Who owns NordVPN, and where is it based?
Three countries appear in NordVPN's ownership chain, which is why the question gets answered differently everywhere you look. Here is the whole structure, from the founders down to the entity that operates the service.
Short answer
NordVPN is owned by Nord Security, a privately held group whose top holding entity is Nordsec Ltd, registered in London. The VPN service itself is operated by nordvpn S.A., incorporated in Panama. The company was founded in Lithuania in 2012 and is still controlled by its two founders, Tomas Okmanas and Eimantas Sabaliauskas. It is not owned by Kape Technologies, and it has no Chinese ownership.
The ownership chain
Each layer exists for a different reason, which is worth understanding because critics and marketers each tend to quote only the layer that suits them.
| Layer | Entity | Where | What it does |
|---|---|---|---|
| Controlling owners | Tomas Okmanas and Eimantas Sabaliauskas | Lithuania | Co-founders and co-chief executives, still the controlling shareholders |
| Minority investors | Novator Ventures, Burda Principal Investments, General Catalyst, Warburg Pincus | Europe and United States | Bought in across two funding rounds of about $100m each |
| Group holding company | Nordsec Ltd, trading as Nord Security | London, United Kingdom | Top of the corporate structure. Also holds NordPass, NordLocker and Surfshark |
| Service operator | nordvpn S.A., formerly Tefincom S.A. | Panama | The entity you actually contract with. Panama has no mandatory data retention law |
| Operations | Nord Security engineering | Lithuania, mainly Vilnius | Where the product is built and where most staff sit |
Where is NordVPN based, properly answered
"Based" does three different jobs in this question, and the honest answer is that the three do not point at the same country.
- Legally, for your subscription: Panama. You contract with nordvpn S.A. Panama has no mandatory data retention regime and is outside the Five, Nine and Fourteen Eyes intelligence sharing arrangements. This is the number NordVPN's own marketing leads with, and it is real, though it is also the layer that a determined legal process is least likely to stop at.
- Corporately: London. The group holding company, Nordsec Ltd, is registered in the United Kingdom. Critics point out that the UK is a Five Eyes country and that this sits oddly beside the Panama framing. In practice the holding company does not operate servers or hold user traffic, but it is a fair thing to know.
- Practically: Lithuania. This is where the company was founded, where the engineering happens, and where the people are. It is also where the no-logs assurance work is carried out.
The short version: Panama is where the service is incorporated, London is where the parent is registered, Lithuania is where the company actually is. Any source that gives you only one of the three is simplifying, in one direction or the other.
The Tesonet question
The most persistent criticism of NordVPN concerns Tesonet, a large Lithuanian technology company. NordVPN grew out of the Tesonet orbit: Tesonet acted as an incubator in the early years, and the two have shared premises and back office services in Vilnius.
What people do with that fact varies a lot. Some accounts describe Tesonet as simply the incubator that helped two founders get started, which is ordinary. Others treat the continuing overlap as evidence that the Panama incorporation is decorative. Public sources genuinely conflict on the current legal relationship, and we are not going to pretend otherwise: what is well established is the shared origin and the operational proximity, not a clean, documented statement of who owns whom today.
If that relationship is decisive for you, it is a reasonable thing to ask Nord Security directly, and a reasonable reason to prefer a provider with a simpler corporate structure such as Proton VPN.
What the audits actually cover
NordVPN has now completed six independent no-logs assurance engagements. The most recent was carried out by Deloitte Lithuania under ISAE 3000 (Revised), with the auditors given access to NordVPN's systems from 10 November to 12 December 2025. They interviewed staff, inspected server infrastructure and technical logs, and reviewed the privacy relevant configuration of standard, Double VPN, Onion Over VPN and obfuscated servers.
This is meaningfully better than the industry norm, and repeating it six times matters more than any single pass. But it is worth being precise about what an assurance engagement is:
- It is a point in time examination of configuration and process, not continuous monitoring. Nothing prevents a configuration changing the day after.
- It confirms that the systems are set up consistently with the stated no-logs policy. It is not a mathematical proof that no data has ever been retained anywhere.
- The auditor is engaged and paid by NordVPN, which is how every VPN audit in the industry works, and is a limitation of the whole category rather than of this company.
Compared with providers who have never submitted to one, six repeat engagements from a Big Four firm is a strong record. Treat it as the best available evidence, not as a guarantee.
The 2018 server breach, and how it was handled
In October 2019, NordVPN confirmed that one rented server in a Finnish data centre had been accessed by an attacker in March 2018. The route in was an insecure remote management system that the data centre provider had left in place without telling NordVPN. The company said no user activity logs existed on the server to be taken, and it subsequently terminated the provider and moved toward audited infrastructure and diskless RAM servers.
