{"description":"What a no-logs policy promises, what an outside audit checks, its limits, and which audits the providers in this archive describe on their own websites.","language":"en","latest_measurement":"2026-10-17","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"Key points\nA no-logs policy is a provider\u0026rsquo;s promise not to record what you do online. An audit is a check by an outside firm. It shows the state at the time of the check, within the scope the provider agreed to. This archive has recorded a published audit for 6 of 13 providers so far, as they describe them. For the others, audits are not recorded yet, which does not mean there are none. Kinds of audits KindWhat it checksTypical limit No-logs assurancewhether servers and systems are set up as the policy saysa point in time; the full report is often for customers only Infrastructure auditsecurity of servers and networksfinds weaknesses, does not prove the absence of logging App auditsecurity of the appscovers one version of one app Protocol auditthe design and code of a VPN protocolsays nothing about how servers are run What providers here describe The following comes from the providers\u0026rsquo; own websites, each linked to its source:\nExpressVPN: Its trust center lists 28 external audits; KPMG last checked its privacy commitments in June 2025. IVPN: Commissions an annual security audit from Cure53; the eighth audit was scheduled for July 2026. Mullvad: Publishes external security audits on its blog; the most recent ones listed are from January, March, and June 2026. Private Internet Access: Its blog describes three reviews of its VPN infrastructure by Deloitte Audit Romania; the first two were in 2022 and 2024. Proton VPN: Has its no-logs policy audited annually by Securitum; the fifth audit was published in 2026. Surfshark: Its trust center lists external audits, including no-logs checks by Deloitte in 2023 and 2025 (the full report is for customers only) and infrastructure audits by SecuRing (2025) and Cure53 (2026). What an audit cannot prove The future. A system can change the day after the check. What was out of scope. An audit only covers what the provider asked the auditor to check. What happens under pressure. Authorities can request data under the law of the company\u0026rsquo;s seat. Some providers point to court cases where they could not hand over data; those are their own statements. How to weigh it as a buyer An audit is a signal, not a guarantee. Look at how recent it is, who did it, what it covered, and whether the report is public. Combine it with facts you can check yourself: where the company is based, who owns it, and what its own website loads. The guide Who owns your VPN? shows how.\nNot a rating: this site does not rate audits. It records what each provider states, with a link to its source and the date it was checked.\nNext step Your privacy does not end with the VPN. Read Beyond the VPN: private email.","title":"Audits and no-logs claims: what they can and cannot prove","url":"https://crackthe.net/learn/vpn-audits-and-no-logs/"}