How to check a VPN's no-logs claim

Nearly every VPN says it keeps no logs. The EFF's advice is blunt: a claim is not a guarantee. You can't inspect a provider's servers yourself, but you can check how much evidence stands behind the claim. Here are five checks, using real examples from the providers we compare.

1. Read what the policy actually says

“No logs” rarely means no data at all. A good policy lists what is kept and why. Mullvad's policy, for example, explains that it keeps payment records because Swedish accounting law requires them, while saying it doesn't log your activity. Be wary of a policy that says “no logs” on the home page but lists “connection data” or “usage data” further down without saying what that means.

2. Look for a named auditor and a report you can open

An audit claim means little without a named firm, a date and a report or summary you can read. Some examples:

• Proton VPN publishes five annual no-logs audits by Securitum, 2022 to 2026, each linked from one page.
• NordVPN has had Deloitte check its no-logs statement under the ISAE 3000 assurance standard, most recently in late 2025.
• ExpressVPN published a KPMG no-logs assurance report in June 2025.

If a provider says it was “independently audited” but won't name the firm or show the report, treat the claim as unverified.

3. Check what the audit covered, and when

Audits differ a lot in scope, and the details matter:

• Point in time or over a period? ExpressVPN's 2025 KPMG report is a “Type 1” engagement: it checked how controls were designed as of one date (February 28, 2025), not how they ran over months.
• No-logs audit or security audit? Mullvad's 2024 Cure53 audit tested its servers' security rather than certifying a no-logs policy. Both are useful, but they answer different questions.
• How old is it? IVPN's only no-logs audit was in 2019, and it says it won't commission more, relying on yearly security audits instead.

Even a clean, recent audit is a snapshot. The EFF notes that practices can change after an audit, especially under government pressure.

4. Look for real-world tests

The strongest evidence is what happened when someone with legal power came asking.

• In 2023 Swedish police arrived at Mullvad's office with a search warrant for computers holding customer data. Mullvad says there was none, and the officers left with nothing.
• In 2017 Turkish authorities seized an ExpressVPN server while investigating the assassination of Russia's ambassador. ExpressVPN said it yielded no useful information.
• Law can also force logging. In 2021 Proton was ordered under Swiss law to log a Proton Mail user's IP address. Proton says the same kind of order can't be used to force VPN logging, which is exactly why jurisdiction belongs in your check.

5. Check ownership and how incidents were disclosed

A no-logs promise is only as good as the company making it. Find out who owns the provider and how it has handled bad news. NordVPN's 2018 server breach became public in October 2019. ExpressVPN has been owned since 2021 by Kape Technologies, which used to be called Crossrider. Neither fact rules a provider out, but both belong in your decision.

Putting it together

No single check proves a VPN keeps no logs. A provider that passes all five, with a clear policy, recent named audits, a sensible jurisdiction, a real-world test and open handling of incidents, has earned more trust than one that just says “no logs” in big letters. Our comparison table lays out these facts for six providers.