vpns.to

Data

Which VPNs have been independently audited

Every VPN says it keeps no record of what you do. An audit is an outside firm going in to check, and they are not all the same: some inspect the servers, some only the apps, some publish a full report and some a paragraph. This table lists the most recent one for every VPN in the directory, and says what it covered.

Data as of 2026-08-2634 rowsDownload CSV

What the table shows

  • 11 of the 34 VPNs here have had an outside firm examine their no-logs claim in the last two years.
  • 18 have no published outside examination of that claim at all, and 5 were examined once but not in the last two years.
  • 5 of the 11 recent examinations were done by Big Four accounting firms (Deloitte and KPMG).
  • The most recent is Proton VPN's, by Securitum, published June 2026.
Proton VPNLast two yearsJune 2026SecuritumSecuritum inspected the servers in June 2026, the fifth year runningCompany post
Malwarebytes VPNLast two yearsApril 2026X41 D-SecX41 D-Sec examined the infrastructure and the company published the report in April 2026, criticals includedCompany post
CyberGhostLast two yearsDecember 2025DeloitteDeloitte checked the servers as they stood on 31 October 2025; limited assurance, at one date rather than over a periodFull report
NordVPNLast two yearsDecember 2025DeloitteDeloitte inspected the servers in December 2025, the sixth such reviewCompany post
Private Internet AccessLast two yearsDecember 2025DeloitteDeloitte inspected the servers as they stood in October 2025, its third such reviewFull report
TunnelBearLast two yearsNovember 2025Cure53Cure53 ran the eighth annual audit across October and November 2024; no report was published for itCompany post
Norton VPNLast two yearsSeptember 2025VerSpriteVerSprite assessed it between June and August 2025 and published on 3 September 2025, scoring the privacy impact NoneSummary
ExpressVPNLast two yearsJune 2025KPMGKPMG reviewed the controls as they stood on one day in February 2025, not over a periodFull report
ObscuraLast two yearsJune 2025Cure53Cure53, June 2025 — the app, network extension and relay protocol, not an inspection of the serversFull report
SurfsharkLast two yearsJune 2025DeloitteDeloitte assessed the servers in June 2025, and a separate firm tested the network that DecemberFull report
IPVanishLast two yearsApril 2025SchellmanSchellman Compliance finished a no-logs audit on 21 February 2025; the report is behind a customer loginCompany post
MullvadNot recentlyJune 2024Cure53Last examined by Cure53 in June 2024, and that was a security review rather than a no-logs checkCompany post
WindscribeNot recentlyJune 2024PacketlabsPacketlabs went through the server code in June 2024, which is now past the two-year markCompany post
hide.meNot recentlyJune 2024SecuritumSecuritum examined the servers and dated its report 7 June 2024; first checked by DefenseCode in 2015Full report
PureVPNNot recentlyApril 2023Not namedThe fourth assessment ran in February 2023, and the company's pages no longer name the firm that did itCompany post
IVPNNot recentlyMarch 2023Cure53Cure53's May 2025 audit covered the email and DNS side services; the VPN gateways were last examined in February 2023Company post
AdGuard VPNNever——No outside examination of the service or its protocol could be located, and the company cites noneNone
AirVPNNever——No outside firm has ever examined it; the company offers open source and a live server monitor insteadNone
AstrillNever——No independent examination of the service has been published, and the company cites noneNone
Avast SecureLine VPNNever——No independent examination of the logging claim has ever been publishedNone
Bitdefender VPNNever——No outside examination of the no-logs claim has been publishedNone
F-Secure VPNNever——No outside examination of the no-logs claim has been publishedNone
FastestVPNNever——No outside examination of the no-logs claim has been publishedNone
Hotspot ShieldNever——No independent audit of this service could be located from the company or any assessorNone
IvacyNever——Nothing published for Ivacy itself; the merger moved its clients onto PureVPN, whose audit is recorded thereNone
Mozilla VPNNever——No outside examination of this subscription's own no-logs claim has been publishedNone
OVPNNever——No outside examination located; what exists instead is a court case it fought and won in 2020None
PrivadoVPNNever——No independent examination of the no-logs claim has been publishedNone
PrivateVPNNever——No third-party examination of the logging policy has ever been publishedNone
SpeedifyNever——No outside examination of the no-logs claim has been publishedNone
StrongVPNNever——No outside examination of the no-logs claim has been publishedNone
TorGuardNever——Nobody outside the company has examined the servers or the logging claim, and it cites noneNone
Trust.ZoneNever——No outside examination of the no-logs claim has been publishedNone
VPN UnlimitedNever——No outside examination of the no-logs claim has been publishedNone

How this was built

Each row is the most recent outside examination we could find, dated by the month it was published, because that is when a reader could first see it. The "Examined" column is the directory's own audit rating: "Last two years" means published within 24 months of the date the entry was last checked, and covering what the VPN's no-logs claim rests on. The "What was examined" column says what each examination actually covered — servers, apps, a protocol or side services — because the word "audit" on a vendor's page is used for all of them.

The link is to what we read. "Full report" is the auditor's own document; "Summary" is an auditor's executive summary; "Company post" is the VPN's own announcement, which may link on to a report or keep it behind a login. "Never" means no outside examination of the no-logs claim has been published, which is not proof that one never happened.

Using this data? Please link to this page.

Read with this table

More data