NordVPN reveals the results of several audits on its apps and network

NordVPN recently announced that it has completed a third audit of its no-logs policy. It showed, for the third time, that the company does what it says in its privacy policy and does not log information about how its customers use its service.

Now it has revealed more audit results, this time for the security of its apps, website, servers and infrastructure.

Berlin-based Cure53 ran tests from July to October 2022, and NordVPN has made both reports available for anyone to read. You can find Application Audit here and Server Audit here.

And if you read them, you’ll see that Cure53 found a few issues, albeit only one potentially dangerous one, in the macOS app. But this and all other issues highlighted in the reports have been fixed and these fixes were later verified and approved by Cure53.

This all might sound rather dull and boring, but it’s important. This demonstrates that NordVPN is happy to be transparent about their service, something you won’t find with all VPN services. Moreover, audits are not simply performed to prove that there are no security vulnerabilities. They help identify vulnerabilities and fix them, as was the case here.

“Dedication to product development and a satisfied customer always pays off. We are continually improving the overall performance of our service and developing advanced VPN features, providing our users with increased online security. Our developers have fixed all detected vulnerabilities, and they have been approved by Cure53, ensuring that NordVPN has correctly implemented all mitigations,” says Marijus Briedis, CTO at NordVPN.

While auditing NordVPN’s apps, Cure53 noted that it had identified “a total of twenty-two (issues). Six of the findings were classified as security vulnerabilities, while the remaining sixteen were deemed to be security vulnerabilities. general weaknesses with lower potential for exploitation.

“Conversely, the scope covering Android apps generated a considerably positive impression, largely due to the fact that only minor findings of informational severity were identified here.”

Regarding the server and infrastructure audit, Cure53 said, “Overall, the overall performance of the findings documented in this report is relatively moderate, which is a positive indication of the state of Perceived security of NordVPN servers and infrastructure. This impression is also supported by the fact that of the eleven findings, only one was considered a security vulnerability, while all other findings were considered miscellaneous in nature and should be trivially easy to address and mitigate.

Audits are important because VPN services are built on trust. As a customer, you need to know that your data is kept safe and your activity is not logged.

There are plenty of VPN services you can choose from, but you’re much more likely to choose one that’s been audited.

NordVPN isn’t the only service to order audits. ExpressVPN has made a similar selection over the past year, while Surfshark recently confirmed the results of its first no-logs audit.

Private Internet Access, CyberGhost, Proton, and PureVPN also had no-logs audits in 2022, which is nice to see and means there’s more to choose from if you only plan to use an audited VPN.

Of course, the ideal situation is when these audits take place regularly, and especially if the VPN service changes ownership.