NordVPN vs Xeovo

Compare NordVPN and Xeovo on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: ExpressVPN

NordVPN

Lithuania· VPN Services

Needs review

Shortlist NordVPN when you want a polished multi-platform VPN with NordLynx performance, a very large RAM-only network, Meshnet, and in-app Threat Protection backed by repeated Big Four no-logs engagements. Skip when you need a pure EU data controller, fully public audit PDFs and subprocessors, anonymous numbered accounts, unlimited devices, or self-host—consider Mullvad or Proton VPN instead (and NordLayer for managed business access).

NordLynx (WireGuard-based)RAM-only serversMeshnetThreat ProtectionNo-logs audits (Big Four)EU group (LT HQ)

View listing Visit Website

Xeovo

Finland· VPN Services

Needs review

Shortlist Xeovo when you need a Finnish EU operator with WireGuard/OpenVPN plus a real stealth-proxy toolkit (AmneziaWG, multi-protocol obfuscation, Hysteria 2) and cash/crypto payment options. Skip when you require independent no-logs audits, port forwarding, dedicated IPs, or streaming reliability—prefer Mullvad or Proton VPN instead.

Finnish Xeovo OyWireGuard + OpenVPNStealth proxies + AmneziaWGCash & crypto paymentsAnnual transparency reports

View listing Visit Website

Highlighted rows differ between the two products.

NordVPN vs Xeovo: Snapshot
Feature	NordVPN	Xeovo
Country of origin	Lithuania	Finland
Category	VPN Services	VPN Services
Open source	No	No
Self-hosted	No	No
Headquarters	Lithuania	Finland
Legal entity	nordvpn S.A. (Panama) as consumer data controller; NordSec B.V. (Netherlands) EEA representative; Nord Security group HQ Lithuania	Xeovo Oy (reg. no. 3233901-7), Rautiontie 5G 30, 00640 Helsinki, Finland
Governing law	Privacy policy references GDPR and UK DPA among other regimes; confirm Terms of Service for contract law	Finnish courts for unresolved disputes (terms of service)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Global VPN egress: vendor-stated 8,900+ RAM-only servers across 224+ locations; mix of Nord-managed colocated hardware and partner-hosted servers. Trust Center describes multi-cloud security for operational infrastructure (providers not fully named on public pages reviewed). Account, billing, and support data paths per privacy policy under Panama controller.	No public infrastructure/subprocessor register. Privacy policy claims stored personal data is not transferred outside the EEA. VPN and stealth exit nodes on status.xeovo.com include EU/EEA locations plus Australia, Brazil, Canada, Japan, Singapore, South Korea, and multiple US cities. Payment rails include global card networks, PayPal, and crypto; Xeovo states it does not store full card data.
Summary	Lithuanian Nord Security consumer VPN: NordLynx (WireGuard-based), large RAM-only network, Meshnet, Threat Protection, and audited no-logs claims under a Panama data controller.	Finland-based Xeovo Oy VPN with WireGuard/OpenVPN plus stealth proxies (Shadowsocks, AmneziaWG, VLESS/VMess/Trojan, Hysteria) for censorship resistance, no-logs policy claims, and privacy-friendly payments.
Tags	privacy vpn no-logs nordlynx meshnet	privacy vpn no-logs finland wireguard censorship-bypass stealth-proxy

At a glance: NordVPN vs Xeovo
At a glance	NordVPN	Xeovo
Group HQ	Nord Security — Lithuania	Not listed
Data controller (consumer)	nordvpn S.A., Panama	Not listed
EEA representative	NordSec B.V., Amsterdam	Not listed
Founded	2012	Not listed
Network (vendor)	8,900+ servers / 224+ locations; RAM-only	Not listed
Simultaneous devices	Up to 10 (router = 1 slot)	Not listed
Self-host	No (managed SaaS VPN)	No (SaaS VPN)
Open source	Partial (Linux client components); service proprietary	No (uses open protocols; service not OSS)
HQ	Not listed	Helsinki, Finland (Xeovo Oy)
Legal entity	Not listed	Xeovo Oy, reg. 3233901-7
Timeline	Not listed	Public product history from April 2016
Protocols	Not listed	WireGuard, OpenVPN, AmneziaWG, Shadowsocks, VLESS/VMess, Trojan, Hysteria 2
Network	Not listed	~27 countries / ~60 servers (vendor); live status map
Commercial model	Not listed	Prepaid subscription; 5 devices; 30-day refund (limits apply)

