NordVPN - Economic Audit

Executive Summary

This Economic audit examines NordVPN and its corporate parent, Nord Security (holding structure Cyberspace B.V.), for economic ties to Israel, Israeli-controlled territory, or Israeli state and defense interests. NordVPN was founded in Lithuania in 2012 and operates as a privately held, digitally delivered VPN/cybersecurity service with no disclosed physical goods supply chain, no Israeli incorporation, and no identified Israeli beneficial ownership ¹²³⁴⁵. The most substantive findings in this audit relate not to NordVPN’s own conduct but to the separately documented Israel-market investment activity of two of its minority institutional investors, Warburg Pincus and General Catalyst, which is flagged here as investor-level (not target-level) exposure ^{678910111213141516}.

Supply Chain & Sourcing Relationships

NordVPN/Nord Security is a software and digital-services company and does not maintain a physical goods supply chain, agricultural sourcing network, or importer-of-record structure of the kind typically assessed under this rubric ¹. No public evidence identified of direct supplier relationships with Israeli agricultural aggregators or exporters, of an importer-of-record structure involving Israeli-origin goods, of seasonal sourcing patterns tied to Israeli producers, or of third-party/indirect sourcing of Israeli-origin goods through intermediaries. No public evidence identified.

Product Origin, Labeling & Regulatory Compliance

NordVPN’s product is a digital VPN and cybersecurity service, to which country-of-origin labeling regimes, customs/DEFRA-type findings, and settlement-origin product labeling frameworks do not apply as a matter of subject-matter fit ¹. No public evidence identified of settlement-origin product labeling issues, customs findings, or country-of-origin compliance or non-compliance actions involving NordVPN or Nord Security. No public evidence identified of any corporate policy statement by NordVPN/Nord Security specifically addressing sourcing or labeling of goods from occupied or contested territories.

Investment, Capital & Financial Exposure

Target-level foreign direct investment. No public evidence identified of NordVPN/Nord Security making operational investments - acquisitions, factories, data centers, logistics hubs, or real estate - in Israel or the Occupied Palestinian Territories. NordVPN markets approximately 20 virtual VPN server nodes physically located in Israel (including Tel Aviv) as part of its global network of more than 8,900 servers, hosted on leased third-party data-center rack space; the identity of the underlying Israeli data-center operator(s) is not publicly disclosed in available sources ¹. This is characterized as a leased-infrastructure footprint rather than an operational investment, acquisition, or subsidiary presence.

R&D and innovation centres. No public evidence identified of any NordVPN/Nord Security research, development, or innovation centre located in Israel; the company’s primary engineering and R&D base is documented in Vilnius, Lithuania ¹¹⁷.

Capital structure and financing rounds. Nord Security first took outside capital at a $1.6 billion valuation in April 2022 ¹⁸. In September 2023, Warburg Pincus led a further $100 million round at a $3 billion valuation intended to fund acquisitive growth, with Warburg Pincus securing board representation and veto rights over major corporate events such as an IPO or sale ⁶⁷. Novator Ventures holds a board seat via Birgir Már Ragnarsson, in place since April 2022 ¹⁹. Nord Security has also publicly discussed profitability and potential IPO plans while remaining privately held ¹⁷.

Investor-level Israel-market exposure (institutional, not the target itself). Warburg Pincus, Nord Security’s lead 2023 investor, has a documented history of Israel-focused private equity and growth investments, including: a $690 million buyout of Leumi Card, an Israeli credit-card services provider, closed February 2019 ¹¹; a $75 million investment in Personetics, an Israeli AI/fintech firm serving banks, announced February 2021 ¹⁰; a position as a listed shareholder in Claroty, an Israeli industrial/OT critical-infrastructure cybersecurity firm, whose $140 million Series D closed June 2021 ⁸⁹; and co-leading a $63 million round in MDClone, an Israeli synthetic health-data company, announced March 2022 ¹². Startup Nation Central’s investor database, last updated 19 February 2025, characterizes Warburg Pincus as presently inactive in new Israeli investments, with the most recently confirmed new deal dating to 2022 ¹³. General Catalyst, which participated in Nord Security’s 2022 funding round, is separately reported to be actively pursuing Israeli defense-tech investment as of 2024–2025, including delegation visits to Israel ¹⁴, and is listed as an investor in Conntour, a Tel Aviv-based AI video-surveillance startup founded in September 2024 whose team includes Israeli military, Unit 8200, and reportedly Mossad veterans; General Catalyst participated in Conntour’s $7 million seed round, reported 26 March 2026 ¹⁵¹⁶. No public evidence identified of direct Israel-focused investment activity by Novator Ventures in this research.

