Quick answer
Mullvad, Private Internet Access, Proton VPN, NordVPN and ExpressVPN have the strongest no-logs evidence in 2026. Mullvad and PIA stand apart because their claims were tested by real events – a police raid and multiple court subpoenas – rather than only by a commissioned audit.
Why “no logs” means almost nothing on its own
Every commercial VPN advertises a no-logs policy. It is the baseline marketing claim of the industry, and it costs nothing to make. The useful question is not whether a provider claims it, but what evidence exists that the claim is true.
There are three tiers of evidence, and the difference between them is substantial.
An assertion is the privacy policy saying no logs are kept. This is worth something, since misrepresenting it can attract regulatory action, but it is unverified.
An audit is an independent firm examining servers, configurations and policies and publishing findings. This is meaningfully stronger, but it is a snapshot of a particular moment, usually scoped by the provider, and auditors generally examine what they are shown.
A real-world test is a subpoena, a seizure or a raid where the provider was compelled to produce data and could not. This is the only category that proves the claim operationally, because it was tested adversarially by someone with no interest in a favourable outcome.
VPNs with real-world proof
Mullvad – office raid, nothing found
In April 2023, Swedish police arrived at Mullvad’s Gothenburg offices with a search warrant seeking customer data. They left without any, because Mullvad does not collect it. Accounts are random numbers, no email is required, and payment can be made in cash.
Mullvad’s apps are open source and have been audited by Assured and Cure53. The combination of audits plus a tested raid makes it the strongest no-logs record of any provider.
Private Internet Access – tested in US courts
PIA has been subpoenaed in multiple US federal cases, including a 2016 FBI investigation, and in each instance was unable to provide user activity data because none existed. Court transcripts documenting this are public.
That matters especially because PIA is US-based, inside Five Eyes. The courtroom record is the counterargument to the jurisdiction concern: a company cannot hand over what it does not hold, wherever it is incorporated. PIA has also been audited by Deloitte and publishes open-source clients.
ExpressVPN – server seized in Turkey
In 2017, Turkish authorities seized an ExpressVPN server as part of an investigation and recovered no user data. The company’s TrustedServer architecture runs everything in RAM, so a powered-down server retains nothing.
ExpressVPN has also commissioned audits from KPMG and Cure53. The reservation some users raise is ownership by Kape Technologies rather than anything in the logging record.
VPNs with strong audit records
Proton VPN – annual audits, open source
Proton VPN publishes an independent audit every year, releases all its client applications as open source, and issues transparency reports documenting legal requests received. It operates from Switzerland, which has no mandatory retention for VPN providers.
It has not had a publicised seizure or subpoena test, but the combination of annual audits, open code and a company whose entire business is privacy makes it one of the most credible options available.
NordVPN – four Deloitte audits
NordVPN has had its no-logs policy audited by Deloitte on multiple occasions, operates from Panama, and runs a fully diskless RAM-only server fleet that cannot retain data across a reboot.
A 2018 breach of a rented Finnish server was disclosed in 2019 and prompted the move to diskless infrastructure and a wider audit programme. How a company responds to an incident is itself evidence, and the response here was substantive.
Surfshark, CyberGhost and others
Surfshark has been audited by Deloitte and runs RAM-only servers; its jurisdiction in the Netherlands is the main caveat. CyberGhost has also been audited by Deloitte and operates from Romania, which has favourable privacy law. Both are credible, without the real-world tests the top group has.
IVPN, hide.me and Windscribe all publish audits and have strong transparency practices despite being smaller operations. Windscribe’s response to a 2021 Ukrainian server seizure – moving to encrypted disk-less deployments and publishing a detailed account – was handled well.
Providers whose record raises questions
PureVPN advertised no logs and then supplied connection logs to the FBI in a 2017 case. It has since relocated to the British Virgin Islands and commissioned an always-on KPMG audit, which is a genuine structural change, but the history remains relevant.
IPVanish provided user data in a 2016 federal case under previous ownership, and has since been audited independently. Avast’s parent company operated Jumpshot, which sold browsing data collected from users until it was shut down in 2020.
None of this means these services are unsafe for ordinary use. It means that if your reason for buying a VPN is a serious privacy requirement, the providers with clean and tested records are the rational choice.