Key capabilities: NordVPN vs Xeovo
Key capabilities	NordVPN	Xeovo
NordLynx (WireGuard-based)	Yes	Not listed
RAM-only servers	Yes	Not listed
Meshnet	Yes	Not listed
Threat Protection	Yes	Not listed
No-logs audits (Big Four)	Yes	Not listed
EU group (LT HQ)	Yes	Not listed
Finnish Xeovo Oy	Not listed	Yes
WireGuard + OpenVPN	Not listed	Yes
Stealth proxies + AmneziaWG	Not listed	Yes
Cash & crypto payments	Not listed	Yes
Annual transparency reports	Not listed	Yes

NordVPN

NordLynx (WireGuard-based) plus fallback protocols
Default high-speed path uses NordLynx, Nord’s WireGuard implementation with a double-NAT design meant to preserve performance while limiting server-side identifiers. OpenVPN and IKEv2 remain available on many clients; NordWhisper targets hard-to-reach networks. Benefits travelers and latency-sensitive users; confirm protocol availability per OS and router firmware.
Large RAM-only network with specialty servers
Trust Center figures cite 8,900+ servers in 224+ locations, RAM-only memory so power-off wipes volatile state, and a mix of Nord-managed colocated hardware plus partner-hosted nodes. Specialty modes include Double VPN, Onion over VPN, obfuscated servers, and P2P nodes—useful when a single hop is not enough or when ISP shaping blocks standard VPN fingerprints.
Threat Protection and in-app security extras
Beyond the tunnel, NordVPN bundles Threat Protection (and Pro variants by plan and platform) to block malicious sites, trackers, ads, and scan downloads for malware, plus Dark Web monitoring and other digital-security tools marketed as an all-in-one app. Ideal when end users will not install a separate browser stack; feature depth still varies by OS and subscription tier.
Meshnet encrypted peer networking
Meshnet creates NordLynx-encrypted links between devices for remote file access, private gaming LANs, and routing traffic through a trusted peer without opening ports on the public internet. Typical limits: about ten devices on your account plus dozens of external peers—evaluate current caps in-app. Complements but does not replace a full site-to-site business VPN product.
Ten-device multi-platform coverage with kill switch
Official apps span desktop, mobile, TV platforms, routers, and browser extensions, with kill switch, split tunneling, and private DNS inside the tunnel on supported clients. One account covers up to ten simultaneous connections (router setup protects the whole LAN as one slot). Suits households and freelancers; teams needing admin policy should look at NordLayer.

Xeovo

WireGuard and OpenVPN with published crypto details
Official features page documents WireGuard (ChaCha20/Poly1305, Curve25519; ports 51280/53/80/443, AmneziaWG configs) and OpenVPN (AES-256-GCM, TLS 1.3, TCP 443 and UDP 1196). Suits teams that want modern defaults without proprietary tunnels—still validate leaks on your OS stack.
Stealth proxies for DPI and censorship resistance
Shadowsocks (+ v2ray plugin), VLESS/VMess (WS+TLS), Trojan (TLS/WS+TLS), AmneziaWG, and Hub-announced Hysteria 2.0 for networks that block plain VPN. Subscription generators target tested third-party clients; no SOCKS5. Availability claims for restricted countries are vendor status-matrix based.
Config generator, custom DNS, optional ad/tracker block lists
Built-in generators produce VPN and stealth subscription configs. WireGuard/AmneziaWG/OpenVPN can use custom DNS or Xeovo’s ad/tracker-blocking DNS (lists such as pgl.yoyo.org, AdAway, oisd). Useful for power users; block lists may break some sites.
Compact multi-region map with live P2P labels
Marketing cites ~27 countries / ~60 servers with quality-over-quantity positioning. status.xeovo.com shows per-node health and which VPN/stealth locations allow P2P. Five concurrent devices, unlimited bandwidth marketing, IPv6, WireGuard kill-switch—no port forwarding or dedicated IPs.
Privacy-oriented payments and optional email accounts
Accepts cash, Monero, Bitcoin, and Litecoin alongside cards and PayPal. Registration needs a username/password; email is optional for recovery and billing notices. Prepaid plans with a one-time 30-day money-back window (crypto refunds excluded per terms).

