A sourced, at-a-glance comparison of which major VPNs have had their no-logs claims independently audited — by whom, and when — plus the jurisdiction and server architecture behind those claims.
A "no-logs" marketing line is not the same as a verified no-logs policy. The difference is an independent audit by a named third party, a privacy-friendly jurisdiction, and (increasingly) RAM-only servers that cannot retain data across a reboot. This page compiles those three signals for 12 of the most widely used consumer VPNs in 2026.
| VPN | Independent no-log audit (firm / year) | Jurisdiction | RAM-only | Notable public fact |
|---|---|---|---|---|
| NordVPN | Deloitte — 6th consecutive no-logs engagement (audit Nov 10–Dec 12, 2025) | Panama (outside 5/9/14 Eyes) | Yes (diskless) | 7,000+ servers across 110+ countries |
| ExpressVPN | KPMG (2019, 2022, 2023, 2025); Lightway by Cure53 | British Virgin Islands | Yes (wiped on reboot) | Owned by Kape Technologies since 2021 |
| Surfshark | Deloitte (2025) verified its 15-min IP-deletion claim | Netherlands (Nine Eyes) | Yes | Merged with Nord Security in 2022; brands run independently |
| Proton VPN | 5th annual no-logs audit; apps by Securitum (Aug 2025) | Switzerland (outside 5/9/14 Eyes) | — | First major VPN to open-source all its apps |
| CyberGhost | Quarterly transparency report of data requests | Romania (outside 5/9/14 Eyes) | NoSpy own data center | 11,000+ servers across 100 countries |
| Private Internet Access | No-logs upheld in court (FBI subpoena yielded no data); independent auditor review | United States | — | All apps are 100% open source |
| IPVanish | Leviathan Security (2022); Schellman (2025) | United States | — | 2016: handed data to DHS under prior ownership despite no-logs claims |
| PureVPN | KPMG "always-on" no-logs audit since 2023, reports public | British Virgin Islands (since 2021) | — | 2017: provided connection logs to the FBI despite no-logs claim |
| Mullvad | Multiple audits by Cure53 and Assured AB | Sweden | Yes | Anonymous account numbers; runs no affiliate program |
| TunnelBear | Annual independent audits by Cure53 | Canada (Five Eyes) | — | Owned by McAfee since 2018; free tier 2 GB/month |
| Hotspot Shield | Privacy-policy audit completed 2023 | United States | — | Proprietary, closed-source Catapult Hydra protocol |
| Windscribe | Desktop app audited by Leviathan Security Group (2021) | Canada (Five Eyes) | — | 2025: Greek court case dismissed — no logs meant no data to hand over |
"—" means no public confirmation was found in the source compilation; it does not assert the opposite. Verify against the provider before relying on it.
Scope: 12 consumer VPN brands by 2026 market visibility. Signals compared: (a) existence/recency of an independent no-logs audit and named firm; (b) jurisdiction relative to the 5/9/14 Eyes alliances; (c) public RAM-only confirmation; (d) one notable public fact. This is a transparency-signal snapshot, not a security rating, speed test, or endorsement.