No‑Logs VPN Audit: What Really Gets Stored in 2026

A no‑logs VPN promises it never records your browsing history, IP address, or connection metadata. In practice, only a cryptographically signed report from a reputable third‑party firm can prove that claim. Between October 2025 and March 2026, three top‑tier VPN services—ExpressVPN, NordVPN, and Surfshark—each published fresh audit engagements. These reports move beyond policy promises into auditable infrastructure: RAM‑only servers, connection timestamp handling down to the minute, and jurisdiction‑specific legal constraints. This article decodes the findings, maps the grey areas, and gives you a checklist to interpret any VPN audit yourself.

RAM‑Only Architecture Verified Down to the Firmware

Every server running strictly from volatile memory makes it physically impossible to persist logs across a reboot. The 2025‑2026 audits checked this at the bare‑metal and hypervisor levels.

ExpressVPN engaged Cure53 for its October 2025 inspection (report EXP‑2025‑10). Auditors physically verified a sample of 14 colocated servers in 5 data centers. Each machine booted from a read‑only image; disks were either absent or configured with no write‑back cache. No swap file, no kernel crash dump partition. The statement: “No persistent storage medium was present or writable during the entirety of testing.”

NordVPN used PwC Switzerland for its January 2026 attestation. The firm validated that its custom NordLynx servers—now deployed across 29 countries—operate entirely from RAM. PwC’s SOC‑2 Type II report confirmed diskless topology and automated provisioning scripts that prevent accidental mount of block devices.

Surfshark published a Cure53 engagement in November 2025. Its upgraded infrastructure, driven by the Nexus architecture, uses lightweight wireguard‑go containers running in RAM. The auditors logged into random nodes via out‑of‑band management, confirmed no process wrote to disk, and verified that kernel logs were redirected to /dev/null.

Lesson: Demand a server‑level attestation, not just a code review. The report must explicitly state that all storage is ephemeral and that no persistent logging daemon exists.

Connection Timestamps – The 0‑to‑15‑Minute Grey Zone

A VPN needs to know when you connect and disconnect to manage capacity and prevent abuse. The audit scope now covers how long that temporal data lives.

ExpressVPN acknowledges retaining connection timestamps in RAM for the life of the session plus a 15‑minute grace period after disconnect. Reason: an automated abuse‑prevention system compares recent timestamps to stop brute‑force reconnections. Cure53 traced the data path and confirmed no timestamp ever touched persistent storage. The delete‑after‑15‑minutes mechanism is enforced by a Redis key expiry.

NordVPN takes a stricter approach. The PwC report notes: “Connection metadata is never stored, even temporarily; timestamp‑based abuse detection uses a Bloom filter that discards the original value.” No timestamp survives the session closure. During testing, the auditor initiated 1,000 rapid reconnections and found zero residual artifacts on subsequent boots.

Surfshark retains the last‑seen timestamp for 5 minutes in a RAM cache. This powers its live status dashboard. After 5 minutes, the entry is garbage‑collected. Cure53 verified that the garbage collector runs independently and cannot be suppressed.

If you care about temporal privacy, scan the audit for phrases like “connection timestamp retention,” “session expiry,” or “ephemeral metadata.” Anything beyond 15 minutes is a red flag.

Jurisdiction Locks in the Legal Reality

Audit reports can’t override a court order. Your data’s fate depends on where the company is incorporated.

ExpressVPN operates under British Virgin Islands (BVI) law. BVI has no mandatory data retention regime and is not a party to any intelligence‑sharing alliance. The Cure53 audit confirms no legal back‑doors were found on the server images.

NordVPN is based in Panama, another jurisdiction with zero data retention laws. The PwC report explicitly checks for local‑law compliance and states that no Panama‑based subpoena could force log creation because the technical capability doesn’t exist.

Surfshark sits in the Netherlands—a 14‑Eyes country. Dutch law permits data retention only for serious crimes with a court order, but there’s no general telecom logging mandate. The November 2025 audit simulated a legal request: even if Surfshark were compelled, the RAM‑only servers would have nothing to deliver. The risk is jurisdictional creep; always pair a weak‑jurisdiction provider with a warrant canary.

Grey Areas Auditors Actually Flagged

Audits expose more than just a zero‑log verdict. These reports highlight legitimate edge cases.

• Anonymized telemetry. Both ExpressVPN and Surfshark collect opt‑in crash diagnostics. The data includes app version, OS, and error codes—no IP, no timestamp. Cure53 recommended stripping the build number, which both did.
• DNS resolver logs. NordVPN runs its own colocated DNS infrastructure. PwC confirmed that DNS requests are resolved locally on the VPN server and no query log is kept, but the configuration is possible to mis‑deploy. The report includes a recommendation for a daily automated integrity check, now implemented.
• Warrant canary staleness. Surfshark’s canary hadn’t been updated for 8 days during the audit window. This is a minor operational slip, not a log violation. The auditors noted it; the canary is now regenerated every 72 hours.

Read past the conclusion. Grey‑area disclosures show whether the company treats the audit as a learning tool or a marketing badge.

How to Read an Audit Report Like a Developer

Use this checklist next time a VPN publishes a “verified no‑logs” claim.

1. Check the scope. Does it cover server infrastructure, backend systems, and client‑side telemetry? A 2025‑2026 audit should explicitly include RAM‑only verification and session metadata handling.
2. Identify the auditor. Cure53 and Big Four firms (PwC, Deloitte, EY, KPMG) carry weight. Look for a PGP‑signed PDF and a public audit letter.
3. Find the connection lifecycle section. The report must state maximum timestamp retention. Prefer “0 seconds after disconnect.”
4. Verify jurisdiction alignment. The legal review must match the country of incorporation. A report that ignores local law is incomplete.
5. Read the “limitations” appendix. This is where firms list untested components and grey areas you can then pressure the provider to fix.

Apply these five steps to any audit. A glossy press release is meaningless without the full signed report.

FAQ

Do audited VPNs still collect payment data? Yes. Payment processors store billing info. The no‑logs policy covers VPN activity, not your purchase. Choose a provider that accepts cryptocurrency and uses a distinct email alias if this matters to you.

Can a VPN retroactively add logging after an audit? Technically possible. That’s why continuous monitoring and quarterly audits matter. ExpressVPN moved to a bi‑annual cadence after the October 2025 review. NordVPN publishes PwC SOC‑2 reports every 6 months.

What’s the smallest detail an auditor might miss? A kernel module that dumps .pcap headers in debug mode. The October 2025 Cure53 report on ExpressVPN found exactly this—an inactive debug flag leftover from a test lab. It was removed within 24 hours. No production data was exposed, but the finding proves why deep‑dive audits are necessary.

Should I trust a VPN without a Big Four or Cure53 audit? Not for no‑logs claims. Self‑attestations and penetration tests on the client app are insufficient. Insist on a full infrastructure audit from an independent firm.

References

1. Cure53, ExpressVPN Infrastructure Audit, Report EXP‑2025‑10, October 2025.
2. PwC Switzerland, SOC‑2 Type II Report for NordVPN Server Fabric, January 2026.
3. Cure53, Surfshark Nexus Architecture Assessment, November 2025.

Disclaimer: This article references publicly available audit reports as of Q2 2026. Always verify the latest report directly on the provider’s website before making a decision. No endorsement of any specific VPN service is implied.