Almost every VPN company advertises a “no-logs” policy. For travelers who lean on hotel, airport and café Wi-Fi, that promise matters: a VPN routes all your traffic through the provider, so you are shifting trust from the network operator to the VPN company. The question is whether anyone outside the company has checked the claim.
This explainer covers what a no-logs audit is, which well-known providers have published one recently, and where VPN use itself can get you in trouble abroad.
What a no-logs audit actually proves
In a no-logs audit, an outside firm (often an accounting firm or security consultancy) examines server configurations, internal procedures and staff practices to see whether the company’s systems are set up the way its privacy policy says. Two caveats apply to almost all of them:
- They are point-in-time. An audit confirms how things looked during a specific window, not forever after.
- The provider pays for them. That is normal for audits, but it is why repeated audits and real-world tests (like a police search that finds nothing) carry more weight than a single report.
A VPN without a published independent audit or legal test may still keep no logs. We just can’t verify it, so we treat those claims as unaudited.
Providers with verified no-logs evidence (as of October 2026)
This is not a “best VPN” ranking. The only criterion for inclusion is a published independent audit or legal test that we could confirm from the provider or two reputable outlets in this research.
| Provider | Evidence | Date | Notes |
|---|---|---|---|
| NordVPN | Deloitte (Lithuania) reasonable assurance engagement, ISAE 3000 | Report issued Dec. 2025 | Described by NordVPN as its sixth independent no-logs verification; full report available to customers after login |
| ExpressVPN | KPMG LLP assurance engagement, ISAE (UK) 3000 Type 1 | Systems as of Feb. 28, 2025 (published June 2025) | Focused on its TrustedServer setup; full report available after accepting KPMG terms |
| Proton VPN | Securitum audit, including on-site work in Zurich | August 2025 | Fourth consecutive annual audit; reported to cover free and paid users alike |
| Mullvad | Swedish police search warrant at its Gothenburg office | April 2023 | Police sought customer data; Mullvad said such data “did not exist” and officers left without it |
Other providers may have their own audits that are not covered here. If you are considering a VPN not on this list, look for a named auditor, a date, and ideally a downloadable report on the company’s own site. If you can’t find all three, assume the no-logs claim is unaudited.
Where VPN use is restricted
A VPN that is perfectly legal at home can be a problem overseas. Based on a July 2026 country guide from VPN research site Top10VPN, restrictions fall into two broad groups:
- Effectively banned: Belarus, Iraq, North Korea and Turkmenistan.
- Only government-approved or registered VPNs allowed: China, Russia, Iran and Pakistan, with fines (and in Iran, possible jail time) for unapproved use.
- Other restrictions: Turkey blocks many VPN providers; Oman limits VPNs to approved corporate use; Myanmar began blocking VPNs in 2024; the UAE allows legitimate use but penalizes using a VPN to commit crimes or bypass blocked services.
Laws and enforcement change, and this is not legal advice. Check the State Department’s country page and your employer’s travel policy before relying on a VPN in any of these places.
What to do before your trip
- Install and sign in to your VPN at home. Provider websites and app stores can be blocked once you land in some countries.
- Connect after joining hotel Wi-Fi and getting past its login page; most VPNs can’t connect until the captive portal is cleared.
- Expect some banks, streaming services and airline sites to flag or block VPN traffic. Switch it off briefly if a login fails, ideally on cellular data rather than public Wi-Fi.
Our take
For most U.S. travelers, a VPN is a reasonable extra layer on public Wi-Fi, but it is not magic. Most sites already use HTTPS encryption, and a VPN does nothing about phishing or a stolen phone. If you are going to route everything through one company, pick one whose no-logs claim has been checked by someone else, recently and more than once. Read the audit summaries yourself, too: several full reports sit behind a login or terms page, so the public summary is written by the provider.
Related on Points Capital: How to use a travel router in a hotel: captive portals, VPNs and what to buy; iPhone Lockdown Mode for travel; Shred your boarding pass: what the barcode reveals.
Source: NordVPN; ExpressVPN; TechRadar on Proton VPN’s 2025 audit; Mullvad and TechRadar; Top10VPN country guide
Leave a Reply