VPNInfobaseThirteen of the 22 services on our register (two are closed or rebranded) have a recorded audit that looked at logging or privacy-policy claims in some form, and for several of them the full report sits behind an account login or is not linked at all. An audit is not a stamp on the whole product: it covers the scope the auditor was given, on the dates it looked. The table splits the two kinds so a “no-logs audited” claim can be checked against what was actually examined.
Two kinds of audit
- No-logs or privacy-claim assurance. An accounting or assurance firm (Deloitte, KPMG, PwC, Aon, Schellman) or a security firm checks whether the vendor’s stated logging practice matches its systems. This is the audit behind “independently verified no-logs”.
- Security test of an app or infrastructure. A penetration-test firm (Cure53, Securitum, Leviathan, SecuRing, X41, Packetlabs) looks for vulnerabilities in code or servers. It says nothing direct about logging.
A provider can have many of the second kind and none of the first, or the reverse. ExpressVPN’s most recent KPMG report is described by the vendor as a Type 1 engagement “as of 28 Feb 2025”, which is a snapshot at one date, not a period.
No-logs and privacy-claim audits by provider
| Provider | Latest recorded no-logs audit | Auditor | Public report | Recorded count of all audits |
|---|---|---|---|---|
| NordVPN | Sixth review, fieldwork 10 Nov to 12 Dec 2025 per press coverage of Nord’s release (the vendor page was blocked to us) | Deloitte Lithuania | The 2024 report is summarised on the vendor blog; 2025 not linked | 6 |
| ExpressVPN | June 2025, KPMG (called third on the trust page, second in the post body) | KPMG | Vendor blog post | 28 |
| Surfshark | June 2025 (second assurance report, as of 10 June 2025 per press release) | Deloitte | Full report only inside a Surfshark account | 7 |
| Proton VPN | 2026, fifth consecutive annual | Securitum | Proton says its reports are public; no link captured | 7 |
| Private Internet Access | 2025, third | Deloitte Audit Romania | Vendor page | 3 |
| CyberGhost | 2025, third | Deloitte Audit Romania | Vendor page | 3 |
| IPVanish | Finalised 21 Feb 2025, announced 10 April 2025 (press coverage) | Schellman Compliance | Account portal only | 2 |
| IVPN | March 2019 (no-logs verification of gateways) | Cure53 | Report | 5 |
| hide.me | June 2024 | Securitum | Report | 1 |
| Hotspot Shield | August 2023 | Aon | Summary report | 1 |
| PureVPN | February to April 2023 assessment; auditor not named on the page | Not named | None linked | 3 |
| VyprVPN | Undated | Leviathan Security Group | Report | 1 |
| Mullvad | June 2022 (server infrastructure; no logging of customer data found) | Assured AB | Listed on Mullvad’s blog | 16 |
| Windscribe | None recorded | 4 | ||
| TunnelBear | None recorded | 8 | ||
| AirVPN, Astrill, PrivateVPN, StrongVPN, Trust.Zone | None found on vendor pages | 0 |
“None found” reflects what we could read. StrongVPN’s site returned HTTP 403 to us and AirVPN’s could not be read, so absence there is not evidence of no audit. Mullvad’s row is our reading of its infrastructure audit list: it is a server audit, not an assurance report on a written no-logs policy.
Security tests worth knowing
- Mullvad publishes the longest run of technical reports: infrastructure audits by Cure53 (fourth, June 2024) and Radically Open Security (third, August 2023), plus 2025 and 2026 app, web and payment-service assessments by NCC Group, Assured, X41 D-Sec and Leviathan.
- TunnelBear has had eight annual Cure53 audits; the eighth was published 24 November 2025 and covered work done in October and November 2024.
- IVPN’s sixth annual Cure53 audit, of web UI and backend, was published 11 April 2024.
- Surfshark links Cure53 (2026, infrastructure and a new protocol; report-to-year mapping is our inference from the page order) and SecuRing (December 2025 network infrastructure) reports.
- ExpressVPN lists 28 items, mostly Cure53 tests of individual apps and of its Lightway protocol, and a 2026 run of tests on new products.
What no audit here tells you
None of these reports proves nothing was logged the day after the audit ended, or on servers outside the sample. Several vendors’ full reports are visible only to customers, and a summary written by the vendor is not the auditor’s report. We record who audited, when, and whether the report can be opened, and we do not rank one auditor over another.
Method
Researched from each vendor’s trust and audit pages and the auditors’ published reports, recorded in the VPN audit register on 28 September 2026 with one report (hide.me) re-read on 29 September. Nothing here was tested by us. Audit dates from vendor pages can be blog dates rather than report dates, and where that applies the register says so. For who is behind each service, see who owns your VPN; for what a no-logs promise does and does not prove, see what a no-logs policy means; for cases where logging claims were tested by police or attackers, see the incidents timeline.