I'm pretty sure it's based in Panama and being a global brand, NordVPN must have offices in a lot of locations, but it's main one is in Panama, which is a pro data privacy country. Moreover, even if some security agency would ask for user data, Nord does not keep logs and has most of its servers operate in RAM only.