Is NordVPN safe? Its logs policy, audits and security record

NordVPN is a legitimate paid VPN with a safety record you can check on paper: a written no-logs policy, six independent no-logs assurance engagements (PwC in 2018 and 2020, then Deloitte every year from 2022 to 2025), several Cure53 security assessments and, by NordVPN’s account, RAM-only servers. The record also includes a 2018 breach of one rented server in Finland, which NordVPN disclosed in 2019. None of it is a guarantee: each engagement is a point-in-time check, the full reports are open only to logged-in customers, and The VPN Deal has not tested NordVPN.

What “safe” can and can’t mean

A VPN provider handles traffic your internet provider would otherwise see, so the useful questions are: what the company records, whether outsiders have examined that, how its software has been tested and how it handled a real incident. We answer them from NordVPN’s documents and one news report, checked on 13 October 2026, without tests of our own.

“Safe” also can’t mean anonymous. A NordVPN account needs an email address, which NordVPN links to any dedicated IP or Dedicated Server, and Smart DNS stores your IP address once you activate it.

NordVPN’s no-logs policy

Does NordVPN keep logs? It says no. Its Additional Terms (updated 10 June 2026) say your “activities while using them are not monitored, recorded, logged, stored, or passed to any third party,” and its VPN privacy notice (updated 20 July 2026) says: “We do not store used bandwidth, traffic logs, IP addresses, or browsing information.”

The notice does list what NordVPN processes: the last session’s details, deleted within 15 minutes after it ends; whether you used the service in the last 90 days, kept to prevent abuse and contest unfair chargebacks; and app connection data under random identifiers that it says can’t be linked to your account. Its general privacy policy adds account details such as your email and payment information.

On legal requests, its privacy policy says, “In most cases, we have no data to share,” though a valid request naming specific identifiers, such as an email address, may require it to disclose the requested data.

Six independent no-logs assurance engagements

The final 2025 report was issued on 12 December 2025, and NordVPN published the results on 3 February 2026: “Deloitte concluded that NordVPN’s IT systems and supporting operations are designed and implemented in line with our no-logs statement.” Its scope lists standard, Double VPN, obfuscated and Onion Over VPN servers; P2P servers, listed from 2020 to 2024, aren’t named.

Each engagement is, in NordVPN’s words, “a point-in-time assessment.” The reports are available only to logged-in Nord Account users, and NordVPN doesn’t publish excerpts, so we haven’t read them. Some NordVPN pages count four or five engagements; we use six, from its latest post.

Security tests of the apps and servers

NordVPN reports these outside security tests. VerSprite tested the Android, iOS, Windows and Mac apps (published October 2019) and found 17 vulnerabilities, none critical, all fixed. Cure53 tested the desktop apps, servers and infrastructure in 2022, with every critical, high and medium finding fixed, and the apps and browser extensions from June 2024, finding “several high level” issues that were fixed. Its latest round, in May, June and October 2025, covered apps, extensions, account sign-in, core APIs, servers and infrastructure, with “no critical vulnerabilities” and high-severity findings fixed and verified by Cure53. Each result covers only the versions tested.

The 2018 server breach and the 2019 disclosure

On 21 October 2019, NordVPN disclosed that one server it rented in Finland had been breached “on or around March 5th, 2018,” through an insecure remote management account the data center had added without its knowledge. NordVPN says that access was restricted on 20 March 2018, that it learned of the breach on 13 April 2019, and that it shredded the server the same day.

NordVPN says the intruder took expired TLS keys that, under extraordinary circumstances, could have helped a targeted attack on a single user, but that “could not and cannot be used to decrypt any encrypted NordVPN traffic in any form.” It says “the intruder did not find any user activity logs because they do not exist,” and that no user credentials were affected. It explained the delay as waiting until it “could be sure that such an attack could not be replicated anywhere else on our infrastructure.”

TechCrunch, an independent news outlet, reported the same day that NordVPN “has confirmed it was hacked.” The statements about what wasn’t exposed are NordVPN’s own.

NordVPN then ended the data-center contract and promised outside testing, a bug bounty, colocated servers and RAM servers, and later posts report each one being introduced. A promised full independent security audit in 2020 isn’t confirmed by any official post we found.

A later claim NordVPN has addressed

In January 2026, NordVPN denied an alleged breach of its “Salesforce” development servers. Its 5 January statement said there were “no signs that NordVPN servers or internal production infrastructure have been compromised,” and that the leaked files came from a third-party platform it had briefly used on a trial account, where “no real customer data” was uploaded. That is NordVPN’s account of an allegation; it called its investigation continuing, and we haven’t verified either side.

Servers, protocols and post-quantum encryption

NordVPN’s Trust Center says its servers keep all data in RAM, which is wiped when a server powers off, and that “a big chunk” of its servers are run by its own team alongside partner-hosted ones. Its WireGuard-based NordLynx protocol is “used by default in most of our apps.”

Post-quantum encryption is a setting you switch on in the Windows, macOS, Linux, Android, iOS, tvOS and Android TV apps. It works with NordLynx only, and is disabled with a dedicated IP, other protocols, obfuscated servers or Meshnet. NordVPN also says it keeps DNS queries inside the VPN tunnel; a DNS leak test shows what your own device does.

Jurisdiction: a Panama provider with a Lithuanian parent

NordVPN’s terms (updated 10 August 2026) name the provider as nordvpn S.A., with an address in Panama City, and apply Panama law except where a customer’s country, such as an EU member state, requires its own consumer law. The parent, Nord Security, is headquartered in Lithuania; our page on who owns NordVPN covers the group. We treat NordVPN’s claims about Panama’s data-retention rules as company statements, not verified law.

Is NordVPN legit, and is it worth it?

It is legit in the plain sense: a service running since 2012, with published terms, named auditors and a 30-day money-back guarantee on eligible first purchases. Whether it is worth it is a question of fit. NordVPN allows 10 simultaneous connections and documents app split tunneling on Windows and Android, but not on Mac or iPhone. Basic costs $94.23 for the first 27 months, then $139.08 a year. Our NordVPN review weighs those features, and the NordVPN price guide compares every plan.

Common questions

Does NordVPN keep logs?

NordVPN says it doesn’t store your activity, traffic logs, IP addresses or browsing information. It does keep brief session details, whether you used the service in the last 90 days and your account data, and a dedicated IP, Dedicated Server or Smart DNS ties more to your account.

Has NordVPN been hacked?

One rented server in Finland was breached in 2018, and NordVPN disclosed it in October 2019. NordVPN says no user activity logs or credentials were exposed and that the stolen keys couldn’t decrypt VPN traffic. In January 2026 it denied a separate alleged breach.

Is NordVPN worth it?

It depends on fit: 10 simultaneous connections, app split tunneling on Windows and Android, and $94.23 for 27 months before a $139.08 yearly renewal. If those suit you, compare the plans before buying.