VPN audits: who checked what

What a VPN audit is

Every VPN says it protects your privacy. An audit is an outside firm, paid by the VPN company, checking some part of that claim and writing down what it found. The table above lists the audits recorded in our provider files: who did them, when, and what they covered.

"Audit" is used loosely in VPN marketing. It can mean an accounting firm's review of a no-logs claim, a security firm trying to break into servers, or a line-by-line review of app code. Those answer different questions, so the first thing to check is which kind you're looking at.

Three kinds of audit

1. Assurance engagements (no-logs audits). These are done mostly by accounting firms such as Deloitte, PwC and KPMG under ISAE 3000 (Revised), the international standard for assurance on subjects other than financial statements. The VPN company writes a description of its systems and its no-logs claim. The auditor interviews staff and inspects server configurations, deployment processes and logs, then says whether the description holds. ISAE 3000 has two levels:

• Reasonable assurance ends in a positive opinion, along the lines of "in our opinion, the statement is fairly stated". NordVPN's 2025 Deloitte engagement and ExpressVPN's 2025 KPMG engagement were described as reasonable assurance.
• Limited assurance uses fewer or smaller tests and ends in a negative conclusion: "nothing has come to our attention" that suggests the claim is wrong. The accountants' body ICAEW notes the residual risk of a missed problem is higher.

Some engagements also say whether they check design at one date (ExpressVPN's 2025 KPMG report was "Type 1", as of February 28, 2025) or operation over a period. A design check confirms the controls existed; it doesn't test whether they kept working.

2. Penetration tests. A security firm attacks the systems, with permission, looking for weaknesses. In June 2024, for example, Cure53 tested one OpenVPN and one WireGuard server of Mullvad's, with access to the deployment code, and reported one medium and one low-severity issue, which Mullvad says it fixed. Cure53 published the full report. A penetration test tells you how hard the systems are to break into; it doesn't directly test a no-logs claim.

3. Code audits. Reviewers read the source code of an app or protocol. ExpressVPN's Lightway protocol was assessed by Cure53 and Praetorian, and Cure53's 2020 Mullvad work combined a penetration test with source code review of selected apps. Open-source apps let anyone read the code, which is useful but isn't the same as a paid, scoped review.

What an audit doesn't prove

• It's a point in time. Deloitte's 2025 Surfshark fieldwork ran about four weeks; CyberGhost's 2025 report is pinned to October 31, 2025. They say nothing direct about earlier or later months.
• It covers a defined scope. Check which servers and systems were in scope. IPVanish's 2026 Schellman assessment, for instance, examined a sample server and relied partly on interviews and a shared server image for the rest.
• It tests the company's own description. The auditor checks the VPN's statement of its systems. If the statement is narrow, the conclusion is narrow too.
• It usually ignores account data. No-logs audits focus on VPN activity. Your email, payment records and app analytics are separate; app store privacy labels can tell you about those.
• It can't bind the future. A sale, a new team or a new server design can change everything. See who owns your VPN.

Big Four accountants vs security firms

The Big Four accounting firms (Deloitte, PwC, KPMG and EY) bring formal assurance standards and a reputation that rests on following them. Their no-logs work checks configurations and processes against a written claim, and it's good at confirming that a stated design exists. Security firms such as Cure53, Praetorian, SecuRing, VerSprite and Leviathan Security Group are specialists in attacking systems and reading code. Compliance firms such as Schellman sit somewhere between.

Neither type is better across the board. A provider with both a no-logs assurance engagement and published security tests, repeated over several years, has the strongest audit record. A single report, of either type, is weaker evidence than a series.

How to read an audit report

• Who did it? Is the firm named? The table above flags where we couldn't confirm an auditor's name.
• Which standard and level? ISAE 3000, reasonable or limited, design only or operation over time.
• When? The date or period covered, and how long ago that was.
• What was in scope? Which servers, apps or processes, and how many were sampled.
• What did it find? Look for exceptions, qualifications and the severity of any issues, and whether the company says they were fixed.
• Can you read it? Some providers publish the full report as a PDF; others put it behind a customer login or summarize it in a blog post. A summary written by the company is marketing until you can see the report.

Court cases and seizures: real-world tests

Audits are planned and paid for. Court cases, subpoenas and server seizures are not, which makes them useful evidence. Private Internet Access had nothing identifying to hand over in a 2016 FBI case and a 2018 federal case. ExpressVPN's server seized in Turkey in 2017 reportedly yielded no useful logs. On the other side, IPVanish under its old owner gave investigators connection records in 2016, and an FBI complaint in a 2017 cyberstalking case described PureVPN linking a customer's home and work IP addresses. Our guide to no-logs policies covers these and other cases in detail.

A court case covers one moment and one request. Audits and real-world tests answer different questions, and the strongest records have both.

Red flags

• No independent audit at all, or one so old the company has changed since.
• "Audited" with no auditor named, no date and no scope.
• A narrow audit sold as a broad one, such as a browser-extension test presented as proof that the whole VPN keeps no logs.
• A penetration test cited as no-logs proof. It shows resistance to attack, not what the servers record.
• A past logging case with no explanation and no audit since.
• Reports you can't see, with only a company press release to go on.