Just to say, I'm not a shill for NordVPN - no affiliation with them. I was wanting to reiterate a hosted option vs self-install and it was the first one that came to mind. Noted they are not good!

Why are they bad?

Last time they had a breach, they took 6 months to notify the public and did everything in their power to blame anyone else. [0]

The breach was limited - but it doesn't inspire confidence.

[0] https://www.techradar.com/news/whats-the-truth-about-the-nor...

I get your point here, but its been years since that happened and they kept clean since then as far as I know. That server didn't store any user data just as none of their servers do, I've also read their audits and no evidence of logs were ever found. Even with that breach, it was not directly their fault, but a data center that left a backdoor. Since then they cut ties with the and nothing similar happened again. What I'm trying to say is that no one is 100% safe from a breach as the tech world changes daily and new exploits are growing just as fast. Once company can stay breach free for a decade and then get one. All that such companies can do is work to constantly improve and keep such problems under control.

No one is immune to a breach. You're absolutely right. Which is why the response to the breach is what is so important.

NordVPN left the backdoor open themselves - they left a remote admin console enabled. Then, they proceeded to hold their silence for _six months_, before informing their customers... And take no responsibility. They struggled to even admit they got their dates wrong.

That kind of behaviour, and lack of transparency, is the problem. Not that a breach occurred.

Sleazy marketing promises makes me dismiss them outright.