Portfolio and fund exposure (target’s own holdings). No public evidence identified of NordVPN/Nord Security itself holding Israeli-domiciled equities, Israeli sovereign bonds, or Israel-focused fund units; the company does not operate as an asset manager or fund vehicle ¹⁷⁷.

Financing the Israeli state. NordVPN/Nord Security is not a bank, insurer, asset manager, or underwriter, is privately held, and has no public financial filings ¹⁷⁷. No public evidence identified of NordVPN/Nord Security underwriting Israeli sovereign debt or war bonds, facilitating Israel Bonds sales, or providing trade finance or lending to Israeli defense primes or OHCHR-listed enterprises.

Operational Presence & Market Activity

No public evidence identified of NordVPN/Nord Security offices, sales operations, support centres, warehouses, or retail locations within Israel or the Occupied Palestinian Territories; documented physical corporate offices are in Lithuania, the United Kingdom, Panama, and the Netherlands ¹. No public evidence identified of any NordVPN/Nord Security workforce, payroll, or tax/regulatory registration within Israeli jurisdiction. No public evidence identified of NordVPN/Nord Security characterizing Israel as a distinct strategic market, export market, or regional hub in any investor communication, press release, or public statement, and the company does not publish annual reports or investor presentations of the type typically reviewed for this sub-category ¹⁷. The only identified Israel-located technical footprint is the leased virtual server presence described above ¹.

Corporate Structure & Foundational Ties

Founding and incorporation history. NordVPN was founded in Lithuania in 2012 by Tomas Okmanas and Eimantas Sabaliauskas, with early support from their Lithuanian accelerator/holding entity Tesonet, founded in 2008 ¹²³. It is not an acquired entity and has no documented Israeli-origin operations or brand identity. Nord Security’s disclosed acquisitions/mergers are Clario Tech (2021) and Surfshark (merged in 2022 via the Dutch holding vehicle Cyberspace B.V.) ¹; No public evidence identified that either entity was Israeli-founded, Israeli-headquartered, or Israeli-owned prior to its transaction with Nord Security, and No public evidence identified of any acquired Israeli operating company, manufacturer, or brand within the Nord Security group.

Headquarters and domicile. The NordVPN service entity is incorporated in Panama, chosen for its data-retention and privacy law regime; parent Nord Security operates through Cyberspace B.V., domiciled in the Netherlands; the principal operational and engineering base is Vilnius, Lithuania ¹⁴⁵. No dual or legacy headquarters in Israel are documented. Public commentary distinguishes NordVPN and its sibling brand Surfshark as not Israeli-owned, in contrast to Kape Technologies-owned VPN brands (ExpressVPN, CyberGhost, ZenMate, PIA), which are owned by Israeli-British businessman Teddy Sagi; this is noted as public discourse context rather than independent verification ²⁰.

State and institutional linkages. No public evidence identified of Israeli state ownership stakes, Israeli government board appointees, Israeli government contracts, or critical-national-infrastructure designation involving NordVPN or Nord Security. No public evidence identified of any Israeli Ministry of Defense, IDF, Israel Prison Service, Israel Border Police, or SIBAT-registry tender, contract, or listing involving Nord Security, NordVPN, NordLayer, NordPass, NordLocker, Tesonet, or Cyberspace B.V.

Structural governance features. No public evidence identified of golden shares, founder shares, or charter restrictions tying NordVPN/Nord Security’s governance to the Israeli state or its policy objectives; the documented governance features instead relate to Warburg Pincus and General Catalyst protective veto rights over IPO, sale, and charter events, which are unconnected to Israel ⁷.

