# NordVPN privacy rating

Commercial VPN service from Nord Security, operated by a company in Panama. Apps use the WireGuard-based NordLynx protocol, OpenVPN or the NordWhisper protocol.

## Summary

NordVPN scores 56 out of 100 (grade D) on the VPN providers criteria. It meets 4 of 12 criteria: no ads or data sales, transparency report, TLS configuration and modern protocols. It partly meets open source, independent audit, security headers, audited no-logs policy, anonymous payment and open-source apps. It does not meet no trackers or telemetry and tells users about requests. It is based in Panama: Not in the Five, Nine or Fourteen Eyes. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.

- Website: https://nordvpn.com
- Source code: https://github.com/NordSecurity/nordvpn-linux
- License: GPL-3.0
- Jurisdiction: Panama. Not in the Five, Nine or Fourteen Eyes.
- Platforms: Windows, macOS, Linux, Android, iOS
- Category: [VPN providers](https://privacyratings.com/vpns/)
- Also rated: [NordVPN Meshnet](https://privacyratings.com/mesh-vpns/nordvpn-meshnet/) (Mesh VPNs and private networks)
- Grade: D (56/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | Only the Linux app is open source, under GPL-3.0. The other apps and the servers are closed source. | https://github.com/NordSecurity/nordvpn-linux/blob/main/LICENSE.md |
| No trackers or telemetry | No | The Android app includes AppsFlyer, Google Firebase Analytics and Crashlytics. | https://reports.exodus-privacy.eu.org/en/reports/com.nordvpn.android/latest/ |
| No ads or data sales | Yes | Funded by paid subscriptions. No ads in the apps. | https://nordvpn.com/pricing/ |
| Independent audit | Partial | Deloitte performed a no-logs assurance engagement. The full report is only available to logged-in customers. | https://nordvpn.com/blog/nordvpn-no-logs-assurance-engagement-2025/ |
| Transparency report | Yes | Quarterly counts of government inquiries and DMCA requests are published. | https://nordvpn.com/blog/nordvpn-introduces-transparency-reports/ |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=nordvpn.com&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=nordvpn.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Audited no-logs policy | Partial | Deloitte assessed the no-logs policy repeatedly, but the full report is only available to logged-in customers, not publicly. | https://nordvpn.com/blog/nordvpn-no-logs-assurance-engagement-2025/ |
| Anonymous payment | Partial | Several cryptocurrencies are accepted, but an email address is needed for the account. | https://nordvpn.com/pricing/ |
| Open-source apps | Partial | Only the Linux app is open source. | https://github.com/NordSecurity/nordvpn-linux |
| Modern protocols | Yes | NordLynx, built on WireGuard, is the default protocol. | https://nordvpn.com/blog/nordlynx-protocol-wireguard/ |

Source: https://privacyratings.com/vpns/nordvpn/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/vpns/nordvpn.md