NordVPN operates out of Panama, a non-Five-Eyes jurisdiction that has no data retention laws. Reportedly, NordVPN has a parent company, Lithuania-based Tesonet.