Every VPN says it keeps no logs. An independent audit is the closest thing to evidence. Here's who has been audited, by whom, and what that does and doesn't prove.
| Provider | What's been independently checked |
|---|---|
| Proton VPN | No-logs policy audited by Securitum every year from 2022 to 2026; open-source apps; Swiss jurisdiction |
| NordVPN | No-logs policy independently audited six times since 2018, most recently a Deloitte assurance report in late 2025 |
| ExpressVPN | More than 20 published third-party audit reports covering its no-logs policy, servers and apps |
| Surfshark | No-logs policy verified by Deloitte in 2023 and 2025; infrastructure reviewed by Cure53, most recently in 2026 |
| Mullvad VPN | No email needed to sign up; cash payments accepted; server, app, web and API audits by Assured and X41 D-Sec, most recently January to February 2026 |
| Private Internet Access | No-logs policy verified by Deloitte in 2022 and 2024 |
| CyberGhost | No-logs policy verified by Deloitte in 2022, 2024 and February 2026; quarterly transparency reports; based in Romania |
| Windscribe | No standalone no-logs audit, but its claims have been tested in practice: a Greek criminal case was dismissed in 2025 because it held no user data, and a server seized by Dutch authorities in 2026 held none. Server infrastructure penetration-tested by Packetlabs (June 2024); open-source apps |
Verified 16 Oct 2026. Each provider's profile lists its sources.
What an audit proves
That a qualified outside firm examined specific systems at a specific time and found them configured the way the company claims. Repeated audits, year after year, are much stronger evidence than a single one.
What it doesn't prove
- That nothing changed afterwards. An audit is a snapshot.
- That everything was checked. A no-logs audit, an app security test and an infrastructure review cover different things. Read the scope.
- Complete independence. The VPN company chooses and pays the auditor. Reputable firms still put their name on the findings.
How we use audits
At least one independent audit in the last three years is a minimum requirement for our shortlist. Beyond that, the number, recency and scope of audits make up a large part of the privacy score, which carries the most weight in our evaluation.
The short versionAn audit isn't a guarantee, but a VPN that won't be audited is asking for blind trust.