I run a small VPN review site and kept finding "independently audited" in marketing copy with no report behind it. So I built a table of all 71 providers I cover and recorded only audits where there's a dated report or announcement from the provider or the auditor, with a link to each.
Disclosure: I used Claude to do the first pass of the research and to build the page. It fetched every source URL and I checked the ones it flagged as uncertain by hand (Norton, NordVPN, hide.me, CactusVPN).
Results: 23 have at least one audit. 48 have never published any. 30 audits in the last 24 months, almost all no-logs attestations; only a handful cover apps or infrastructure.
Surprises: NordVPN's reports are only readable inside a customer account. Cloudflare's KPMG examinations cover the 1.1.1.1 resolver and never mention WARP, so WARP is listed as unaudited. Several big names have exactly one audit from years ago.
I run a small VPN review site and kept finding "independently audited" in marketing copy with no report behind it. So I built a table of all 71 providers I cover and recorded only audits where there's a dated report or announcement from the provider or the auditor, with a link to each.
Disclosure: I used Claude to do the first pass of the research and to build the page. It fetched every source URL and I checked the ones it flagged as uncertain by hand (Norton, NordVPN, hide.me, CactusVPN).
Results: 23 have at least one audit. 48 have never published any. 30 audits in the last 24 months, almost all no-logs attestations; only a handful cover apps or infrastructure.
Surprises: NordVPN's reports are only readable inside a customer account. Cloudflare's KPMG examinations cover the 1.1.1.1 resolver and never mention WARP, so WARP is listed as unaudited. Several big names have exactly one audit from years ago.