What a VPN "No-Logs Audit" Actually Proves in 2026

Search for a private VPN and every result wears the same badge: independently audited, no-logs verified. After a while the phrase stops meaning anything. It's on the honest providers and the marketing-led ones alike, in the same font, with the same confidence.

So it's worth asking the flat question: what does a no-logs audit actually prove?

The answer is more interesting than either "everything" or "nothing." Some audits are rigorous, published in full, and repeated annually. Others are a single paragraph you'll never see behind an NDA. One well-regarded provider looked at the whole practice and decided to stop commissioning no-logs audits, for reasons worth hearing out.

This isn't a ranked list of VPNs — we already wrote the checklist for choosing one. This is about reading the badge properly.

Three different things called "an audit"

Most of the confusion comes from one word covering three unrelated exercises. Separating them makes every marketing page easier to read.

• A no-logs assurance engagement. Usually run by a large accounting firm under a standard like ISAE 3000. Auditors inspect server configuration, interview staff, and check whether the systems match the published policy. It's an attestation about a configuration at a moment in time.
• A security audit or penetration test. Run by a specialist security firm. They attack the apps and infrastructure looking for vulnerabilities. This tells you the software is well-built. It says nothing directly about whether the company keeps logs.
• A source code review. Reading the actual implementation for flaws and undisclosed behavior. Deepest of the three, and only meaningful when the code is also open.

These get reported identically. "Independently audited" on a landing page might mean a full public no-logs report, or a penetration test of a mobile app that never touched the logging question.

The 2026 audit record

Here's what the major privacy-focused providers have actually published, from their own disclosures. Scope varies enormously, which is the whole point.

Proton VPN

Five consecutive annual no-logs audits by Securitum, a European security auditing firm. The August 2025 engagement involved technical interviews, supervised access to randomly selected live production servers, and review of server configuration, data-flow design, and logging settings. Securitum reported no user activity logging or connection metadata storage that contradicted the policy. Crucially, Proton publishes the full reports — every year from 2022 onward — rather than a summary.

What that gives you: repetition, live-server access, and a report you can read yourself. That's near the top of what this category currently offers.

NordVPN

Six no-logs assurance engagements since 2018. The most recent ran November 10 to December 12, 2025, conducted by Deloitte Lithuania under ISAE 3000 (Revised). Deloitte reviewed privacy-relevant configuration and deployment processes across standard, Double VPN, Onion Over VPN, and obfuscated servers.

What that gives you: a formal assurance standard and a big-four name, applied repeatedly. Worth noting the shape though — assurance engagements like this typically produce a report available to customers under terms, not an open technical write-up, and they attest to configuration during a defined window.

Mullvad

Mullvad runs a lot of audits, and almost none of them are no-logs audits. Their published record includes infrastructure audits by Cure53 (June 2024) and Radically Open Security (August 2023), a white-box source-code audit of the payment and account API by X41 D-Sec (January 2026), an audit of their WireGuard implementation by Assured (March 2026), and Android app assessments by NCC Group and Leviathan Security Group.

What that gives you: deep, repeated, publicly documented scrutiny of the software and infrastructure — and a deliberate emphasis on not collecting the data in the first place rather than attesting annually that it wasn't collected. Their argument is that an account system with no email address and no payment trail is a stronger guarantee than a report saying the logs were empty in March.

IVPN

One no-logs audit, by Cure53 in March 2019: three auditors over seven days, concluding that IVPN's privacy statements were truthful within the defined scope. Since then, IVPN has continued annual security audits — the sixth concluded, and a 2026 engagement scheduled covering their cryptography and privacy model.

They have also publicly stated they will not commission further no-logs audits. That deserves its own section.

The provider that stopped auditing on purpose

IVPN's position is the most useful thing anyone in this industry has said about audits, largely because it argues against their own marketing interest.

Their reasoning, in short: a no-logs audit is a snapshot in time. Auditors examine systems during a defined window. Nothing about that window binds the company's behavior the following week, and nothing prevents the result from being cited as a permanent guarantee in advertising for years afterward. They concluded that such audits can mislead more than they inform, and stepped away from commissioning them.

