What this guide checks, and what it does not
This guide sets out only facts you can verify: ownership, jurisdiction, NordVPN's own statements about logging, a documented security incident, and the safety settings NordVPN and GL.iNet document. We have not tested NordVPN, and we do not aggregate user reviews or speculate. NordVPN's main website, including its pricing and Trust pages, returned an access error to our checker on 30 October 2026. We therefore do not summarise audit reports or certifications. Its support centre and the other sources below loaded normally.
| Question | What the record shows | Source |
|---|---|---|
| Who runs NordVPN? | Nord Security, based in the Netherlands | [1][2] |
| What jurisdiction? | Panama, which NordVPN says has no mandatory data retention law | [1] |
| Logging claim | Says it does not keep records of what you browse or when you connect | [4] |
| Known incident | One rented server in Finland accessed in March 2018, disclosed October 2019 | [5] |
| Related brands | Surfshark merged with Nord Security under one holding company in 2022 | [3] |
| Independent audits | Not verified for this guide | See the FAQ |
Ownership and jurisdiction
NordVPN's support centre says the service is based in, and operates under the jurisdiction of, Panama. It names Nord Security as the parent company, based in the Netherlands, and says Panama has no mandatory data retention law. [1] Nord Security's timeline begins in 2012 with 'Launched NordVPN as a Windows configuration'. Later entries include the NordLynx protocol in 2020, a first outside funding round at a 1.6 billion dollar valuation in 2022, and another 100 million dollar round in 2023. Its product list includes NordVPN, NordLayer, NordPass, NordLocker, NordStellar, Coveron and Saily. [2]
Surfshark's own about page says that in 2022 Surfshark and Nord Security merged under one holding company and continue to operate independently. [3] This matters if you are comparing the two as independent alternatives: they share an owner.
The 2018 server incident
On 21 October 2019 TechCrunch reported that NordVPN had confirmed one of its data-centre servers was accessed in March 2018. The server was rented from an unnamed provider in Finland and had been active for about a month. The attacker got in through an insecure remote management system that the provider had left in place, which NordVPN said it did not know about. [5]
According to the report, NordVPN said an expired internal private key was exposed but could not have been used to decrypt VPN traffic on any other server. It said the server held no user activity logs, that no user credentials were exposed, and that no other server on its network was affected. NordVPN said it learned of the breach months before disclosure and waited to be sure its infrastructure was secure. [5] The TechCrunch report does not list the specific changes NordVPN made afterwards, and this guide does not describe them; NordVPN's own statement on nordvpn.com is the place to check.
What NordVPN says about logging and safety features
NordVPN's feature summary says it 'does not keep records of what you browse, when you connect, or your personal data while you use the service'. That is NordVPN's own claim; we have not verified it independently. The same page describes a kill switch, Double VPN, dedicated IP, obfuscated servers and Meshnet. [4]
The kill switch differs by platform. Windows has an Internet Kill Switch, which cuts the connection when NordVPN disconnects, and an App Kill Switch, which closes chosen apps. Android 8.0 and later has a system-wide Kill Switch. The iOS and macOS App Store versions use VPN bypass prevention, which forces covered traffic through the tunnel. The Linux client is switched with 'nordvpn set killswitch on'. [6] Obfuscated servers now run on NordWhisper rather than OpenVPN, and NordVPN says you can no longer reach them with a manual OpenVPN connection. [8]
Configuring it safely while travelling
Captive portals on hotel and airport Wi-Fi are one documented conflict between a VPN and travel networks. NordVPN's own instructions are to turn off Auto-connect and Kill Switch, disconnect, log in to the portal, then reconnect and turn both back on. It warns that Kill Switch blocks the portal page from appearing. [7] On a GL.iNet travel router running firmware v4.8 or later, each tunnel's kill switch is on by default once the tunnel is active. Enhanced Kill Switch in Policy Mode blocks any traffic that matches no tunnel. [9]
- Turn on the kill switch for your platform: Internet Kill Switch on Windows, Kill Switch on Android 8.0+, VPN bypass prevention on iOS and the App Store macOS app. [6]
- For a captive portal, disable Auto-connect and Kill Switch, log in, reconnect, then re-enable both. [7]
- On restrictive networks use obfuscated servers in the app; they are not reachable over a manual OpenVPN setup on a router. [8]
- On a GL.iNet router, set up the VPN client first, then confirm the tunnel kill switch is on; consider Enhanced Kill Switch if nothing should leave unencrypted. [9]
- Buy direct and note the 30-day money-back window, which covers only the first purchase. [10]
Who should look elsewhere
If you need a provider that is independent of the Nord Security group, Surfshark is not one, because the two merged under one holding company in 2022. [3] If your safety decision depends on independent audit reports, read them on NordVPN's own site and check who ran each audit, its scope and its date before you subscribe. Use the refund window to test the service on your own networks rather than relying on any single review. NordVPN says the 30-day guarantee applies to new subscriptions, not renewals. [10]
Questions before you decide
Was NordVPN ever hacked?
TechCrunch reported on 21 October 2019 that NordVPN confirmed one of its rented servers in a Finnish data centre was accessed in March 2018 through an insecure remote management system left by the provider. NordVPN said the server held no user activity logs, no user credentials were exposed, and no other server was affected.
Where is NordVPN based?
NordVPN's support centre says it operates under the jurisdiction of Panama and that its parent company, Nord Security, is based in the Netherlands. It says Panama has no mandatory data retention law.
Is NordVPN owned by the same company as Surfshark?
Surfshark says that in 2022 it and Nord Security merged under one holding company and continue to operate independently. Surfshark says it is based in the Netherlands.
Has NordVPN been independently audited?
NordVPN's main website blocked our checker on 30 October 2026, and its support centre pages we read do not cover audits. We therefore do not describe any audits here. Read the audit reports on NordVPN's own site and note who ran each one, its scope and its date before relying on them.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- NordVPN Support: Where is NordVPN based Accessed 30 Oct 2026
- Nord Security: About us Accessed 30 Oct 2026
- Surfshark: About us Accessed 30 Oct 2026
- NordVPN Support: What features does NordVPN have? Accessed 30 Oct 2026
- TechCrunch: NordVPN confirms it was hacked (Zack Whittaker, 21 October 2019) Accessed 30 Oct 2026
- NordVPN Support: NordVPN Kill Switch, how does it work Accessed 30 Oct 2026
- NordVPN Support: How to log in to a captive portal Wi-Fi network while using NordVPN Accessed 30 Oct 2026
- NordVPN Support: NordVPN Obfuscated Servers are getting an upgrade - what changed? Accessed 30 Oct 2026
- GL.iNet Router Docs 4: VPN Kill Switch (Block Non-VPN Traffic) Accessed 30 Oct 2026
- NordVPN Support: What is your refund policy? Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.