Nordvpn
Verified“European-built, Panama-flagged.”
- Founded
- 2012
- Valuation
- $3B
- Users
- ~15M
- No-logs audit
- 6th time
60 = midpoint of Control 55 & Data 65
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 16 sourced facts across 11 independent sources, last verified 2026-06-12. 4 open questions hold confidence at 72% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
45
Split by design. The developer/parent is EU-incorporated (Nord Security under Cyberspace B.V., Amsterdam; NordSec B.V. KVK 83812385) and operations are in EU (Lithuania), so EU law reaches the corporate group. BUT the entity that actually provides the consumer VPN — NordVPN S.A. — is incorporated in and operates under the jurisdiction of Panama, with Panamanian governing law, specifically to sit outside the 5/9/14-Eyes and EU data-retention regimes. The user-facing legal relationship is therefore non-EU. Net: EU-operating group, non-EU service entity.
Why 45? 4 sourced facts · click to expand
Consumer VPN service entity & governing jurisdiction
Wikipedia (NordVPN) · as of 2026-06-12
Parent/developer incorporation
Wikipedia (NordVPN) · as of 2026-06-12
EU legal entity on official impressum
Nord Security Impressum · as of 2026-06-12
VPN entity historically Tefincom S.A., consolidated to NordVPN S.A. (Panama)
TechNadu (Who Owns NordVPN) · as of 2026-06-12
Control & Ownership
65
Founder- and EU-controlled. Co-founders Tomas Okmanas and Eimantas Sabaliauskas (Lithuanian) retain control; the company stayed fully founder-funded until 2022. External capital is MINORITY: a US PE firm (Warburg Pincus, NY), Novator (UK/Icelandic-founded), and Burda (Germany) hold minority stakes. So voting control and the economic majority sit with EU founders — but there is meaningful non-EU (US) capital on the cap table and the company is private (no EU listing venue to anchor it). Exact percentages are not publicly disclosed.
Why 65? 4 sourced facts · click to expand
External investment was first-ever, raised at $1.6B then $3B
Warburg Pincus · as of 2026-06-12
Data →
Where your data lives and who can reach it
Data & Infrastructure
55
Better than the typical hyperscaler-dependent SaaS, but not EU-resident-by-design. NordVPN runs RAM-only/diskless servers (state wiped on reboot, no persistent local storage) and has moved to company-OWNED colocated hardware where only Nord staff have physical access — so it does NOT depend on AWS/Azure/GCP for the VPN data plane, reducing CLOUD Act exposure on the core network. However the server fleet is globally distributed (facilities supplied by local partners worldwide, including non-EU), and account/billing backend jurisdiction and data-residency are not clearly EU-pinned. So: independent, company-controlled infra (good) but global, not EU-only (caps the score).
Why 55? 4 sourced facts · click to expand
Owned colocated servers, Nord-only physical access
NordVPN blog (colocated servers) · as of 2026-06-12
No-logs independently verified (6th time)
NordVPN blog (2025 assurance) · as of 2026-06-12
Server facilities supplied by partners globally (not EU-only)
DataCenterNews · as of 2026-06-12
Operations & People
80
Strongly EU-centered. Global HQ is Vilnius, Lithuania, where Nord Security owns a 7-floor building housing ~2,000 staff; the founders are Lithuanian and leadership/operations are EU-based. Offices also in UK, Netherlands and Panama, but the operational and engineering center of gravity is unambiguously Lithuania. The main public counterweight is the deliberately Panama-flagged service entity and the global server footprint — but people, leadership and day-to-day operations are EU.
Why 80? 4 sourced facts · click to expand
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
4 open questions — they lower confidence, never the score
- ?
Exact equity split — what % do founders vs. Warburg Pincus / Novator / Burda hold, and what are the voting rights / board control terms?
Determines whether EU founders truly retain hard voting control or whether US/non-EU minority investors hold blocking/veto rights. Caps confidence on the ownership score.
- ?
Where does NordVPN's account, billing and support backend data actually reside, and under which entity's jurisdiction, vs. the VPN data plane?
The no-logs/RAM story covers the VPN tunnel, but account-level personal data (email, payment, device IDs) residency and CLOUD Act exposure are not clearly EU-pinned — directly affects the infra score.
- ?
Is the current consumer Terms of Service still issued by NordVPN S.A. (Panama) as of 2026, or has the contracting entity shifted toward the EU parent?
If the contracting entity were EU-based, EU enforceability and the legal score would rise materially. The live ToS page (my.nordaccount.com) blocked automated fetch, so this rests on secondary sources.
- ?
What share of the server fleet sits inside the EU vs. third countries, and how much is owned/colocated vs. rented from partners?
Affects data-residency and infra independence; only Finland was confirmed as an early owned-colocation site.
EU Cloud Sovereignty Framework lens
SEAL was designed to assess cloud service providers; this is an analogous sovereignty mapping for a consumer VPN, not a certification.
Strategic
EU founder-controlled and EU-headquartered, but a US PE house (Warburg Pincus) is the lead outside investor and the flagship service entity is deliberately offshore in Panama.
Legal & jurisdictional
Parent EU-incorporated (NL) and EU-operating (LT), but the consumer-facing entity NordVPN S.A. is Panama-incorporated under Panamanian governing law — the user contracts outside EU enforceability.
Data & AI
RAM-only/diskless VPN servers with no persistent storage; no-logs verified 6x by Deloitte Lithuania. But account/billing data residency is not clearly EU-pinned.
Operational
Operational and engineering center of gravity is Vilnius, Lithuania (~2,000 staff, owned HQ); EU leadership and EU founders.
Supply chain
Moving to company-owned colocated hardware (Nord-only physical access) reduces hyperscaler dependence, but server facilities are supplied by local partners across many non-EU jurisdictions.
Technological
Owns and controls its core network stack and proprietary protocol; not dependent on AWS/Azure/GCP for the VPN data plane, but globally distributed rather than EU-resident by design.
Security & compliance
Repeated independent assurance (Deloitte, ISAE 3000), public bug bounty and audit history; among the more transparently audited consumer VPNs.
Environmental sustainability
No verified data on energy sourcing or emissions reporting found in this review.
EU alternatives
Strong privacy pedigree under Swiss law and a non-profit foundation structure — but Switzerland is not an EU member, so it is not strictly EU-jurisdictional (adequacy via FADP).
EU-incorporated and EU-operating (Sweden), privacy-first with anonymous accounts and a clear EU legal entity — a fully EU-jurisdictional consumer VPN option.
Audited, privacy-focused, but incorporated in Gibraltar (a UK overseas territory, outside the EU), so not EU-jurisdictional despite strong practices.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology