Is NordVPN safe? No-logs audits, Panama law and where it falls short
Privacy and jurisdiction 6.3/10 and security 7.1/10 (segment medians 2.7 and 2.1). No red flag in our data. Independent no-logs audit: ✓ Yes.
In 10 seconds
- Independent no-logs audit: ✓ Yes
- RAM-only servers
- Kill switch
Privacy
- Jurisdiction
- Panama, outside 5/9/14 Eyes
- Legal entity
- nordvpn S.A.
- No-logs policy
- Yes strict no-logs policy
- Data retention
- session info 15 min; connectivity flag 90 days
- Shared with third parties
- states no activity data shared; processors
What the privacy policy says is collected
Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.
- Email✕ Yes
- IP at sign-upNot stated
- Connection IP✓ No
- Session times✕ Yes
- Bandwidth✓ No
- Device info✕ Yes
- App analytics✕ Yes
- Crash reports✕ Yes
Security
- Kill switch
- Yes
- DNS leak protection
- Yes (yes (Private DNS; leak test tool))
- Security audits
- No logs verified 2018 + 4 more times; app assessments ongoing
- Two-factor sign-in
- Yes (yes (MFA))
On the published record, yes. VPNRadarLab places the service 5th with 5.58 of 10, with no red flag in the site data (completeness 0.93). Its privacy mark of 6.3 and security mark of 7.1 sit well above the consumer medians of 2.7 and 2.1. The soft spots are specific: a mandatory email at sign-up, a short-lived session record with a 90-day flag, and no published record of a dedicated security audit or open-source apps.
Who runs NordVPN and what Panama law means for your data
Nord Security's nordvpn S.A. is the legal entity behind the service, based in Panama City. Panama sits outside the 5, 9 and 14 Eyes alliances, so no alliance-based data-sharing duty applies. The policy allows disclosing limited personal data when the law demands it; in most cases, it adds, there is nothing to hand over. A quarterly transparency report counts government inquiries and DMCA notices. See the VPNRadarLab jurisdiction overview for how Panama compares.
What NordVPN logs despite the no-logs promise
The brand calls it a strict no-logs policy. The NordVPN privacy policy is dated 20 July 2026, the general Nord policy 10 August 2026. What it says is kept:
| Data item | What the policy says |
|---|---|
| Collected, required for registration | |
| Connection IP | Not collected |
| Session times | Details of the last session, erased within 15 minutes of it ending; a flag that you used the service within the past 90 days |
| Bandwidth | Not collected |
| Device info | Technical data sent by the apps |
| App analytics | Optional, user-controlled |
| Crash reports | Crash logs and error events |
Nothing there ties a website to your home address; after the 15-minute window only the 90-day flag remains, holding no browsing content.
Audits, servers and the security toolkit
Independent auditors have checked the no-logs claim five times since 2018, though the pages the site read never name them or the years. Compare it with other audited no-logs VPNs.
| Protection | Status |
|---|---|
| Independent no-logs audit | Yes, five times since 2018 |
| Separate security audit | Not on record |
| Open-source apps | Not on record |
| Perfect forward secrecy | Not stated in the data |
| Warrant canary | Not on record |
| RAM-only servers | Yes |
| Protocols | NordLynx (WireGuard-based), OpenVPN, NordWhisper |
| Post-quantum encryption | Yes, across all apps |
| Kill switch, DNS leak protection | Yes, with own Private DNS |
| Double VPN, Onion over VPN | Yes |
| Multi-factor sign-in | Yes |
| Bug bounty | Yes, via HackerOne |
RAM-only hardware matters if a server is seized: a reboot wipes it. Of the 7115 servers in 150 countries, a large share is Nord-owned, the rest hosted by partners; some locations are virtual and unlabelled. Threat Protection filters malware, while the ad and tracker blocker arrives with Complete and higher plans.
Where NordVPN drops points on safety
The audited logging promise, Panama registration, RAM-only fleet and leak controls collect most of the score. Privacy stops at 9.5 of 15, and identity is the reason: sign-up demands an email and there is no account-number login. The 90-day usage flag costs the timestamp mark, and a warrant canary plus a court test of the no-logs policy are not on record either. Paying with crypto or a cash-prepaid card keeps the bank out of the trail without removing that anchor. Security gets 10 of 14; the main deduction, 2 points, comes from the separate security audit not being on record, with apps not recorded as open source and forward secrecy not stated making up the rest.
Incidents and red flags in the record
The site data records no public security incident, no incident penalty and no red flag. Without a court test in the record, those five outside checks remain the main evidence behind the logging claims.
NordVPN safety FAQ
Is NordVPN safe on iPhone, Android and PC?
One policy covers every app, from desktop to TV systems, with post-quantum encryption in each and per-app split tunnelling.
Can NordVPN or the police see what you do online?
Sites see the server address, not yours. Under a lawful demand only the email, device data and the brief session record are in play.
Is NordVPN safe on public Wi-Fi and for online banking?
Yes, once the kill switch is on: it cuts traffic the instant the tunnel drops, and Private DNS keeps queries from leaking.
Will NordVPN get past heavy censorship?
Only partly. Bypass scores 1.9: obfuscated servers and NordWhisper are the toolkit, without VLESS Reality, Trojan, Shadowsocks, Hysteria2 or obfs4.
Verdict on NordVPN safety
Everyday privacy: yes. Panama registration, five independent no-logs audits, no connection-IP logging, RAM-only servers, no incident on file. Register with a spare email, pay by crypto or a cash-prepaid card, and keep the kill switch on for public networks.