NordVPN vs Private Internet Access

The 2018 Finland datacenter breach was a third-party intrusion, not a law-enforcement seizure — recorded under P12_case_history as kind=breach, not P01_seizure_event. NordVPN's own account (nordvpn.com/blog/official-response-datacenter-breach/) and Bloomberg's contemporaneous coverage agree the disclosure followed Twitter allegations by outside researchers, not NordVPN's own initiative — hence third_party_disclosed rather than self_disclosed_late.

NordVPN and Surfshark share a parent (Nord Security) but both companies' own merger announcement states separate infrastructure and product roadmaps; M18 is set to separate on that basis.

M08_user_scale, P02_disclosure_history, P03_court_record and P12_case_history were re-read against the same sources and stand unchanged; the main transparency-report page still names no case beyond the 2016-2017 subpoenas already on file. The pricing re-read against the same buy-vpn-online page found both figures unchanged: month-to-month $11.95, one-year plan $47.88 billed for the first year and autorenewing at the same $47.88 with no intro/renewal gap, consistent with PIA's flat-rate pricing noted elsewhere in the catalogue.

Sourced from privateinternetaccess.com's own pages and blog, the two Deloitte ISAE 3000 (Revised) 'Independent Limited Assurance Report' PDFs (April 2024 and December 2025, both opened and read directly), Kape Technologies' own site, the Isle of Man/Companies House-sourced reporting on Kape's 2023 take-private by Unikmind Holdings (Teddy Sagi), and the official pia-foss GitHub organisation for the open-source clients.

The public CourtListener docket for United States v. McWaters (9:16-cr-80043, S.D. Fla.) was opened but names no subpoena, VPN provider or outcome; the affiliate writeup (vpncompare.co.uk) that describes that subpoena in detail was dropped as a forbidden source, and TorrentFreak's own coverage returned HTTP 403 to every fetch attempt this run, curl included. P03/P12 now rest on PIA's own transparency-report self-declaration instead.

Wikipedia was dropped from V12 in favour of the GitHub organisation itself. No affiliate or 'best VPN' aggregator site was used as a factual source anywhere in this record, even though several turned up repeatedly in search results with plausible-looking numbers (server counts, user counts, audit dates) that could not be cross-checked against a primary page and were discarded rather than used.

The canary, and the quarter that replaced it. The same page retired the warrant canary (P07=removed) for quarterly transparency reports; the latest complete quarter (Apr–Jun 2026) shows 85 government inquiries and 0 disclosures, so P08/P09 are that period, not the lifetime figure.

India, and the secret-order regime. P04=withdrew_physical is the June 2022 India exit. P11=none_known rests on the page's statement that NordVPN has received no binding National Security letters or gag orders and on Panama's absence of such a regime.

An assurance level nobody can check. NordVPN describes the Deloitte Lithuania engagement as a reasonable assurance engagement under ISAE 3000 (Revised), which would be the stronger form; PIA's report, which can be read, states a limited assurance conclusion.

Why the stronger form is not credited. The model now prices that difference, and this record does not get the benefit of it: V15_assurance_strength is unknown because the only statement of the level is NordVPN's own, about a report nobody outside a Nord Account can open. A document behind a login is not evidence here at any level, so the engagement is credited at the market norm rather than at the level it is said to have reached.

A report behind a login. The report itself is readable only after signing in to a Nord Account, so nobody outside that relationship has checked its scope, and every audit field here rests on NordVPN's own summary of it rather than on the document. That, and not a finding against the service, is why this record is the thinnest in the catalogue.

The owner fields. M11_owner_jurisdiction and X04_owner_group_history are unknown: nordvpn.com and nordsecurity.com name Nord Security as owner but neither states Nord Security's own jurisdiction of incorporation or any prior record for the group; secondary press ties a 'Cyberspace' holding entity to the Netherlands from the 2022 merger, but that was not confirmed against a primary Nord Security or NordVPN page in the time available.

What could not be read at all. The full text of the 2025 Deloitte report cannot be read at all (login-gated), so no retention finding is recorded beyond the policy's own claim in C01_linkable_retention.

The server table that would not open. C09b_mandate_hosting is unknown: the live per-country server table shows physical/virtual status only for the Americas region in the accordion state this audit could render; Europe, Asia-Pacific and Africa/Middle East sections (which include several mandate countries the fleet serves, e.g. AE, IN, TR, VN, IQ, KZ per the servers API) load client-side on click and were not expanded.

Left unknown rather than asserted. C04-C07, U06 (censorship proof), U11, V12-V14, X06, X07, X10 and X11 were not independently confirmed against a primary document and are left unknown rather than asserted from secondary coverage.

One doubt left open, and not charged. One doubt stays open on X12 without being charged: the Play data safety form for com.nordvpn.android declares Installed apps under analytics on Android, while the NordVPN privacy notice mentions installed applications in one place only — the anti-malware vulnerability scan — and scopes the processing of application names and versions to Windows.

Why it still reads as a match. The category is disclosed rather than absent, and R28 does not make a finding out of a platform scope difference, so the value reads matches_policy; but the Android purpose is not the one the notice describes, and only NordVPN can say which of the two is written wrong.

What it did not examine. The report covers infrastructure only. C07a_app_sdk and C12_device_identifier are app-side facts it never examined; they now cite the privacy policy instead, which describes analytics for website visitors and opt-in diagnostic reports carrying platform and app version. Reading either as a statement about SDKs compiled into the app is the weakest link in this record, and the open-source clients are where it would actually be settled.

The 2016 subpoena rests on PIA's own word, not the court file. The only detailed account of the McWaters case (S.D. Fla., 9:16-cr-80043) sits on an affiliate site this record cannot cite; CourtListener's docket for that case names no subpoena, no provider and no outcome. P03_court_record and P12_case_history now stand on PIA's own transparency-report statement that it was subpoenaed in 2016-2017 and produced nothing — a B-level self-declaration, not a verified court record.