Independent auditors confirm that top VPN never logs your data

Independent auditors have confirmed that one of the top VPN providers does not log your data and offers “the highest standards of security and privacy.”

Security experts at Securitum inspected Proton VPN’s server and file configurations to ensure that data related to users’ activities is never recorded or stored as stated in the privacy policy. After thorough analysis, no traces of user logs were detected.

While Proton VPN offers open-source apps across all platforms, it regularly subjects its security and privacy features to independent audits. This is actually the third time the popular VPN provider has proven its no-logs claims with a third-party audit since 2022.

Third No-Log Audit of Proton VPN

Auditors spent six days – from July 3 to 5, 2024 – verifying the technical aspects of the Proton VPN server and file deployment, while simultaneously assessing the company’s operational procedures.

Among other things, auditors looked at whether Proton VPN keeps track of your activity on its servers or logs metadata, including DNS traffic. They also checked whether the provider monitors what users do when connected to Proton’s network, such as the websites they visit or the servers they connect to. They also checked how the company prevents unauthorized configuration changes.

“The audit confirmed that the Proton VPN product complies with the No-Log policy and offers the highest standards of security and privacy,” Securitum’s report said.

Simply put, the audit confirmed that Proton VPN does not engage in practices that could compromise your privacy. This means that the VPN apps never log metadata or your VPN activity. At the same time, auditors verified that all changes and additional features were developed to maximize user security and privacy.

Andy Yen, founder and CEO at Proton, wrote in an official announcement about the outcome: “At Proton, we believe that all claims should be investigated and verified, including our own. Going forward, we will continue to conduct regular security audits and publish the results so that you can read the report of an independent security professional before you trust us with your data.”

Why do you want a no-logs VPN?

A strict no-logs policy, even better if it’s regularly independently audited, should be one of your top priorities when signing up for a new VPN service. That’s especially crucial if improving your online privacy is the primary reason you’re using a virtual private network.

While some basic data logs, such as the number of users connecting to the same server and the email address associated with a user account, are unavoidable, a no-logs VPN ensures that no personal information or usage data tied to you or your activities is ever collected.

For example, let’s say a malicious hacker or government manages to obtain data that originates from a VPN network. With a no-log VPN, none of your sensitive information will leak, simply because the details don’t exist.

The importance of this feature has already been proven in some cases. In 2019, Proton was unable to help authorities identify a user because it had no identifiable information stored. More recently, Swedish authorities were left empty-handed after an inconclusive police operation on Mullvad’s servers last year.

As mentioned, Proton’s commitment to user privacy and security goes even further. All of its apps are completely open-source, meaning anyone can check the coding for bugs and vulnerabilities.

“As an organization founded by scientists who met at CERN, we believe in peer review and transparency,” Yen said, calling on all security researchers to support Proton’s security through the bug bounty program.