How No-Logs Audits Actually Work

Almost every VPN homepage carries some version of the same sentence: "we keep no logs." On its own, that sentence is unverifiable — it's a policy the provider wrote about itself. A no-logs audit is what turns that claim into something you can actually check: an independent party is given access to the provider's infrastructure, source code, or both, specifically to confirm that no connection logs, timestamps, IP addresses, or browsing activity are being written to disk.

This guide walks through the four ways a no-logs claim actually gets tested in practice, what auditors look at when they do it, and the difference between a real audit and the marketing version of one.

What a "no-logs" claim actually covers

VPN providers necessarily process some data to function at all — an active connection needs a session in memory to route your traffic. The meaningful distinction a no-logs policy is supposed to guarantee is that this data is never written to persistent storage and never retained after the session ends. A provider can be processing your traffic in real time and still be "no-logs" in the sense that matters: there's nothing left over to hand to anyone once you disconnect.

The four ways a no-logs claim gets verified

1. Independent security audits

This is the most common and most thorough method. A firm like Deloitte, PwC, or Cure53 is given access to the provider's server infrastructure, internal configuration, and sometimes source code, and produces a report on what data is actually being collected and stored — not what the privacy policy says should happen. CyberGhost's no-logs infrastructure was audited by Deloitte, NordVPN has run repeated independent assurance engagements on its no-logs policy, PwC audited ExpressVPN's RAM-only TrustedServer infrastructure, and Cure53 has repeatedly audited Mullvad's server infrastructure for PII and privacy leaks.^{[1] [2] [4] [5]}

The key thing to check when a provider cites an audit: was the auditor looking at live infrastructure and configuration, or just reading the privacy policy and confirming it's internally consistent? Both get called an "audit." Only the first one tells you anything meaningful.

2. Court orders and subpoenas

This is the test that can't be staged. Several VPN providers have been legally compelled — through a criminal investigation or civil subpoena — to hand over user data, and returned nothing usable, because no logs existed to retrieve. A provider cannot fabricate compliance with a binding court order; if they had logs, a court order is exactly the situation where they'd be forced to produce them. Private Internet Access has had its no-logging claim tested by a federal court subpoena on more than one occasion and was unable to produce any identifying information because none existed. A no-logs claim that has survived an actual legal request carries more weight than any voluntary audit, because the provider had no choice in the matter.^[6]

3. Server seizures

A small number of providers have had physical servers seized by authorities during investigations. In the cases that have been publicly documented, investigators found no data usable to identify users or reconstruct their activity — real-world confirmation that the provider's no-logs infrastructure worked as advertised under the one scenario a policy document can't fake: someone with physical access to the hardware looking for something to use. When Turkish authorities seized an ExpressVPN server in 2017 during an assassination investigation, the provider had no connection logs to hand over, and the seizure is now cited as one of the most concrete real-world tests any VPN's no-logs claim has faced.^[7]

4. RAM-only (diskless) infrastructure

This is a structural guarantee rather than a policy promise. Servers that run entirely in volatile memory (RAM) lose everything the moment they lose power or reboot — there is no disk image to seize or subpoena even if someone gets physical or legal access to the hardware. A provider running RAM-only infrastructure doesn't need you to trust its privacy policy on this point; the architecture itself makes long-term log retention impossible. ExpressVPN's TrustedServer technology and NordVPN's diskless server network are both examples of providers that have migrated their entire infrastructure to this model.^[8] [9]

What auditors actually check, step by step

• Server configuration files, to confirm logging is disabled at the system level, not just in the app the user sees
• Whether the codebase includes any code paths that would write connection metadata to disk
• Session-handling logic, to see what data exists in memory during an active connection and whether any of it is exported or persisted
• Third-party analytics or crash-reporting tools bundled into the app, which can quietly collect identifying data even when the VPN tunnel itself is clean
• Employee access controls — whether staff could access identifying data even if the system isn't designed to log it by default

Red flags: how to spot a weak or fake audit claim

• The audit is undated, or the date is more than 2-3 years old — infrastructure and code change; an old audit only proves a past state
• The provider references "an independent audit" without naming the firm that conducted it
• The audit summary is a press release, not a published report or letter you can actually read
• The scope only covers the mobile or desktop app, not the server infrastructure where logging would actually happen
• The claim is "no-logs" but the audit was actually a general security/penetration test

If a provider has genuinely been audited, they'll typically link to the auditor's own summary or the assurance letter itself, not just a blog post describing it in their own words.