The VPNs Whose No-Logs Promise Survived Real Tests

Every VPN swears it keeps no records. Police raids, courtrooms and auditors have tested that claim, and the field sorts itself quickly.

For twelve years, a service called First VPN promised its customers that it kept no record of what they did. Its principal clients, according to US sanctions filings, were ransomware crews and other cybercriminals, and the promise was the product. Over two days in May 2026, French and Dutch investigators took First VPN offline, dismantling 33 servers and leaving with the service’s user database. Details on 506 users were shared with police in partner countries.

Most people shopping for a VPN want to keep an internet provider, an airport Wi-Fi network, or an ad broker out of their business, not dodge an international police operation. But the case is a tidy illustration of how this market works. “No logs” is a sentence on a sales page, and the only way to learn whether it’s true is to watch what happens when somebody with legal authority comes asking.

Some providers have failed that test. PureVPN handed connection records to the FBI in a 2017 cyberstalking case, and records held by IPVanish surfaced in a 2018 federal prosecution, both while the companies advertised that they kept nothing.

Others have passed it. Turkish authorities seized an ExpressVPN server in 2017 while investigating the assassination of Russia’s ambassador and found nothing usable. In April 2023, Swedish police arrived at Mullvad’s Gothenburg office with a warrant to seize computers holding customer data and left without taking anything once the company showed there was none. In April 2025, an Athens court dismissed charges against Windscribe founder Yegor Sak, who had been prosecuted personally because his name was on the bill for a Finnish server an anonymous user allegedly used in an attack. No logs existed to settle the question either way. “We’d rather fight in court than betray our users,” Sak said.

stir

Raids and court cases are rare, so most of the evidence comes from independent audits, and those deserve a closer read than the marketing gives them. An audit is a snapshot. When Securitum examined Proton VPN in May 2026, its report described a point-in-time review of selected production servers rather than a permanent guarantee. That doesn’t make audits worthless. It means an unbroken annual run counts for more than a single certificate, and a provider that posts full reports publicly invites more scrutiny than one that keeps them behind a customer login.

Audits also say nothing about who owns the company. Kape Technologies, which bought ExpressVPN in 2021 for roughly $936 million, also owns CyberGhost and Private Internet Access, and it bought a stable of VPN review sites the same year. NordVPN and Surfshark both sit under Nord Security. None of that is disqualifying on its own, but brands that look like competitors are sometimes one balance sheet.

short list

Mullvad is the purist’s choice. It charges a flat €5 a month, asks for no email address, identifies customers by a random account number, and will take cash by post. It has run on WireGuard alone since retiring its older protocol in January 2026, and the 2023 raid remains about the strongest real-world evidence any provider can point to. It is a weak pick for unlocking streaming libraries and makes no effort to pretend otherwise.

Proton VPN passed its fifth consecutive no-logs audit this year, and the auditors found the same protections on its free servers as on paid ones. The company says its policy has also held up in more than 400 legal cases in which it was ordered to produce logs that did not exist. The open question is geography: Switzerland has been weighing surveillance rule changes that would require larger services to identify users, and Proton has started shifting infrastructure to Germany and Norway in response.

NordVPN has completed six no-logs assessments since 2018, the latest a Deloitte engagement run under the ISAE 3000 standard in late 2025, which concluded its systems matched its stated policy. Subscribers can read that report; everyone else gets the summary. The company also carries a 2018 intrusion into a rented server in Finland, disclosed the following year.

ExpressVPN says it has now completed 27 independent audits, more than any rival has disclosed, spanning its protocol, its no-logs policy, and newer email and identity tools, and it publishes the reports in full. The Turkish seizure counts in its favor. Kape’s ownership is the variable each buyer weighs for themselves.

Surfshark has had its no-logs policy checked by Deloitte twice, in 2023 and 2025, with the report again reserved for account holders. It allows unlimited devices on one subscription, a practical point for households.

Windscribe earns its place on the strength of a courtroom result few rivals can match. Its apps are open source, device connections are unlimited, and its free plan offers up to 10GB a month with a confirmed email address.

show

The riskiest VPN is usually the one that costs nothing. Proton’s research team analyzed more than 7,000 mobile VPN apps and reported in August 2026 that 85% of those on US app stores contained trackers. Of the 390 available to US users, 64 appeared to be owned by Chinese companies, and 31 of those concealed it behind shell entities. Proton sells a competing product, but the numbers line up with the Tech Transparency Project and its 2025 finding that roughly one in five of the top 100 free VPN apps on Apple’s US App Store had undisclosed Chinese ownership. The apps in Proton’s study were downloaded more than 13.2 million times in June 2026 alone.

What a VPN Won’t Do

Even an honest VPN only relocates trust. The internet provider stops seeing which sites a user visits, and the VPN company starts. A VPN won’t stop a phishing link, won’t hide anyone from a service they’re logged into, and won’t keep an app from collecting a location it already has permission to see. That is why a provider’s record matters more than its speed chart.

The records themselves take different shapes. Proton’s latest took two Securitum consultants six person-days in Zürich. Mullvad’s took at least six police officers and a search warrant. Both ended the same way, with nothing to hand over.

tags: VPN, best VPN, no-logs VPN, online privacy, cybersecurity, Mullvad, Proton VPN, NordVPN, ExpressVPN, Surfshark, Windscribe, free VPN apps, privacy audits