← Back to Directory
Logo: NordVPN

NordVPN

Lithuanian Nord Security consumer VPN: NordLynx (WireGuard-based), large RAM-only network, Meshnet, Threat Protection, and audited no-logs claims under a Panama data controller.

privacyvpnnordlynxmeshnetno-logs
Visit WebsiteAsk an EU migration specialistFeedback & corrections

NordVPN is a consumer and prosumer VPN from Nord Security, a cybersecurity company headquartered in Lithuania. It launched in 2012 and is marketed as an all-in-one security app: encrypted tunnels plus optional Threat Protection (malware, phishing, tracker, and ad blocking), Dark Web monitoring, and related extras depending on plan and platform.

It exists as a large-network European-built VPN for people who want polished apps, Meshnet, and extras rather than a numbered-account privacy boutique. Traffic is encrypted to a NordVPN exit. The flagship protocol is NordLynx, Nord's WireGuard-based implementation. A single account may use up to ten simultaneous connections.

The concrete differentiator is Meshnet: an encrypted peer network for remote LAN-style access, file sharing, and gaming on top of the consumer VPN. The published data controller for the consumer service is nordvpn S.A. in Panama, with NordSec B.V. in Amsterdam as the EEA representative.

NordLynx (WireGuard-based)RAM-only serversMeshnetThreat ProtectionNo-logs audits (Big Four)EU group (LT HQ)

Shortlist NordVPN when you want a polished multi-platform VPN with NordLynx performance, a very large RAM-only network, Meshnet, and in-app Threat Protection backed by repeated Big Four no-logs engagements. Skip when you need a pure EU data controller, fully public audit PDFs and subprocessors, anonymous numbered accounts, unlimited devices, or self-host—consider Mullvad or Proton VPN instead (and NordLayer for managed business access).

Key capabilities

Default high-speed path uses NordLynx, Nord’s WireGuard implementation with a double-NAT design meant to preserve performance while limiting server-side identifiers. OpenVPN and IKEv2 remain available on many clients; NordWhisper targets hard-to-reach networks. Benefits travelers and latency-sensitive users; confirm protocol availability per OS and router firmware.

Trust Center figures cite 8,900+ servers in 224+ locations, RAM-only memory so power-off wipes volatile state, and a mix of Nord-managed colocated hardware plus partner-hosted nodes. Specialty modes include Double VPN, Onion over VPN, obfuscated servers, and P2P nodes—useful when a single hop is not enough or when ISP shaping blocks standard VPN fingerprints.

Beyond the tunnel, NordVPN bundles Threat Protection (and Pro variants by plan and platform) to block malicious sites, trackers, ads, and scan downloads for malware, plus Dark Web monitoring and other digital-security tools marketed as an all-in-one app. Ideal when end users will not install a separate browser stack; feature depth still varies by OS and subscription tier.

Meshnet creates NordLynx-encrypted links between devices for remote file access, private gaming LANs, and routing traffic through a trusted peer without opening ports on the public internet. Typical limits: about ten devices on your account plus dozens of external peers—evaluate current caps in-app. Complements but does not replace a full site-to-site business VPN product.

Official apps span desktop, mobile, TV platforms, routers, and browser extensions, with kill switch, split tunneling, and private DNS inside the tunnel on supported clients. One account covers up to ten simultaneous connections (router setup protects the whole LAN as one slot). Suits households and freelancers; teams needing admin policy should look at NordLayer.

At a glance

Group HQ
Nord Security — Lithuania
Data controller (consumer)
nordvpn S.A., Panama
EEA representative
NordSec B.V., Amsterdam
Founded
2012
Network (vendor)
8,900+ servers / 224+ locations; RAM-only
Simultaneous devices
Up to 10 (router = 1 slot)
Self-host
No (managed SaaS VPN)
Open source
Partial (Linux client components); service proprietary

Best fit when

  • Households and freelancers who want one app for VPN plus malware, ad, and tracker blocking
  • Travelers needing broad country coverage, Quick Connect, and multi-OS clients including routers
  • Users who value Meshnet for private peer file share or remote LAN gaming without public port exposure
  • Buyers who want repeated independent no-logs assurance engagements (Deloitte and PwC lineage) even if full PDFs are account-gated
  • Teams already standardizing on other Nord Security consumer tools and accepting a managed SaaS VPN

Poor fit when

  • Organizations requiring the data controller to be an EU company only (controller is nordvpn S.A., Panama)
  • Buyers who need fully open-source clients on every platform, cash or numbered anonymous accounts, or self-hosted relays
  • Enterprises needing centralized SSO, device policy, and B2B contracting on the consumer SKU (use NordLayer or peers)
  • Procurement that must prove EU-only hosting and named non-US subprocessors from a public list alone
  • Users who need unlimited simultaneous devices without a router workaround

Consider instead when

  • When: You want numbered accounts, cash-friendly privacy payments, and fully open clients

    Consider: Mullvad

    Fewer consumer extras (no Meshnet or Threat Protection suite) but stronger anonymity UX

  • When: You want a Swiss privacy-ecosystem VPN with freemium entry and open-source clients