Two honest readings coexist. The exposure was narrow and the no-logs design limited what could be lost. The disclosure also came roughly a year and a half after the event, which was slow, and NordVPN was criticised for it at the time. We mention it because a page about trust that omits the one time trust was tested would not be worth reading.
Is NordVPN owned by Kape Technologies?
No. This comes up because Kape Technologies has bought a large share of the market: ExpressVPN, CyberGhost, Private Internet Access and ZenMate are all Kape owned. Kape also owns vpnMentor and Wizcase, two of the largest VPN review sites, acquired with their parent Webselenese for about $149.1m in March 2021.
NordVPN has never been part of that group. Kape itself was called Crossrider until 2018, when it rebranded after exiting a business whose platform was widely used to distribute adware, and it was taken private in 2023 by Unikmind, the vehicle of the Israeli businessman Teddy Sagi, in a deal valuing it at about $1.6bn.
The full picture is on our VPN ownership map.
If you have decided on NordVPN
This is our affiliate link. Using it costs you nothing extra and pays us a commission, which is how this site is funded. If you would rather we were not paid, go to nordvpn.com directly, and the page above is the same either way.
Visit NordVPNAffiliate link. We are paid a share of the first subscription and a smaller share of renewals. Longer plans pay us more, which is a conflict you should know about: if a one month plan suits you better, buy the one month plan.
Common questions
Is NordVPN owned by China?
No. There is no Chinese ownership in the structure. NordVPN was founded in Lithuania in 2012, its service company is registered in Panama, its holding company is registered in London, and its named outside investors are European and American firms. The rumour circulates widely and has no basis in the corporate record.
Does NordVPN own Surfshark?
They share a parent rather than one owning the other. Nord Security and Surfshark merged in 2022, so both now sit under the same group. Both companies state the brands continue to operate as separate products with separate infrastructure. If you are comparing them as independent alternatives, they are not fully independent at the corporate layer.
Who founded NordVPN?
Tomas Okmanas and Eimantas Sabaliauskas, two Lithuanians who had known each other since childhood. They launched NordVPN in 2012 and are co-chief executives of Nord Security today. They remain the controlling shareholders, which is unusual in a category where most large brands have been sold to holding companies.
Is a Panama incorporation actually meaningful?
Partly. Panama has no mandatory data retention law and is outside the main intelligence sharing arrangements, so there is no standing legal obligation to keep records. What jurisdiction cannot do is make a provider immune from every legal process, and it says nothing about whether the technical no-logs claim is true. That is what the audits are for, and jurisdiction and audit should be read together rather than either alone.
Does ownership actually matter when choosing a VPN?
More than most product features do. A VPN provider sees the traffic your internet provider would otherwise see, so you are moving trust rather than removing it. Who ultimately controls the company, which legal system it answers to, and whether that owner also controls the sites recommending it are all part of the product. Connection speed is easy to test and easy to switch away from. Ownership is neither.
Commercial disclosure
The Quiet Web earns affiliate commission from NordVPN. If you subscribe through our link we are paid a share of that subscription and a smaller share of renewals in later years. It costs you nothing extra.
That gives us a bias, and this page is about NordVPN, so it is worth naming it exactly. We are paid more when you buy a longer plan. We are not paid by Kape Technologies, ExpressVPN, CyberGhost, Private Internet Access, ZenMate, Surfshark or Proton, so we have a commercial interest in the Kape ownership story being interesting to you.
What we have done about it: published the criticisms of NordVPN alongside the case for it, including the Tesonet question and the 2018 breach, sourced the claims so you can check them, and said plainly where the public record is unclear rather than picking whichever version helps the sale.
Sources
- NordVPN customer support documentation on where NordVPN is based, covering the Panama incorporation of the service entity.
- Nord Security corporate disclosures and funding announcements covering the Nordsec Ltd holding structure, the founders' controlling stake, the 2022 Surfshark merger, and investment from Novator Ventures, Burda Principal Investments, General Catalyst and Warburg Pincus.
- NordVPN, "NordVPN passes its no-logs assurance assessment for the sixth time", 2026, covering the Deloitte Lithuania engagement under ISAE 3000 (Revised) with system access from 10 November to 12 December 2025.
- NordVPN public statement of October 2019 on the March 2018 Finnish data centre server breach, and contemporaneous press coverage of the disclosure delay.
- Kape Technologies plc announcements: acquisition of Webselenese Ltd, March 2021, consideration $149.1m; acquisition of ExpressVPN, September 2021, $936m; the 2018 rebrand from Crossrider; and the 2023 Unikmind take private and AIM delisting.