How to verify a VPN’s no-logs claims: reading audit reports
How to evaluate a VPN like a security professional: policies, jurisdictions, audits, and honest speed tests.
How to verify a VPN's no-logs claims: reading audit reports
Every VPN provider promises they don't log your activity. Most claim "zero logs" or "strict no-logs policy" in bold text on their homepage. But marketing copy isn't evidence. The only way to know if a VPN actually keeps its logging promises is to examine independent third-party audits—and understand what those audits actually tested.
This chapter walks you through reading VPN audit reports like a skeptical professional. You'll learn what separates theater from substance, which audit firms have credibility, and what red flags to watch for when a provider waves an "audited!" badge.
Why audit reports matter more than privacy policies
A privacy policy is a legal document the company writes about itself. It can say anything. "We don't log" is easy to type. Proving it requires external verification.
Third-party audits serve as evidence. A reputable firm examines the VPN's infrastructure, reviews server configurations, tests logging capabilities, and documents what they find. The best audits are published publicly so you can read the methodology and findings yourself.
Without audits, you're trusting the provider's word. With audits, you're trusting verifiable technical analysis.
The difference: Mullvad publishes detailed audit reports from Cure53 examining their infrastructure and apps. You can download the PDFs and see exactly what was tested. Contrast that with smaller providers who claim "no logs" but have never submitted to independent review. Which would you trust with your browsing history?
Types of VPN audits and what they actually test
Not all audits examine the same things. Understanding the scope helps you judge whether an audit actually verifies no-logs claims or just checks surface-level security.
No-logs policy audits examine whether the VPN's infrastructure is configured to avoid logging user activity. Auditors review server setups, database schemas, log file locations, and data retention systems. They verify that connection timestamps, IP addresses, DNS queries, and traffic destinations aren't being recorded or stored.
Infrastructure audits verify technical claims like RAM-only servers or diskless operation. If a provider claims servers wipe all data on reboot, auditors test that claim by examining server hardware and configurations.
Application security audits focus on the VPN client software. Security researchers analyze the Windows, macOS, iOS, and Android apps for vulnerabilities, data leaks, or unexpected behavior. These matter for user safety but don't directly verify logging practices.
Transparency reports aren't audits but provide supporting evidence. Some providers publish regular reports showing how many legal requests they received and what data they could provide (ideally: none, because they don't log).
When evaluating a VPN's "audited" claim, first question: which type of audit? An app security audit is valuable but doesn't verify no-logs promises. You need infrastructure and policy audits for that.
Reputable audit firms vs. questionable certifications
The auditing firm matters as much as the audit itself. A few firms have established track records in privacy and security. Others are marketing partners disguised as auditors.
Credible firms include:
- Cure53: German security firm that's audited Mullvad, IVPN, and ProtonVPN. Their reports are technically detailed and publicly available. They have no financial stake in positive findings.
- Deloitte: Major accounting firm that's conducted infrastructure audits for ExpressVPN and others. They examine operational practices and technical infrastructure with forensic rigor.
- VerSprite: Cybersecurity firm that's reviewed VPN providers' privacy claims and server architectures. Less common than Cure53 but credible.
- KPMG and PwC: Occasionally audit VPN infrastructure as part of broader security assessments.
- Audit firms you've never heard of with no public portfolio
- "Certifications" instead of audits—ISO compliance or TrustArc badges verify process adherence, not technical claims
- Audits that aren't published or are summarized in vague marketing language
- Audits conducted by the VPN's parent company or close business partners
- One-time audits from years ago with no follow-ups
Reading an audit report: what to look for
When you find a published audit, here's how to evaluate it:
Check the scope section first. The audit should explicitly state what was examined. Look for phrases like "server infrastructure review," "log file analysis," or "data retention policy verification." If the scope is vague ("reviewed security practices") or limited to app code, it likely didn't verify logging claims.
Examine the methodology. How did auditors test their conclusions? Did they access production servers or just review documentation? Did they simulate real user connections and trace what data was stored? Stronger audits involve hands-on technical testing, not just policy review.
Read the findings and limitations sections. Auditors should state what they couldn't verify or what assumptions they made. If an audit claims "no logs found" but notes they only examined a sample of servers or only reviewed configurations at a single point in time, factor that limitation into your trust.
Look for specific technical details. Good reports mention exact server locations checked, operating system configurations examined, and database queries run. Vague findings suggest superficial review.
Note the date and any follow-ups. An audit from 2019 tells you what was true then. Infrastructure changes. Annual or biannual re-audits show ongoing commitment. One-time audits might have been accurate once but offer no current assurance.
Example: Mullvad's 2020 infrastructure audit by Cure53 examined 36 servers across their network, verified RAM-only operation, checked for log files in standard locations, and tested data persistence after reboot. The report runs 22 pages with technical details. That's thorough. Compare that to a two-page summary stating "we reviewed policies and found them satisfactory."
What audits can't tell you
Even excellent audits have limits. Understanding these helps you maintain appropriate skepticism.
Audits are snapshots in time. A company can change logging practices after an audit completes. Annual re-audits reduce this risk but don't eliminate it.
