crackthe.net
Audits and no-logs claims: what they can and cannot prove
What a no-logs policy promises, what an outside audit checks, its limits, and which audits the providers in this archive describe on their own websites.
Key points
- A no-logs policy is a provider’s promise not to record what you do online.
- An audit is a check by an outside firm. It shows the state at the time of the check, within the scope the provider agreed to.
- This archive has recorded a published audit for 6 of 13 providers so far, as they describe them. For the others, audits are not recorded yet, which does not mean there are none.
Kinds of audits
| Kind | What it checks | Typical limit |
|---|---|---|
| No-logs assurance | whether servers and systems are set up as the policy says | a point in time; the full report is often for customers only |
| Infrastructure audit | security of servers and networks | finds weaknesses, does not prove the absence of logging |
| App audit | security of the apps | covers one version of one app |
| Protocol audit | the design and code of a VPN protocol | says nothing about how servers are run |
What providers here describe
The following comes from the providers’ own websites, each linked to its source:
ExpressVPN: Its trust center lists 28 external audits; KPMG last checked its privacy commitments in June 2025.
IVPN: Commissions an annual security audit from Cure53; the eighth audit was scheduled for July 2026.
Mullvad: Publishes external security audits on its blog; the most recent ones listed are from January, March, and June 2026.
Private Internet Access: Its blog describes three reviews of its VPN infrastructure by Deloitte Audit Romania; the first two were in 2022 and 2024.
Proton VPN: Has its no-logs policy audited annually by Securitum; the fifth audit was published in 2026.
Surfshark: Its trust center lists external audits, including no-logs checks by Deloitte in 2023 and 2025 (the full report is for customers only) and infrastructure audits by SecuRing (2025) and Cure53 (2026).
What an audit cannot prove
- The future. A system can change the day after the check.
- What was out of scope. An audit only covers what the provider asked the auditor to check.
- What happens under pressure. Authorities can request data under the law of the company’s seat. Some providers point to court cases where they could not hand over data; those are their own statements.
How to weigh it as a buyer
An audit is a signal, not a guarantee. Look at how recent it is, who did it, what it covered, and whether the report is public. Combine it with facts you can check yourself: where the company is based, who owns it, and what its own website loads. The guide Who owns your VPN? shows how.
Not a rating: this site does not rate audits. It records what each provider states, with a link to its source and the date it was checked.
Next step
Your privacy does not end with the VPN. Read Beyond the VPN: private email.
The figures in this guide come from the archive and change with every data update. As of October 17, 2026.
Check it with the archive's data
Read next: Beyond the VPN: private email with Proton Mail and HushmailAll guides