What it really means when a VPN says it is audited

"Audited" is not one word, it's three questions

When a VPN says it has been "audited," it can mean three quite different things, and it rarely says which. The first is an audit of the no-logs policy: an outside firm checks whether the provider actually keeps, or doesn't keep, the data it promises not to keep. The second is an audit of the application code: someone reviews the software you install on your phone or computer, looking for vulnerabilities or behaviour that contradicts what the company claims. The third is an audit of the server infrastructure: how the servers running the service are configured, which is neither the app's code nor the written policy.

A provider can have just one of the three and write its site so that a reader assumes it has all three. None of them, on its own or combined, says under which country's law the company operates — that's a separate question, covered further down.

Beyond what was audited, four more things matter: who signed the report, what year it's from, whether it repeats on any regular basis, and whether the report can actually be read or is only mentioned by name. The site's VPN directory holds nine listings where these details were checked one by one, and the differences between them are the point of this article.

Nine providers, nine different combinations

None of the nine cases match another. It's worth going through them one at a time before drawing any general conclusion.

Reading down that right-hand column shows patterns that the single word "audited" hides. CyberGhost and Private Internet Access give the work to a single firm, Deloitte, and name it: in the first case covering both the infrastructure and the no-logs policy, in the second the logs alone. ExpressVPN and Surfshark, instead, split the work across several firms and several years, each with a distinct target: auditing the Lightway protocol is not the same thing as auditing whether the servers keep logs. IVPN and Proton VPN are the two cases where the word "annual" actually has evidence behind it: unbroken runs of reports, with IVPN's eighth round due in 2026 and Proton VPN's five already published and readable without signing anything first. Mullvad sits in between: there are audits, and they're dated, but the 2020 infrastructure one doesn't carry the name of who performed it — an absence the listing itself notes.

The case with no named auditor and no date

Windscribe differs from the other eight: there is no published audit carrying both an auditor's name and a year. What it does publish is a transparency report with the number of data requests received — zero, according to that report — and its own site mentions "audits," plural, without naming the firm or the year they took place.

That is not the same as saying Windscribe is lying about its no-logs policy. It means exactly what it says: based on what's published, there is no report with a name and date that can be checked against anything. It's an absence of public documentation, not evidence of anything in either direction. A reader who needs that specific kind of documented backing simply won't find it there; one who accepts the transparency report and the general mention has that material available and can judge it on its own terms.

No audit changes the jurisdiction

This is the part actually worth comparing: an audit certifies a specific moment and a specific object — the logs as of a given date, the code of a given version, the infrastructure as of a given month. It does not, and cannot, certify which country's law the company operates under, or what a court or an intelligence service in that country could demand from it tomorrow.

Private Internet Access operates out of the United States and says so on its own listing: it's a member of Five Eyes, the intelligence-sharing alliance among several English-speaking countries. The company adds that its no-logs commitment has been tested in court and held up. Mullvad operates out of Sweden, an EU country that is also a member of the broader 14 Eyes alliance. Both providers have audits — different ones, of different things — and both operate under jurisdictions that belong to intelligence-sharing alliances. The audit doesn't change that fact; it sits alongside it, not in place of it.

The rest of the list is spread across other jurisdictions. CyberGhost operates from Romania, inside the EU, and the company itself presents that as being outside the 5, 9, and 14 Eyes alliances. ExpressVPN is based in the British Virgin Islands. IVPN operates from Gibraltar, which left the EU in 2020 and has its own regulatory regime under the Gibraltar Regulatory Authority. NordVPN operates from Panama, though its parent, Nord Security, is Lithuanian. Proton VPN is based in Switzerland, and Proton AG is majority-owned by the Proton Foundation. Surfshark operates from the Netherlands. Windscribe operates from Canada, in Ontario, also a Five Eyes member.

None of these jurisdiction facts come out of a security audit: they're corporate and legal facts that sit next to the audit, not inside it. Putting both together — what was audited, and under which law the company operates — gives a full picture; looking only at the audit leaves half the question unanswered.

Same group, separate brands

One fact worth keeping in mind when comparing listings as if they were independent competitors: since 2022, Surfshark and NordVPN have belonged to the same corporate group, following the merger with Nord Security, even though the brands remain separate from each other. Their audits are different — Surfshark has gone through Cure53, Deloitte, and SecuRing; NordVPN through PwC Switzerland and Deloitte — and their operating jurisdictions differ too, the Netherlands versus Panama with a Lithuanian parent. But it's worth knowing they aren't two unrelated companies when reading their listings side by side.

What to ask before taking an audit at face value

All of this adds up to a short list, applicable to any provider in any directory, not just these nine:

• What exactly was audited: the no-logs policy, the application code, the server infrastructure, or some combination of the three? The listing should say so in those terms, not with the generic word "audited."
• Who signed the report? A verifiable auditor's name is not the same as an unnamed mention.
• What year is it from, and is there more than one report over time? An audit from several years ago describes a situation from several years ago.
• Can the report actually be read, even in summary form, or is only its existence cited?
• Separately from the audit: which country's law does the company operate under, and does that jurisdiction belong to any intelligence-sharing alliance?

None of these questions replace checking where your own traffic is actually going at the moment you use the service. For that, more direct tools help: checking what IP address is showing right now, whether that IP shows up as a proxy or VPN in the lists other sites consult, who owns that address, or which range in the directory of autonomous systems the server belongs to. Those are a different kind of data — technical, present-moment — that neither a 2020 audit nor a jurisdiction written on a listing can replace.