What is the difference between a no-logs audit and a security audit?

A no-logs audit (assurance engagement) checks whether a provider's stated logging practice matches what an auditor observes against a standard. A security audit or penetration test looks for vulnerabilities in apps, code or servers. A provider can have one without the other, and neither proves the service is safe today.

Which VPN providers have a recent independent no-logs audit?

In our 2026-10-23 check, NordVPN (Deloitte, 2025), Surfshark (Deloitte, 2025), ExpressVPN (KPMG, 2025), Proton VPN (Securitum, annual to 2026), PIA (Deloitte, 2025), CyberGhost (Deloitte, 2025) and IPVanish (Schellman, 2025) point to assurance work. Windscribe, TunnelBear and Mullvad publish security assessments instead.

Does an audit prove a VPN keeps no logs?

No. An audit describes what the auditor tested, on which servers, during which period and against which standard. It cannot prove the absence of logs afterwards. Check whether the report covers the whole service, whether it tests operating effectiveness, how recent it is, and whether the full report is public.

Why do some audit reports sit behind a login?

Several providers publish a summary and share the full report only inside a customer account. That limits independent review: readers must trust the provider's summary of scope and exclusions. This index notes where full reports could not be read.

How is this index built and kept current?

Each row comes from the provider's public pages, the auditor's or press coverage cited in the provider's review, checked on the date shown. VPN Advisor did not read confidential reports or test the services. Audits change yearly, so confirm the latest on the provider's trust page.

Home › Research › Audit Scope Index

Original research · edition 2026-10-23

VPN Audit Scope Index 2026

Name: VPN Audit Scope Index 2026
Creator: VPN Advisor
License: https://vpnadvisor.net/terms

“Independently audited” hides two very different things. This index separates no-logs assurance from security assessments for ten reviewed providers and records the auditor, the latest audit we could confirm and what that audit does not prove.

Key findings

Seven of ten providers point to a no-logs or privacy-commitment assurance engagement (NordVPN, Surfshark, ExpressVPN, Proton VPN, PIA, CyberGhost, IPVanish); Surfshark and ExpressVPN also publish security audits.
Windscribe, TunnelBear and Mullvad publish security assessments, which test for vulnerabilities but do not measure logging practice.
For several providers the full report is not public (NordVPN and Surfshark gate it behind an account), so scope and exclusions rest on the provider's summary.

