Nordvpn Transparency Report: Backing Up No-Log Claims with Deloitte

In 2020, NordVPN took a significant step towards transparency by hiring Deloitte, a leading audit firm, to review their no-log claims. This move demonstrates NordVPN's commitment to accountability and trustworthiness.

Deloitte's review involved a thorough examination of NordVPN's systems and infrastructure, which took several months to complete. The resulting report provided a detailed analysis of NordVPN's logging practices.

The report found that NordVPN's servers do not store any logs of user activity, including browsing history, IP addresses, or timestamps. This finding is crucial for users who value their online anonymity and security.

NordVPN's no-log policy is designed to protect users' sensitive information and prevent any potential data breaches.

NordVPN has announced the results of a fourth audit by Deloitte, one of the Big Four. The company said it opened its doors from 30 November until 7 December 2023 for the auditors to poke around, interview employees and generally check that the VPN servers aren’t recording any sensitive data about how subscribers are using the service.

The audit found no evidence of logging, which means it’s safe to use NordVPN. This is the fourth time NordVPN has called in the auditors, exactly a year after the previous one.

The latest report is available online for anyone to read, whether they’re an existing NordVPN user or not. It’s great to see these regular audits because they are just a snapshot in time.

NordVPN’s CTO Marijus Briedis said, “While we work hard to create and develop world-leading cybersecurity solutions to protect our customers, we also take privacy very seriously, and we are fully committed to our promise to not monitor or record the online traffic of our users.”

NordVPN has undergone multiple independent audits to verify its no-logs claims.

Deloitte has performed five audits of NordVPN's infrastructure, with the most recent one taking place at the end of 2024. These audits have consistently found no evidence of logging.

NordVPN's CTO, Marijus Briedis, emphasizes the importance of transparency and trust in the cybersecurity industry. He notes that the company's commitment to a no-logs policy is not just a buzzword, but a fundamental aspect of its DNA.

The audits have involved interviews with NordVPN employees, server infrastructure inspection, and a review of the company's privacy infrastructure. The full audit reports are available to NordVPN subscribers in their account control panel.

NordVPN's use of RAM-only servers is another key aspect of its commitment to transparency. These servers reboot after each VPN session, meaning there's theoretically no data stored.

Here's a summary of NordVPN's audit history:

The transparency report is a monthly publication that shows the number of automated DMCA requests, inquiries from government institutions, and orders that resulted in the disclosure of user information.

NordVPN has decided to ditch its warrant canary, a tactic used by many tech firms to inform users of government inquiries.

A warrant canary is a notice posted on a company's website stating that it has received no requests for information, and its absence would indicate that a request has been received.

NordVPN claims the warrant canary approach is outdated and not especially useful to its customers.

The company is replacing it with detailed transparency reports, which will be posted monthly on its website.

These reports will show the number of automated DMCA requests, inquiries from government institutions, and orders that resulted in the disclosure of user information.

Here's a breakdown of NordVPN's first transparency report for January:

NordVPN continues to maintain that it has never received any National Security Letters, gag orders, or binding warrants from any government organization that forced it to turn over customer information.