    Consider: Proton VPN

    Different protocol and product mix; compare Secure Core vs Nord specialty servers

  • When: You need unlimited devices on a mass-market plan in the same commercial family

    Consider: Surfshark

    Related market positioning after corporate combination; verify current ownership and plan terms

  • When: You need admin-managed business remote access rather than consumer seats

    Consider: NordLayer (Nord Security business product) or a dedicated business VPN

    Do not stretch consumer NordVPN as an enterprise gateway

Jurisdiction & ownership

Legal entity
nordvpn S.A. (Panama) as consumer data controller; NordSec B.V. (Netherlands) EEA representative; Nord Security group HQ Lithuania
Governing law
Privacy policy references GDPR and UK DPA among other regimes; confirm Terms of Service for contract law
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Medium
Hosting / residency
Global VPN egress: vendor-stated 8,900+ RAM-only servers across 224+ locations; mix of Nord-managed colocated hardware and partner-hosted servers. Trust Center describes multi-cloud security for operational infrastructure (providers not fully named on public pages reviewed). Account, billing, and support data paths per privacy policy under Panama controller.

No known US corporate parent. CLOUD Act exposure is indicative medium because of multi-cloud backend practices, global operations (including North America team presence), and incomplete public consumer subprocessor inventory—not because the parent is US-owned. Panama controllership is outside the EU; GDPR applies via policy commitments and NordSec B.V. representation. Not legal advice.

  • Independent security / no-logs auditVendor claimed
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionPartial
  • +3

Considerations & known limitations

  • MediumPanama data controller, not EU entity-as-controller

    Privacy policy names nordvpn S.A. (Panama) as controller despite Lithuanian group HQ and Dutch EEA representative. Sovereignty-focused buyers must accept this structure or pick an EU or Swiss controller peer.

  • MediumMulti-cloud backend; incomplete public subprocessor list

    Trust Center describes multi-cloud operational security without a clear exhaustive public consumer subprocessor table on pages reviewed. Assume possible US-group cloud SaaS for non-tunnel functions until Nord provides a current list under NDA or DPA.

  • LowFull no-logs reports account-gated

    Assurance engagements are real and repeated, but PDFs are not always public. Procurement may need a login or vendor package to attach evidence to a risk register.

  • LowDevice caps and best-effort streaming

    Ten simultaneous connections and variable streaming or geo results are practical limits. Not a substitute for a business SD-WAN or guaranteed media CDN.

  • LowPublic 2018 infrastructure incident history

    Industry coverage of a 2018 third-party datacenter compromise is part of brand history. Nord has since stressed RAM-only designs, audits, and bounty programs—still relevant for long-memory risk committees.

Open questions for due diligence

  • Will Nord provide a current consumer or B2B subprocessor list naming cloud, email, payments, and support vendors with locations?
  • Can procurement obtain the latest Deloitte or PwC assurance PDF and scope letter without a personal Nord Account?
  • Is a signed DPA available for organizational purchase of consumer seats, or must buyers move to NordLayer?
  • Which account, telemetry, and crash-reporting data leave the VPN tunnel path, and under which transfer tools?
  • What is the current relationship and data-sharing boundary between NordVPN and Surfshark products after corporate combination?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

The published privacy policy names nordvpn S.A. (Panama City, Panama) as controller. NordSec B.V. (Amsterdam) is the EEA representative, and the parent brand Nord Security is headquartered in Lithuania. GDPR rights and processes are described in the policy, but this is not a pure Lithuanian-only controller model. For DPIAs, document Panama controllership, the Dutch representative, SCCs or transfer clauses in the current policy, and any subprocessors Nord discloses on request.

Nord pioneered third-party no-logs assurance engagements (PwC AG Switzerland historically; later Deloitte Audit Lithuania under ISAE 3000), with multiple cycles publicly announced through 2024–2025. Press summaries report no evidence of prohibited logging in the sampled systems. Full reports are typically gated to a logged-in Nord Account, so treat the public status as vendor-attested plus Big Four engagement rather than an always-public PDF. Audits are point-in-time and cover stated server types (including specialty modes in recent scopes).

Consumer NordVPN fits individuals, households, and light prosumer use (up to ten devices, no central MDM-style policy on the consumer SKU). For SSO, centralized admin, and business contracting, Nord Security points buyers to NordLayer. If you need open-source clients, numbered anonymous accounts, or cash payment, evaluate Mullvad or similar peers instead.

No official self-host option; ten simultaneous connections per account (router equals one slot); Meshnet peer caps; streaming and geo-access are best-effort and change without notice; Linux GUI and CLI openness does not make the full product open source; account and billing identity still exists even when traffic is not activity-logged. Specialty servers and post-quantum modes may not be available on every platform at the same time.

NordVPN is a paid subscription product with multi-device seats and a time-limited money-back guarantee marketed as a risk-free trial window—there is no durable full-featured free tier comparable to some freemium VPNs. Confirm current plan bundles (which Threat Protection features are included), renewal terms, and any student or employee discounts on the official site. Business procurement should request current terms, DPA language, and subprocessors rather than relying on consumer checkout copy.