VPN No-Logs Audits: Who Runs Them, What Gets Inspected and What They Can't Prove

When a VPN advertises an independently audited no-logs policy, it means an outside firm checked whether the provider's systems and procedures match the published policy and wrote up a conclusion. The provider pays for the review and negotiates its boundaries with the auditor.

Who performs a no-logs audit

Two types of firms take this work. Big Four accounting networks (Deloitte, KPMG and PwC are named in the site's data) handle it as an assurance engagement under a standard such as ISAE 3000 (Revised) from the IAASB, delivering a formal conclusion on whether stated controls match the policy. Because ISAE 3000 is principles-based, the auditor picks which controls to test, so the scope section matters more than readers assume.

Security and IT audit firms (Cure53, Securitum, Versprite, Altius IT in the records) send engineers to review servers, configuration files and code, sometimes with penetration tests, and produce a findings report. One entry in the site's data is a privacy policy review by Aon dated August 2023, a narrower check than a server inspection.

What auditors inspect

The written policy comes first: does every promise have a matching setting in the real systems, and do internal procedures define who may change logging settings. Next, server configuration: VPN server settings, debug and logging switches, what lands on disk, RAM-only operation if claimed, plus central systems for authentication, monitoring and management. A strong engagement verifies that the inspected configuration is what actually runs on live servers. Staff access is the third target: interviews about administrator rights, whether employees could switch logging on, and the change-management records behind those answers.

One date or an ongoing check

Most audits are point-in-time: the conclusion covers only the inspection date or a short window, often about a week, and later system changes can void it. Some frameworks test controls over months instead, in the SOC 2 Type 2 style, and providers repeating the review annually assemble a series of point-in-time results. Nobody watches servers around the clock; a "continuous verification" claim should name the method or be read as marketing.

How much of the network an audit sees

Auditors sample a subset of servers and server types, mixing in document review and interviews. Some engagements cover only an app, a browser extension or the policy wording, none of which reveals what the VPN servers record. Assurance level matters too: limited assurance yields a negative-form conclusion ("nothing came to our attention that suggests otherwise"), while reasonable assurance gives a positive opinion after more testing. The report states which one applies.

Reading an audit report

A badge or press release alone gives you no way to check scope or caveats. A full public report is the stronger document.

What a clean audit does not prove

The conclusion says nothing about the day after the report date, about servers outside the sample, or about what payment processors and other third parties store. It cannot prevent a court in the provider's jurisdiction from ordering that one subscriber be logged going forward. Auditor independence is also not total, since the provider pays and sets the scope. Pair the audit with other evidence: court cases where seized servers produced no data, RAM-only setups, and what the provider publishes in its transparency reports. Which record types a VPN keeps, and how no-logs claims get tested, is covered in the site's no-logs glossary entry.

Audits in the VPNRadarLab ranking

Of the 377 services in the main ranking, 35 have an independent no-logs audit on record, 152 have none, and 190 do not state it: the provider does not publish whether it has an audit, which is not the same as having none. Deloitte, KPMG, Cure53, Securitum and other firms appear by name in the site's data, while many audit claims arrive without any auditor named. A shortlist with scores is available in the audited no-logs VPN ranking.

FAQ

Does an audit mean a VPN keeps no data at all?

No. Billing and account records stay with the provider; the audit covers what is stored about connections and activity.

How old can an audit be and still count?

The conclusion covers only the inspection window. Past roughly two years, treat it as history and expect a repeat.

Is a Big Four audit better than one by a security firm?

One tests controls against a standard, the other digs through servers and code. Check which systems each report covered before comparing them.

The audit question in short

An independent no-logs audit shows what one paid firm saw during one window, in the network area the provider chose to open. Check dates, scope list, assurance level and caveats before putting weight on the badge, and weigh the result against transparency reports and court records where they exist.