Auditors can only examine what they're shown. If a VPN operates secret logging servers not disclosed to auditors, those won't appear in findings. You're trusting both the auditor's competence and the provider's honesty about what infrastructure exists.
Audits don't cover legal compulsion. A no-logs audit verifies the provider doesn't log by choice. It can't prevent a government from compelling logging in the future or secretly requiring it now. This is where jurisdiction matters—a topic we cover elsewhere in this section.
No audit catches everything. Even reputable firms miss things. Security vulnerabilities get discovered after audits. Logging systems might activate under specific conditions auditors didn't test.
Published audits are the exception. Most VPNs haven't been audited at all. Among those that have, many don't publish full reports. Limited transparency makes verification impossible.
Treat audits as strong evidence, not absolute proof. They meaningfully reduce uncertainty but don't eliminate it.
Questions to ask when a VPN claims "audited"
When a provider advertises an audit, here's your checklist:
1. Who conducted the audit? Is the firm recognizable and independent? 2. When was it performed? Anything older than two years is stale. 3. What was the scope? Did it specifically examine logging practices and infrastructure, or just app security? 4. Can I read the full report? If it's not publicly available, why not? 5. Were findings addressed? If auditors identified issues, were they fixed and re-verified? 6. How often are audits repeated? One-time or annual? 7. Are there any disclaimers or limitations? What couldn't be verified?
If answers to these questions are vague, missing, or buried in marketing language, that "audited" badge doesn't mean much.
Combining audits with other verification methods
Audits work best alongside other evidence:
Jurisdiction and legal history: A VPN based in a privacy-friendly jurisdiction with no history of cooperation with surveillance requests adds credibility. If audits say "no logs" but the company's based somewhere with mandatory data retention laws, weigh that contradiction.
Transparency reports: Providers that publish regular reports showing law enforcement requests and their responses (ideally: "we had no data to provide") demonstrate consistency between claims and practice.
Warrant canaries: Some providers maintain canaries—statements they haven't received secret court orders. If a canary disappears, logging might have been compelled.
Real-world tests: Occasionally, law enforcement seizes VPN servers. If authorities find no user logs on seized hardware, that's powerful validation. This happened with ExpressVPN in 2017 when Turkish authorities seized a server and found no useful data.
Source code publication: Open-sourcing VPN apps (not the infrastructure, which would be a security risk) allows security researchers to verify clients don't leak data or maintain hidden logs. ProtonVPN and Mullvad publish client source code.
No single verification method is perfect. Stack multiple forms of evidence to build confidence.
Red flags that should override audit claims
Even if a VPN has been audited, certain red flags should make you reconsider:
- Free VPN with "audited no-logs": Free VPNs need revenue. If not from subscriptions, then from data. An audit can't change business model incentives.
- Recent ownership changes: New owners might alter practices. Post-acquisition audits matter more than pre-acquisition ones.
- Jurisdiction conflicts: Audited no-logs mean little if local laws require logging. Check whether the provider has complied with data retention mandates.
- Undisclosed parent companies: If you can't easily identify who owns the VPN, audits become less meaningful. Hidden ownership suggests hidden incentives.
- Marketing exaggeration: If a provider overstates what an audit verified ("guaranteed zero logs forever!"), treat other claims with skepticism.
Practical example: comparing two audit reports
Provider A publishes a 2-page summary stating "Independent security firm reviewed our privacy policy and confirmed our no-logs claims." The summary doesn't name the firm, explain methodology, or include technical findings. There's no full report available.
Provider B publishes a 30-page report from Cure53 dated six months ago. The report names specific servers examined, includes command outputs showing no log files, documents database schema reviews, tests data persistence after reboot, and lists two minor findings (since fixed). A follow-up audit is scheduled in six months.
Which provider's claims would you trust? Provider B's audit offers verifiable evidence. Provider A's "audit" is marketing.
This pattern repeats across the industry. Learning to spot the difference protects you from convincing-sounding but unverifiable claims.
What to do if your VPN hasn't been audited
Most VPNs—even popular ones—haven't undergone third-party audits. That doesn't automatically disqualify them, but it increases the trust you're placing in their word alone.
If choosing an unaudited VPN, look for:
- Long-standing reputation: Years of operation without privacy scandals suggests consistency, though it's not proof.
- Technical transparency: Providers that explain their infrastructure in detail, publish server lists, and engage with the security community show confidence in their practices.
- Legal track record: Check whether they've ever been compelled to provide user data. If they've faced legal pressure and had no logs to hand over, that's supporting evidence.
- Open-source clients: While not equivalent to infrastructure audits, open clients allow community verification of app behavior.
Key takeaways
- Marketing claims aren't evidence. "No-logs" promises mean nothing without independent verification.
- Audit type matters. Application security audits don't verify logging practices—you need infrastructure and policy audits for that.
- Check who conducted the audit. Cure53, Deloitte, and similar firms have credibility. Unknown "certification" companies don't.
- Read the full report if available. Scope, methodology, and limitations tell you what was actually verified.
- Look for repeated audits. One-time audits become stale. Annual reviews show ongoing commitment.
- Combine audits with other evidence. Jurisdiction, transparency reports, legal history, and real-world tests together build trust more than any single factor.