These risks apply to every Nord Security product. They are legal obligations and corporate practices that individual products cannot override. A subsidiary cannot opt out of an FTC consent decree. A company cannot selectively ignore its home country's intelligence law for one product. These risks set a grade floor of B+ — no Nord Security product can score better than this, regardless of its own privacy settings.