https://www.pcmag.com/news/nordvpn-actually-we-do-comply-with-law-enforcement-data-requests

"From day one of our operations, we have never provided any customer data to law enforcement, nor have we ever received a binding court order to log user data. We never, for a second, logged user VPN traffic, and the results of multiple audits prove that we are true to our policies," the company said.

In the event the company does receive information requests from a law enforcement agency, NordVPN says it "would do everything to legally challenge them."

"However, if a court order were issued according to laws and regulations, if it were legally binding under the jurisdiction that we operate in, and if the court were to reject our appeal, then there would be no other option but to comply. The same applies to all existing VPN companies if they operate legally. In fact, the same applies to all companies in the world," NordVPN said.

So they don't log and are just admitting that they might need to if they were forced to. That is extremely reasonable.