Still open on this record.
the rest of what is open — 567 more words
The canary, and the quarter that replaced it. The same page retired the warrant canary (P07=removed) for quarterly transparency reports; the latest complete quarter (Apr–Jun 2026) shows 85 government inquiries and 0 disclosures, so P08/P09 are that period, not the lifetime figure.
India, and the secret-order regime. P04=withdrew_physical is the June 2022 India exit. P11=none_known rests on the page's statement that NordVPN has received no binding National Security letters or gag orders and on Panama's absence of such a regime.
An assurance level nobody can check. NordVPN describes the Deloitte Lithuania engagement as a reasonable assurance engagement under ISAE 3000 (Revised), which would be the stronger form; PIA's report, which can be read, states a limited assurance conclusion.
Why the stronger form is not credited. The model now prices that difference, and this record does not get the benefit of it: V15_assurance_strength is unknown because the only statement of the level is NordVPN's own, about a report nobody outside a Nord Account can open. A document behind a login is not evidence here at any level, so the engagement is credited at the market norm rather than at the level it is said to have reached.
A report behind a login. The report itself is readable only after signing in to a Nord Account, so nobody outside that relationship has checked its scope, and every audit field here rests on NordVPN's own summary of it rather than on the document. That, and not a finding against the service, is why this record is the thinnest in the catalogue.
The owner fields. M11_owner_jurisdiction and X04_owner_group_history are unknown: nordvpn.com and nordsecurity.com name Nord Security as owner but neither states Nord Security's own jurisdiction of incorporation or any prior record for the group; secondary press ties a 'Cyberspace' holding entity to the Netherlands from the 2022 merger, but that was not confirmed against a primary Nord Security or NordVPN page in the time available.
What could not be read at all. The full text of the 2025 Deloitte report cannot be read at all (login-gated), so no retention finding is recorded beyond the policy's own claim in C01_linkable_retention.
The server table that would not open. C09b_mandate_hosting is unknown: the live per-country server table shows physical/virtual status only for the Americas region in the accordion state this audit could render; Europe, Asia-Pacific and Africa/Middle East sections (which include several mandate countries the fleet serves, e.g. AE, IN, TR, VN, IQ, KZ per the servers API) load client-side on click and were not expanded.
Left unknown rather than asserted. C04-C07, U06 (censorship proof), U11, V12-V14, X06, X07, X10 and X11 were not independently confirmed against a primary document and are left unknown rather than asserted from secondary coverage.
One doubt left open, and not charged. One doubt stays open on X12 without being charged: the Play data safety form for com.nordvpn.android declares Installed apps under analytics on Android, while the NordVPN privacy notice mentions installed applications in one place only — the anti-malware vulnerability scan — and scopes the processing of application names and versions to Windows.
Why it still reads as a match. The category is disclosed rather than absent, and R28 does not make a finding out of a platform scope difference, so the value reads matches_policy; but the Android purpose is not the one the notice describes, and only NordVPN can say which of the two is written wrong.
