VPN providers
NordVPN privacy rating
Commercial VPN service from Nord Security, operated by a company in Panama. Apps use the WireGuard-based NordLynx protocol, OpenVPN or the NordWhisper protocol.
Summary
NordVPN scores 56 out of 100 (grade D) on the VPN providers criteria. It meets 4 of 12 criteria: no ads or data sales, transparency report, TLS configuration and modern protocols. It partly meets open source, independent audit, security headers, audited no-logs policy, anonymous payment and open-source apps. It does not meet no trackers or telemetry and tells users about requests. It is based in Panama: Not in the Five, Nine or Fourteen Eyes. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.
Score 56 out of 100. How scoring works
Criteria
-
Partial
Open source Weight 3 of 3
Is all the source code needed to run the product public?
Only the Linux app is open source, under GPL-3.0. The other apps and the servers are closed source.
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The Android app includes AppsFlyer, Google Firebase Analytics and Crashlytics.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid subscriptions. No ads in the apps.
-
Partial
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Deloitte performed a no-logs assurance engagement. The full report is only available to logged-in customers.
-
Yes
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Quarterly counts of government inquiries and DMCA requests are published.
-
No
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
No published policy on notifying users about data requests.
-
Partial
Audited no-logs policy Weight 3 of 3
Has an independent audit confirmed that activity and connection logs are not kept?
Deloitte assessed the no-logs policy repeatedly, but the full report is only available to logged-in customers, not publicly.
-
Partial
Anonymous payment Weight 2 of 3
Can an account be created and paid for without an email address, name or card?
Several cryptocurrencies are accepted, but an email address is needed for the account.
-
Partial
Open-source apps Weight 2 of 3
Are the apps for every platform open source?
Only the Linux app is open source.
-
Yes
Modern protocols Weight 1 of 3
Is WireGuard (or another modern audited protocol) supported?
NordLynx, built on WireGuard, is the default protocol.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Partial
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B+ (80/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.