NordVPN vs Proton VPN

The 2018 Finland datacenter breach was a third-party intrusion, not a law-enforcement seizure — recorded under P12_case_history as kind=breach, not P01_seizure_event. NordVPN's own account (nordvpn.com/blog/official-response-datacenter-breach/) and Bloomberg's contemporaneous coverage agree the disclosure followed Twitter allegations by outside researchers, not NordVPN's own initiative — hence third_party_disclosed rather than self_disclosed_late.

NordVPN and Surfshark share a parent (Nord Security) but both companies' own merger announcement states separate infrastructure and product roadmaps; M18 is set to separate on that basis.

The canary, and the quarter that replaced it. The same page retired the warrant canary (P07=removed) for quarterly transparency reports; the latest complete quarter (Apr–Jun 2026) shows 85 government inquiries and 0 disclosures, so P08/P09 are that period, not the lifetime figure.

India, and the secret-order regime. P04=withdrew_physical is the June 2022 India exit. P11=none_known rests on the page's statement that NordVPN has received no binding National Security letters or gag orders and on Panama's absence of such a regime.

An assurance level nobody can check. NordVPN describes the Deloitte Lithuania engagement as a reasonable assurance engagement under ISAE 3000 (Revised), which would be the stronger form; PIA's report, which can be read, states a limited assurance conclusion.

Why the stronger form is not credited. The model now prices that difference, and this record does not get the benefit of it: V15_assurance_strength is unknown because the only statement of the level is NordVPN's own, about a report nobody outside a Nord Account can open. A document behind a login is not evidence here at any level, so the engagement is credited at the market norm rather than at the level it is said to have reached.

A report behind a login. The report itself is readable only after signing in to a Nord Account, so nobody outside that relationship has checked its scope, and every audit field here rests on NordVPN's own summary of it rather than on the document. That, and not a finding against the service, is why this record is the thinnest in the catalogue.

The owner fields. M11_owner_jurisdiction and X04_owner_group_history are unknown: nordvpn.com and nordsecurity.com name Nord Security as owner but neither states Nord Security's own jurisdiction of incorporation or any prior record for the group; secondary press ties a 'Cyberspace' holding entity to the Netherlands from the 2022 merger, but that was not confirmed against a primary Nord Security or NordVPN page in the time available.

What could not be read at all. The full text of the 2025 Deloitte report cannot be read at all (login-gated), so no retention finding is recorded beyond the policy's own claim in C01_linkable_retention.

The server table that would not open. C09b_mandate_hosting is unknown: the live per-country server table shows physical/virtual status only for the Americas region in the accordion state this audit could render; Europe, Asia-Pacific and Africa/Middle East sections (which include several mandate countries the fleet serves, e.g. AE, IN, TR, VN, IQ, KZ per the servers API) load client-side on click and were not expanded.

Left unknown rather than asserted. C04-C07, U06 (censorship proof), U11, V12-V14, X06, X07, X10 and X11 were not independently confirmed against a primary document and are left unknown rather than asserted from secondary coverage.

One doubt left open, and not charged. One doubt stays open on X12 without being charged: the Play data safety form for com.nordvpn.android declares Installed apps under analytics on Android, while the NordVPN privacy notice mentions installed applications in one place only — the anti-malware vulnerability scan — and scopes the processing of application names and versions to Windows.

Why it still reads as a match. The category is disclosed rather than absent, and R28 does not make a finding out of a platform scope difference, so the value reads matches_policy; but the Android purpose is not the one the notice describes, and only NordVPN can say which of the two is written wrong.

What actually settles the two fields. What settles C10 and C11 is that Switzerland carries no mandate basis in the catalogue's own country list; the appeal corroborates how Swiss authorities treat Proton and is not by itself a finding about Proton VPN. A ruling on a sibling service is thinner ground than the citation makes it look.

The single largest open item. Proton offers exit locations in eight countries that impose a logging mandate. Whether hardware actually sits in any of them is not established: Proton withdrew physical servers from India in 2022 and documents Smart Routing for locations it serves from elsewhere, which points to virtual, but that was verified for India alone. Establishing C09b_mandate_hosting is the single largest open item on this record.