You don't have to agree with the conclusion to take the premise seriously. A December audit says something real about December. A provider quoting that audit the following November is making a claim the audit never supported.

The strongest evidence isn't an audit at all

On April 18, 2023, at least six officers from the Swedish police National Operations Department arrived at Mullvad's Gothenburg office with a search warrant, intending to seize computers containing customer data.

Mullvad told them the data didn't exist, explained how the service is built, and demonstrated it. After the officers consulted with the prosecutor, they left without taking anything.

No audit produces evidence that strong. An audit is a company inviting scrutiny on its own schedule, with a scope it helped define. A search warrant is an adversary with legal authority arriving unannounced, specifically looking for the data, and finding nothing to take.

This is the tier of proof worth prizing above any badge: a documented occasion where a provider was compelled to hand over user data and had none to hand over. It's rare, it can't be manufactured, and it's the closest thing this industry has to a real test.

Five questions that cut through the badge

Next time you see "independently audited," these five questions will tell you what it's worth in under two minutes.

1. Can you read the report? Not a summary, a blog post, or a badge — the actual document. If it isn't published, the claim is the company's word about someone else's word. Proton publishing every annual report in full is a meaningfully different posture from a summary page.
2. What was in scope? An app penetration test and a no-logs assurance engagement are not interchangeable. The scope section is usually the first page, and it's the page that matters.
3. When was it, and was there one before? A single audit from years ago is a historical note. An unbroken annual series is a pattern of behavior. Check whether the badge cites a recurring engagement or one good year.
4. Did auditors touch live production servers? Reviewing documentation and interviewing staff is weaker than supervised access to randomly selected running servers. The stronger reports say which.
5. What does the architecture require them to hold? The best answer to "do you keep logs" is a system that can't. No email at signup, cash or Monero payment, RAM-only servers, account numbers instead of identities. Design constraints outlive policies and survive changes of ownership.

Why architecture beats policy

Every point above converges here, and it's the principle we build on too.

A policy is a promise about what a company will choose to do with data it holds. An architecture is a statement about what data exists at all. Promises depend on the people currently running the company — and VPN providers get acquired, restructured, and refinanced like any other business. Architecture is far harder to quietly reverse, because reversing it means shipping visibly different software.

So when you're comparing providers, weight the structural facts above the badges: whether signup requires an identity, whether payment creates a trail, whether servers write to disk at all, whether the client is open source, and whether the company has ever been tested by something it didn't schedule.

Audits are a genuine positive signal. Repeated, published, wide-scope audits are a strong one. But they sit on top of the architecture, not in place of it. If you want the full evaluation framework, our guide to picking a genuinely private VPN walks through ownership, jurisdiction, trackers, and the rest — and our privacy toolkit covers where a VPN fits among everything else.

The same test, pointed at your antivirus

Here's the part most people never think to do.

You will happily spend an evening comparing VPN audit reports — and then run an antivirus with deeper filesystem access than any VPN will ever have, without asking a single one of those five questions about it.

Your VPN sees your traffic. Your antivirus reads every file you own, runs with elevated privileges, and in many cases uploads samples to a cloud for analysis. If "no-logs" deserves an audit, "we don't collect your files" deserves at least equal scrutiny. We read the major privacy policies in does your antivirus spy on you, and the answers are not uniformly reassuring.

XorShield takes the architecture position rather than the policy position, because we think that's the one that holds. Scanning happens on your device — signatures, YARA rules, on-device AI, and behavioral monitoring, all local. No account. No email address. Your files aren't protected by our promise not to upload them; they're protected by there being no upload path.

And like any claim, ours is worth what you can verify. Run a network monitor while XorShield is scanning and you'll see one outbound connection: signature updates. That's the whole test, it takes thirty seconds, and our guide to checking whether your antivirus phones home shows you how to run it on anything — including us.

Trust the thing you can check.

Last updated: August 2026