The only incident I know of with Nord is that they had a vulnerability that potentially exposed people's data in 2018 and they didn't disclose it to customers for several months. Their reasoning was they wanted to make sure it was fixed first. They also have automatic renewal which most VPNs don't, and I think that's bitten people before since it's non-standard practice.

On the other hand, iVPN wasn't using proper encryption on some of their overseas servers so a few Ukrainian servers that got seized we potentially left wide open. They did disclose it immediately and fixed it.

Other than that, I think it's all vibes because of how they do their marketing. Which isn't as bad as this Hitler ad, but they aren't very discerning who they do business with and will let just about anyone do ad reads for them. Including relatively problematic Youtubers like SsethTzeentach and The Internet Historian. I think they're somewhere in the middle with cringe marketing but no outright right wing stuff yet.

Just because I also tried Proton recently, I'll mention their split tunnel feature literally just didn't work at all in the app or the browser extension and I've seen reports going back 7 months that it has been broken intermittently on Linux for that entire time, so they still don't care about Linux at all.

Luckily, all of them have a one-time 30-day no questions asked refund policy and I've had no problems getting the refund processed while going through the motions to find one that works. Mullvad was last on my list since they're one of the outright worst and I did notice that Windscribe marketing seemed to be edgy 14 year olds, but I don't think they ever posted anything this bad before.