How to read a VPN audit yourself
Check four things. Who conducted it – a recognised firm such as Deloitte, KPMG, Cure53, Securitum or Assured carries more weight than an unnamed consultancy. What was in scope – an audit of the no-logs policy and server configuration is far more meaningful than an audit of a single mobile app. When it was done – a 2021 audit tells you little about 2026 infrastructure. Whether the full report is published – a summary press release is not an audit; the useful providers publish the document.
Also look for a warrant canary and a transparency report. Neither is proof, but their presence indicates a company that has thought about these questions, and their sudden disappearance is a signal.
What a no-logs VPN still cannot protect you from
Even a perfectly implemented no-logs policy has limits worth being clear about. It does not hide you from services you log into, since your account identifies you regardless of IP address. It does not protect against malware, phishing or a compromised device. It does not defeat browser fingerprinting, which identifies you by device characteristics rather than address.
It also does not protect against a provider being compelled to begin logging going forward. An audit confirms what was happening at a point in time; it cannot bind future behaviour. This is why providers that structurally cannot log – no email at sign-up, RAM-only servers, cash payment – offer something an audit alone does not.
Frequently asked questions
Which VPN has the best proven no-logs record?
Mullvad, on the strength of a 2023 police raid that recovered no data, combined with audits and a model that collects no identifying information in the first place.
Does a US-based VPN automatically keep logs?
No. There is no US law requiring VPN providers to retain user activity, and PIA has demonstrated in court that it holds none. Jurisdiction affects what can be compelled, not what exists.
How often should a VPN be audited?
Annually is the standard set by the best providers. An audit older than two years tells you little about current infrastructure.
What is a warrant canary?
A regularly updated statement that a provider has not received a secret legal demand. Its removal or failure to update is intended to signal that something has changed, since the provider may be barred from saying so directly.
Are open-source VPN apps safer?
They are more verifiable. Open code lets researchers inspect what the client actually does, which closed clients cannot offer. It does not tell you anything about the servers, which is what audits cover.
RAM-only servers: why they matter
A traditional server writes to a hard disk, which retains data across reboots and can be imaged if the hardware is seized. A RAM-only or diskless server holds everything in volatile memory, so cutting power erases it entirely and there is nothing to recover from the physical machine.
NordVPN, ExpressVPN, Surfshark, CyberGhost and Mullvad all run RAM-only fleets. This is a structural protection rather than a policy one, which makes it more durable than a promise: a company cannot hand over disk contents that do not exist, regardless of what it is ordered to do.
It is not a complete answer. A server under live surveillance could still have traffic observed in real time, and RAM-only infrastructure says nothing about what a provider chooses to log centrally. But combined with an audited policy, it meaningfully narrows what could be produced.
Jurisdiction: what the Eyes alliances actually mean
The Five Eyes – the US, UK, Canada, Australia and New Zealand – share signals intelligence under long-standing agreements. The Nine Eyes adds Denmark, France, the Netherlands and Norway; the 14 Eyes adds Germany, Belgium, Italy, Spain and Sweden.
Membership does not mean a country forces VPNs to log. It means that data obtained by one member may be shared with others, so a legal demand in one jurisdiction can have wider reach than it appears.
In practice, jurisdiction matters most in combination with what a provider holds. A Panamanian company that logs everything is worse than a US company that logs nothing, as PIA’s court record demonstrates. Use jurisdiction as one input rather than a verdict.
Building your own assessment
If you want to evaluate a provider yourself, work through five questions. Who owns the company, and is that stated openly? Where is it incorporated, and what are that country’s retention rules? Has the no-logs policy been audited, by whom, when, and is the full report published? Does the infrastructure make logging structurally difficult – RAM-only servers, anonymous sign-up, cash payment? And has the claim ever been tested by a subpoena, seizure or raid?
A provider that answers all five well is rare. Mullvad does. Proton VPN and Private Internet Access come close. Most of the market answers two or three, which is adequate for ordinary privacy and insufficient for anything more serious.
Verdict
If you want the strongest no-logs evidence available, Mullvad and Private Internet Access are the two with records tested by events rather than by commissioned reviews. Proton VPN is the best balance of proven practice and everyday usability, and NordVPN is the strongest choice if you want audited privacy without giving up speed or streaming.