NordVPN

Is NordVPN safe?

Yes, for what a VPN is meant to do. NordVPN encrypts your traffic between your device and its servers, which hides it from café Wi-Fi, your internet provider and anyone else on the local network. Its claim that it keeps no logs of what you do has been checked six times by outside assessors. We score it 79/100.

That is below privacy tools such as DuckDuckGo and Proton Mail, both on 85. NordVPN had a server breach in 2018 that it disclosed 18 months later, its app links a user ID to its own marketing, and it is facing a run of US lawsuits over subscription renewals.

Does NordVPN really keep no logs?

The evidence is better than for most VPNs. NordVPN's first independent no-logs assessment was in 2018, followed by others in 2020, 2022 and 2023. The fifth, by Deloitte Audit Lithuania under the ISAE 3000 standard, ran from 18 November to 20 December 2024. Deloitte's staff interviewed employees, inspected server configurations and technical logs, and reviewed standard VPN, Double VPN, Onion Over VPN, obfuscated and P2P servers. A sixth, again by Deloitte, ran from 10 November to 12 December 2025.

Two limits apply. These are point-in-time checks, not live monitoring. And the full reports are only available to customers who log in, so the public sees NordVPN's summary rather than the report itself.

The app collects more than the VPN service promises to. Apple's label shows your email address and user ID linked to you, with the user ID used for NordVPN's own advertising and marketing as well as analytics. Google Play says no data is shared with third parties, and lists optional analytics on app interactions and the other apps installed on your phone.

What happened in the 2018 breach?

In March 2018 an intruder accessed a server NordVPN leased from a datacentre in Finland, using an insecure remote management account the provider had added without telling NordVPN. The attacker took TLS keys from the server. NordVPN first described them as expired; they were valid at the time and expired in October 2018. The company said the server held no user activity logs and the keys could not decrypt traffic on other servers.

The bigger problem was timing. NordVPN only disclosed the breach in October 2019, about 18 months after the intrusion. The datacentre had removed the account but never told NordVPN about the break-in. It ended the contract with the datacentre and says no other servers were affected. In January 2026 a forum post claimed a new breach. NordVPN denied it and said the data was dummy content from a vendor's trial environment, and we found no evidence that customer data was taken.

On encryption, NordVPN now offers post-quantum protection in all its apps (Linux in September 2024, the rest in 2025), switched on in the connection settings with the NordLynx protocol.

The renewal lawsuits

CourtListener lists at least seven proposed class actions against NordVPN S.A. or Nord Security still open in US federal courts in October 2026. They were filed in California, Colorado, New York, Illinois, Massachusetts, Virginia and Connecticut between 2024 and April 2026. The complaints allege that automatic renewal terms were not clearly disclosed and that cancelling was made difficult. These are allegations; none has produced a ruling against the company that we could find, and we found no regulator fine.

How to use NordVPN safely

1. Turn off automatic renewal in your Nord Account after you subscribe if you do not want to be charged again, and check the renewal price before you pay, since App Store plans of the same length are listed at different prices.
2. Turn on post-quantum encryption in the connection settings and use the NordLynx protocol.
3. Use it on public Wi-Fi and networks you do not control, where it helps most. At home on your own network the gain is smaller.
4. Remember what a VPN does not do. It does not stop phishing, malware you install yourself, or tracking by sites you log in to.
5. Parents relying on router or school filters should know a VPN can bypass them.

How we scored it

NordVPN's strongest factors are privacy, scams and harmful content, and regulatory record (82 each), helped by six no-logs assessments and no fines. Its weakest is transparency and control (72), because audit reports sit behind a login and renewal practices are under legal challenge. Security (78) reflects the late-disclosed 2018 breach.