IVPN vs NordVPN

The 2018 Finland datacenter breach was a third-party intrusion, not a law-enforcement seizure — recorded under P12_case_history as kind=breach, not P01_seizure_event. NordVPN's own account (nordvpn.com/blog/official-response-datacenter-breach/) and Bloomberg's contemporaneous coverage agree the disclosure followed Twitter allegations by outside researchers, not NordVPN's own initiative — hence third_party_disclosed rather than self_disclosed_late.

NordVPN and Surfshark share a parent (Nord Security) but both companies' own merger announcement states separate infrastructure and product roadmaps; M18 is set to separate on that basis.

The August 2026 incident. In August 2026 an attacker exploited a vulnerability in the self-hosted BTCPay Server, before it was public, and took IVPN's own Lightning operating funds. IVPN published the account four days later, unprompted, and scoped it to that machine: the VPN gateways were not involved, no customer records were reached, no customer money was lost.

Why it costs nothing. The model charges nothing for this, which is the point — an operator that says so promptly is behaving the way the field is meant to reward, and the entry is here so a reader knows it happened rather than to move a number.

What the engagements covered. The app pentest (iOS, Android, Electron, the daemon) is from March 2022 and the gateway/server-OS review from February 2023; neither tested the no-logs claim itself, the 2023 report says so explicitly, so retention rests on the privacy policy declaration alone.

The latest report is not the relevant one. April 2024's engagement, Cure53's sixth with IVPN, tested the customer account website, API and hosting; its own scope page names client apps and VPN servers out of scope, so it extends neither the app nor the gateway evidence, and V03_audit_subject reads unknown for it rather than carrying that credit forward. The seventh engagement, on the new email and DNS services, was only announced for May 2025; no report for it is published.

What the primary site never establishes. RAM-only is recorded as partial because IVPN describes it as a transition with test deployments under way, and has not announced its completion. Server hardware ownership (leased vs owned), traffic modification at the exit, and the beneficial owner's personal jurisdiction are unestablished: no primary IVPN page states any of the three, nor does user-base scale.

Three fields the knowledgebase answers, not the pages read at first fill. IP allocation is shared by design — "crowding" pools users on one address to blunt attribution. P2P is allowed everywhere, but IVPN asks customers to avoid US exits, citing upstream DMCA pressure. Streaming carries no guarantee, though the company says many customers do reach it.

The canary, and the quarter that replaced it. The same page retired the warrant canary (P07=removed) for quarterly transparency reports; the latest complete quarter (Apr–Jun 2026) shows 85 government inquiries and 0 disclosures, so P08/P09 are that period, not the lifetime figure.

India, and the secret-order regime. P04=withdrew_physical is the June 2022 India exit. P11=none_known rests on the page's statement that NordVPN has received no binding National Security letters or gag orders and on Panama's absence of such a regime.

An assurance level nobody can check. NordVPN describes the Deloitte Lithuania engagement as a reasonable assurance engagement under ISAE 3000 (Revised), which would be the stronger form; PIA's report, which can be read, states a limited assurance conclusion.

Why the stronger form is not credited. The model now prices that difference, and this record does not get the benefit of it: V15_assurance_strength is unknown because the only statement of the level is NordVPN's own, about a report nobody outside a Nord Account can open. A document behind a login is not evidence here at any level, so the engagement is credited at the market norm rather than at the level it is said to have reached.

A report behind a login. The report itself is readable only after signing in to a Nord Account, so nobody outside that relationship has checked its scope, and every audit field here rests on NordVPN's own summary of it rather than on the document. That, and not a finding against the service, is why this record is the thinnest in the catalogue.

The owner fields. M11_owner_jurisdiction and X04_owner_group_history are unknown: nordvpn.com and nordsecurity.com name Nord Security as owner but neither states Nord Security's own jurisdiction of incorporation or any prior record for the group; secondary press ties a 'Cyberspace' holding entity to the Netherlands from the 2022 merger, but that was not confirmed against a primary Nord Security or NordVPN page in the time available.