No-Logs VPN Audits: What They Prove in 2026

What the no-logs label means—and what an audit adds

A no-logs policy is a provider’s statement about the information it does not collect or retain about your VPN activity. That could include browsing destinations, connection timestamps, or details linking activity to an account. The exact promise varies, so read the policy itself rather than assuming every provider means the same thing by “no logs.”

An independent audit adds an external examination of some part of that promise. Auditors may inspect systems and records, speak with staff, and compare the provider’s stated practices with how its infrastructure is configured. A report can give you evidence that the examined systems matched the policy during the audit. It is not a guarantee that no data is ever collected, or that every server and process was checked.

Our table is filtered to plans tagged with an independently audited no-logs policy. That label is a useful starting point, not a complete audit record: the listing itself does not name the auditor, date, scope, or frequency. Open the provider’s report and look for those details before treating two “audited” labels as equivalent.

Who performed the audit?

The firm matters because you want an identifiable auditor with relevant assurance experience, not just a provider’s claim that “an audit” happened. Coverage of published reports names PwC for NordVPN audits in 2018 and 2020, followed by Deloitte for audits from 2022 to 2025. CyberGhost reports two independent audits by Deloitte, while Proton VPN’s no-logs audits have been performed by Securitum.

Those examples show why you should check the report, not rely on a familiar firm name repeated in a listing. Confirm that the report concerns the no-logs policy and the provider you are considering. A security review of an app, for instance, is not automatically a review of server logging. One critical interpretation of an ExpressVPN assessment has questioned whether it covered server infrastructure; don’t treat that interpretation as a settled description of the report.

Independence also has limits. Providers generally hire and pay the auditor, and the engagement defines what is examined. That does not make the work meaningless, but it gives you a reason to inspect the scope, access arrangements, and any qualifications in the report. Across all plans in our full VPN comparison, prices range from $0.83 to $5.01 and were last synced on 31 October 2026. Price freshness does not tell you whether an audit is recent.

What an auditor can inspect

A useful report explains the work rather than stopping at a conclusion. Depending on the engagement, auditors might interview staff, review configuration files, examine live system logs over a defined period, or inspect the systems used to manage configuration changes. Reports about NordVPN have described staff interviews, configuration-file review, and inspection of live system logs during a fixed audit window. Proton’s Securitum audits have been described as reviewing configuration management, monitoring tools, and alerts intended to detect changes that could affect its no-logs posture.

Look closely at what infrastructure was in scope. Did the auditor examine production VPN servers, supporting systems, or only selected locations? Were staff processes and access controls included? A report covering a limited sample may still be useful, but it should not be read as a check of every machine, employee, and future configuration. Likewise, reviewing a VPN app is different from inspecting the server systems that handle connections.

Access matters too. An auditor who can independently inspect relevant systems has a different view from one relying heavily on demonstrations arranged by the provider. Some commentary describes Proton audit work as operator-assisted, with Proton staff demonstrating systems rather than auditors having full independent remote access. Check the report’s own description of access and evidence; don’t infer the level of access from the word “independent” alone.

Read the date and scope, not just the conclusion

An audit is evidence about a defined engagement, not continuous surveillance of a provider’s systems. Note the date of the work, the dates covered by any live inspection, and the report’s publication date: they may differ. A report that is several years old cannot tell you whether the same configuration is still in place today. Repeated audits can provide fresher evidence, but check the dates and scope of each rather than assuming a provider is audited annually.

Some critics describe an audit as a snapshot of the configuration auditors could access at a particular time. That is a fair reason to look for repeated assessments and clear boundaries, not a reason to dismiss every report. Auditors can examine configurations, database schemas, logs, and controls. They cannot prove that code for secret logging was never added, or establish what a developer intended. Treat the conclusion as a finding about the evidence examined, not a promise about every possible future event.

For a journalist, activist, or business handling sensitive work, ask for the full report or a detailed scope summary. If the provider offers only a badge, ask which systems and servers were examined, when, and whether the auditor could access them directly. Those answers are more useful than a generic claim that the policy is “verified.”

RAM-only servers are a separate safeguard

RAM-only servers store their running data in volatile memory rather than keeping it on a hard drive. When a machine powers down, its memory is erased. This can reduce what remains if a powered-off server is seized, but it does little to prevent collection from a running server or acquisition of its live memory. It also does not establish what the provider’s policy says it collects in the first place.

RAM-only infrastructure and an audited no-logs policy address different questions. The audit examines stated practices and selected systems; RAM-only operation can limit persistent data left on a server after shutdown. Neither control replaces the other. Some configuration files may still be stored on hard drives, as Surfshark has said about its setup, so “RAM-only” should not be taken to mean that every file on every server exists only in memory.

Not every provider uses RAM-only servers. In this filtered list, some plans carry that tag and others do not. Proton VPN has argued that seizing one of its powered-off servers would yield no more information than seizing a RAM-only server. Compare the specific infrastructure and audit evidence rather than treating the RAM-only label as a shortcut to a privacy verdict.

What past cases show—and how to check for yourself

Past cases are a reminder to test a policy against evidence, not to assume a label makes data impossible to obtain. In 2017, reporting on a Massachusetts cyberstalking case described the FBI using PureVPN connection logs to trace activity. PureVPN had advertised a no-logs policy; after the case, it published third-party audits of its policy. Earlier, 2011 reporting said HideMyAss handed over logs in a hacking case linked to the LulzSec investigation. These accounts concern specific cases and should not be stretched into claims about every provider or every legal request.

An audit also does not remove the possibility that a provider may be legally compelled to begin logging. Jurisdiction still matters, as do the provider’s procedures for responding to legal demands. An audit and RAM-only servers may reduce particular risks, but they cannot guarantee how a company will respond to future orders or changes in law.

Before choosing a plan, use this checklist:

• Date: When did the examination take place, and has the provider published a more recent report?
• Firm: Is the auditor named, and does the report identify its role?
• Scope: Does the work cover server infrastructure and logging controls, or a different part of the service?
• Access: Did auditors inspect systems directly, use a sample, or rely on provider-led demonstrations?
• Limits: What locations, systems, time periods, or processes were excluded?

When a report leaves one of those points unclear, ask the provider before you rely on the claim. The filtered table can narrow your shortlist; the report tells you how much weight to give each audit.