Assurance & compliance: NordVPN vs Xeovo
Assurance & compliance	NordVPN	Xeovo
Independent security / no-logs audit	Vendor claimed Multiple ISAE 3000-style no-logs assurance engagements announced (PwC AG Switzerland historically; Deloitte Audit Lithuania for recent cycles including end-2024). Full reports typically require Nord Account login; EuropeanStack did not re-download gated PDFs.	Not found Privacy policy claims detailed no-logs; annual Hub transparency reports are first-party only. No public third-party audit PDF located.
ISO 27001	Not found No clear public ISO 27001 certificate for the consumer NordVPN service on Trust Center pages reviewed (sibling products may differ).	Not found
SOC 2 / SOC 3	Not found No public SOC 2/3 report located for consumer NordVPN during this research pass.	Not found
GDPR / EU data protection	Partial Policy asserts GDPR applicability; EEA representative NordSec B.V. (NL); group HQ Lithuania. Controller is nordvpn S.A. (Panama)—document transfers and representative arrangement in your DPIA.	Vendor claimed Finnish controller Xeovo Oy; privacy policy cites GDPR and Finnish DPA (tietosuoja.fi); claims no transfer of stored personal data outside EEA.
US CLOUD Act exposure (indicative)	Partial No known US parent. Medium/partial assessment: multi-cloud infrastructure (unnamed providers on public Trust Center), global offices including US presence, and Panama controller—VPN no-logs posture does not eliminate account/cloud subprocessor questions. Not legal advice.	Partial EU entity / no known US parent and claimed EEA storage for account data, but no public hosting/subprocessor list and public US exit locations. Residual exposure medium. Not legal advice.
Data processing agreement (B2B)	Unknown Consumer checkout does not surface a standard public DPA the way many B2B SaaS portals do. Request DPA and subprocessors for any organizational use; NordLayer may be the intended business contracting path.	Not found No public B2B DPA download or subprocessor schedule found; privacy policy is consumer-oriented.
EU AI Act	Not applicable Consumer VPN and digital security app; not marketed as an AI system under the AI Act.	Not applicable Consumer VPN/stealth-proxy service, not an AI system offering under typical AI Act scoping.

Considerations & known limitations: NordVPN vs Xeovo
Considerations & known limitations	NordVPN	Xeovo
Panama data controller, not EU entity-as-controller	Medium Privacy policy names nordvpn S.A. (Panama) as controller despite Lithuanian group HQ and Dutch EEA representative. Sovereignty-focused buyers must accept this structure or pick an EU or Swiss controller peer.	Not listed
Multi-cloud backend; incomplete public subprocessor list	Medium Trust Center describes multi-cloud operational security without a clear exhaustive public consumer subprocessor table on pages reviewed. Assume possible US-group cloud SaaS for non-tunnel functions until Nord provides a current list under NDA or DPA.	Not listed
Full no-logs reports account-gated	Low Assurance engagements are real and repeated, but PDFs are not always public. Procurement may need a login or vendor package to attach evidence to a risk register.	Not listed
Device caps and best-effort streaming	Low Ten simultaneous connections and variable streaming or geo results are practical limits. Not a substitute for a business SD-WAN or guaranteed media CDN.	Not listed
Public 2018 infrastructure incident history	Low Industry coverage of a 2018 third-party datacenter compromise is part of brand history. Nord has since stressed RAM-only designs, audits, and bounty programs—still relevant for long-memory risk committees.	Not listed
No public independent no-logs audit	Not listed	High High-sensitivity buyers must treat no-logs and transparency reports as first-party claims. Demand external evidence or shortlist an audited peer.
Infrastructure and subprocessors not published	Not listed	Medium Without a DC/payment/email/hosting register, residual transfer and CLOUD Act analysis stays incomplete even with Finnish HQ and EEA storage claims for account data.
Optional US and other non-EU exit nodes	Not listed	Medium Status map includes multiple US cities and other non-EU locations. Choose EU exits deliberately when residency of tunnel egress matters.
No port forwarding or dedicated IPs; streaming weak	Not listed	Medium FAQ denies port forwarding and dedicated/residential IPs; major streaming services likely blocked. Hard blockers for some use cases.
Five concurrent devices; personal accounts	Not listed	Low Five simultaneous connections and terms against multi-person account sharing constrain household or team rollouts.

