want open-source clients on every platform (the vendor states only its Linux app is open source), a published individual owner, or a renewal price close to the first-term price. Proton VPN and Mullvad are the register’s examples on open source and flat pricing.
This is our reading of the register, not a measured result.
Alternatives
- ExpressVPN: compare audits and renewal price side by side
- Surfshark: merger with Nord Security announced in 2022
- Proton VPN: non-profit shareholder and Swiss base
For a direct comparison with Mullvad, see Mullvad vs NordVPN.