The index

Audit type, auditor, latest audit and limits per provider
Provider	Audit type	Latest we could confirm	Auditors	What this does not prove
NordVPN	No-logs / privacy-commitment assurance	Deloitte Lithuania, 2025 (reported fieldwork 10 Nov to 12 Dec 2025)	PwC (2018, 2020), Deloitte (2022, 2023, 2024, 2025) Six ISAE 3000 no-logs engagements since 2018	Full reports sit behind a Nord account, so scope and exclusions could be read only from public summaries and press.
Surfshark	Both kinds	Cure53 (2026, infrastructure and Dausos protocol); Deloitte report dated 10 June 2025	Deloitte (2023, 2025), Cure53, SecuRing Deloitte ISAE 3000 reports in 2023 and 2025; SecuRing infrastructure review Dec 2025 and apps/extensions 2025	Surfshark's pages do not say whether the Deloitte reports test operating effectiveness over a period or a point in time; the full report is gated.
ExpressVPN	Both kinds	KPMG, June 2025 (privacy commitments, third KPMG audit); Cure53 Lightway audit Oct 2024	PwC (2019), Cure53 (2018, 2022, 2024), KPMG (2022, 2025) TrustedServer audited by PwC (2019) and Cure53 (May 2022); newer Cure53 audits also cover non-VPN products	Report texts and sampling procedures were not reproduced publicly; part of the growing audit list covers products other than the VPN.
Proton VPN	No-logs / privacy-commitment assurance	Securitum, annual no-logs audit (provider page updated 2026-06-16)	Securitum (2022 to 2026) Five annual no-logs audits listed by the provider	Proton's page gives no per-year scope detail, and the audit reports themselves were not opened for this index.
Private Internet Access	No-logs / privacy-commitment assurance	Deloitte, ISAE 3000, completed 19 Dec 2025 (reported by CyberInsider)	Deloitte Audit Romania (as of 30 June 2022), Deloitte (2025) Two independent audits stated by PIA; US court cases cited separately by the provider	The 2025 audit is confirmed through press, not PIA's own post; the second audit's year is not stated on PIA's no-logs page.
CyberGhost	No-logs / privacy-commitment assurance	Deloitte Audit Romania, as of 31 Oct 2025 (limited assurance)	Deloitte Audit Romania (2022, 2024, 2025) ISAE 3000 (Revised); the 2025 engagement is described as limited assurance	Report type (design versus operating effectiveness) and the number of servers inspected could not be verified for the 2022 and 2024 reports.
IPVanish	No-logs / privacy-commitment assurance	Schellman, finalized 21 Feb 2025 (announced 10 April 2025)	Leviathan Security Group (2022), Schellman (2025) Two no-logs audits; the 2016 logging episode predates the current owner	Report texts and exclusions were not seen; some press items correct earlier attribution of the 2022 audit.
Windscribe	Security assessment (apps, code, infrastructure)	Packetlabs, June 2024 (20 repositories and infrastructure penetration test)	Leviathan Security Group (2021 desktop, 2022 mobile), Packetlabs (2024) App and infrastructure security assessments; open-source clients	These are vulnerability assessments, not no-logs assurance; a Cure53 audit seen in forums could not be confirmed on an official page.
TunnelBear	Security assessment (apps, code, infrastructure)	Seventh annual Cure53 audit, report published February 2024	Cure53 (annual since 2017) Annual security audits; later reports were announced but not found	Cure53 audits assess security, not logging practice; no report newer than the seventh could be confirmed.
Mullvad	Security assessment (apps, code, infrastructure)	Leviathan Security Group assessment of the Android app, published 2026-06-01	Radically Open Security (2023), Cure53 (2024), X41 D-Sec (2024, 2026), Assured (GotaTun 2026), Leviathan (2026) Frequent published security assessments of apps and infrastructure; RAM-only servers and a no-data outcome after a 2023 police visit are provider statements	The search-warrant account comes from Mullvad's own post with no independent confirmation; audit reports measure security, not that no logs exist.

Rows reflect public pages and press on 2026-10-23. Each provider review lists the exact sources.

How to read an audit claim in five questions

What was tested? Logging practice (assurance) or vulnerabilities (security)?
Which standard and who? A named firm and standard such as ISAE 3000, not “an independent expert”.
Which servers and period? A point-in-time review of a sample says less than a period of testing.
Is the full report public? If not, you are reading the provider's summary.
How old is it? Annual repeats matter more than a single old report.

For the long version, with examples, read our audit report guide, the Transparency Index and the methodology.

Frequently asked questions

What is the difference between a no-logs audit and a security audit?: A no-logs audit (assurance engagement) checks whether a provider's stated logging practice matches what an auditor observes against a standard. A security audit or penetration test looks for vulnerabilities in apps, code or servers. A provider can have one without the other, and neither proves the service is safe today.
Which VPN providers have a recent independent no-logs audit?: In our 2026-10-23 check, NordVPN (Deloitte, 2025), Surfshark (Deloitte, 2025), ExpressVPN (KPMG, 2025), Proton VPN (Securitum, annual to 2026), PIA (Deloitte, 2025), CyberGhost (Deloitte, 2025) and IPVanish (Schellman, 2025) point to assurance work. Windscribe, TunnelBear and Mullvad publish security assessments instead.
Does an audit prove a VPN keeps no logs?: No. An audit describes what the auditor tested, on which servers, during which period and against which standard. It cannot prove the absence of logs afterwards. Check whether the report covers the whole service, whether it tests operating effectiveness, how recent it is, and whether the full report is public.
Why do some audit reports sit behind a login?: Several providers publish a summary and share the full report only inside a customer account. That limits independent review: readers must trust the provider's summary of scope and exclusions. This index notes where full reports could not be read.
How is this index built and kept current?: Each row comes from the provider's public pages, the auditor's or press coverage cited in the provider's review, checked on the date shown. VPN Advisor did not read confidential reports or test the services. Audits change yearly, so confirm the latest on the provider's trust page.