Fit

NordVPN

Best fit when

Households and freelancers who want one app for VPN plus malware, ad, and tracker blocking
Travelers needing broad country coverage, Quick Connect, and multi-OS clients including routers
Users who value Meshnet for private peer file share or remote LAN gaming without public port exposure
Buyers who want repeated independent no-logs assurance engagements (Deloitte and PwC lineage) even if full PDFs are account-gated
Teams already standardizing on other Nord Security consumer tools and accepting a managed SaaS VPN

Poor fit when

Organizations requiring the data controller to be an EU company only (controller is nordvpn S.A., Panama)
Buyers who need fully open-source clients on every platform, cash or numbered anonymous accounts, or self-hosted relays
Enterprises needing centralized SSO, device policy, and B2B contracting on the consumer SKU (use NordLayer or peers)
Procurement that must prove EU-only hosting and named non-US subprocessors from a public list alone
Users who need unlimited simultaneous devices without a router workaround

Consider instead when

When: You want numbered accounts, cash-friendly privacy payments, and fully open clients
Consider: Mullvad
Fewer consumer extras (no Meshnet or Threat Protection suite) but stronger anonymity UX
When: You want a Swiss privacy-ecosystem VPN with freemium entry and open-source clients
Consider: Proton VPN
Different protocol and product mix; compare Secure Core vs Nord specialty servers
When: You need unlimited devices on a mass-market plan in the same commercial family
Consider: Surfshark
Related market positioning after corporate combination; verify current ownership and plan terms
When: You need admin-managed business remote access rather than consumer seats
Consider: NordLayer (Nord Security business product) or a dedicated business VPN
Do not stretch consumer NordVPN as an enterprise gateway

Xeovo

Best fit when

Users under active DPI/censorship who need Shadowsocks, AmneziaWG, VLESS/VMess/Trojan, or Hysteria—not only plain WireGuard
Buyers who want a Finnish EU legal entity and GDPR-framed privacy policy with claimed EEA storage for account data
Privacy-oriented individuals who value optional email, cash/Monero/BTC/LTC payments, and prepaid subscriptions
Power users comfortable with config generators and third-party stealth clients rather than a single mega-app
Teams fine with a compact ~27-country map and live status/P2P labels instead of thousands of cities

Poor fit when

Procurement that requires independent no-logs audits, ISO 27001/SOC 2 evidence, and a public B2B DPA with subprocessors
Users who need port forwarding, dedicated/residential IPs, or reliable access to major streaming catalogues
Organisations standardising only on audited multi-hop or RAM-only infrastructure claims Xeovo does not publish
Households seeking a free tier or free trial (only prepaid + limited money-back)
Anyone who will treat vendor no-logs claims as verified without third-party evidence

Consider instead when

When: You need stronger anonymous-account culture and long-standing independent reputation
Consider: Mullvad
Better default when stealth protocols are secondary to audited privacy ops
When: You want a larger EU brand suite, free tier options, and deeper corporate security programme material
Consider: Proton VPN
Prefer for broader product integration and procurement packaging
When: You want simple Dutch consumer apps and lifetime packaging more than censorship tooling
Consider: GOOSE VPN
Different protocol story; fewer stealth-focused features

Open questions for due diligence

NordVPN

Will Nord provide a current consumer or B2B subprocessor list naming cloud, email, payments, and support vendors with locations?
Can procurement obtain the latest Deloitte or PwC assurance PDF and scope letter without a personal Nord Account?
Is a signed DPA available for organizational purchase of consumer seats, or must buyers move to NordLayer?
Which account, telemetry, and crash-reporting data leave the VPN tunnel path, and under which transfer tools?
What is the current relationship and data-sharing boundary between NordVPN and Surfshark products after corporate combination?

Xeovo

Will Xeovo publish or provide under NDA a current infrastructure and subprocessor list (DCs, payment processors, email, CDN for stealth)?
Is an independent no-logs or application security audit planned or available on request?
For B2B: will Xeovo Oy sign a GDPR DPA with a named subprocessor schedule?
What exact retention periods apply to payment metadata, tickets, and WireGuard/proxy keys after account deletion?
Which official first-party apps (if any) ship kill-switch and DNS controls vs config import only per platform?