Controlling principals. Nord Security’s named leadership team, including co-founders Okmanas and Sabaliauskas, co-founder Jonas Karklys, and function heads such as General Counsel Dina Lurje, shows no publicly documented personal or family-office investment into Israeli companies, Israeli settlement activity, or Israeli defense entities ²¹. No public evidence identified of Israel-linked personal investment activity by institutional board designees representing Novator Ventures, Warburg Pincus, or General Catalyst, distinct from the firm-level exposure of those investing entities documented above ¹⁹.

Authoritative watchlist screening. Screening of the OHCHR Database of Business Enterprises pursuant to Human Rights Council Resolutions 31/36 and 53/25 (most recently updated June 2023 and September 2025) returned no listing for NordVPN, Nord Security, Tesonet, Cyberspace B.V., or Surfshark ²²²³²⁴. Wikipedia’s compiled “List of companies operating in West Bank settlements,” which draws on the OHCHR list, likewise contains no entry for these entities ²⁵. PAX’s 2024 report “The Companies Arming Israel and Their Financiers,” which addresses financiers of six named European arms manufacturers, does not name NordVPN, Nord Security, Warburg Pincus, General Catalyst, or Novator within its financier list ²⁶. No public evidence identified of NordVPN/Nord Security inclusion on any of these authoritative watchlists.

Profit Repatriation & Economic Contribution

No public evidence identified of disclosed revenue figures specifically attributed to the Israeli market; the company is privately held and does not publicly break out country-level revenue ¹⁷. No profit-flow-into-Israel channel is documented, since no Israeli-domiciled ownership exists in the Nord Security/NordVPN structure; conversely, no Israel-sourced profit-repatriation-outward flow is documented, since no Israeli operating subsidiary of NordVPN/Nord Security exists ¹. No public evidence identified of any industry report or government designation characterizing NordVPN/Nord Security as a key employer, sector anchor, or infrastructure provider within the Israeli economy. Separately, NordVPN publicly documents philanthropic and nonprofit-partnership activity through its 2025 “wrapped” corporate blog post and its NordVPN.org digital-freedom initiative; no Israel-specific component of this nonprofit activity is identified in these sources ²⁷²⁸.

Group Attribution & Investor Exposure (Supplementary)

Cyberspace B.V. (Netherlands) is the holding company for Nord Security/NordVPN and Surfshark ¹. No public evidence identified of Cyberspace B.V. itself holding separate Israel-related investments, and No public evidence identified of sibling brand Surfshark having any Israel, West Bank, or settlement-related nexus. A multi-degree-removed chain was identified through Nord Security investor Warburg Pincus: Warburg Pincus retained an 18% stake in Allied Universal following CDPQ’s 2019 acquisition of a 40% stake from Wendel and Warburg Pincus ²⁹; Allied Universal acquired G4S in 2021; G4S had already divested its core Israeli security business (prisons, military checkpoints, West Bank operations) in December 2016 to Israeli fund FIMI for approximately $110 million ³⁰; and a residual Allied Universal/G4S contract training and servicing Israel’s national police academy was reported in June 2023 as being sold to G1 Secure Solutions (formerly G4S Israel), pending Israeli regulatory approval, with the completion date not confirmed in available sources ³¹. This chain is flagged as an investor-of-an-investor relationship several degrees removed from NordVPN, not a NordVPN or Nord Security operational relationship, and the underlying divestiture predates the constructive-notice dates used elsewhere in this audit. Broader private-equity-sector context on Israel-linked war profiteering is documented by the Private Equity Stakeholder Project ³².

Constructive Notice & Settlement Nexus (Supplementary)

No NordVPN/Nord Security operation, sale, listing, service, sourcing arrangement, or revenue stream in or to West Bank, East Jerusalem, or Golan Heights settlements was identified in this research, consistent with the company’s status as a digital software provider with no reseller, franchise, or physical distribution network located in the Occupied Palestinian Territories. No public evidence identified. The only constructive-notice-relevant activity identified in the broader investor network after the 19 July 2024 ICJ advisory opinion and November 2024 ICC arrest warrants is the General Catalyst–Conntour investment reported in March 2026, which remains an investor-of-investor relationship rather than a Nord Security or NordVPN corporate act ¹⁵¹⁶.

End Notes