“No logs” is a claim that needs a definition. A service may distinguish browsing history from account information, payment records, diagnostic events or abuse-prevention data. Read the actual policy rather than treating the slogan as a complete description.
Ask what information is collected
Look for categories of data, the reasons for collection, retention language and any optional diagnostics. Check whether the policy applies to the VPN itself, the website, related security tools or all of them. A policy written for a whole product suite may cover information that a simple marketing line does not mention.
Understand the limits of an audit
An audit report concerns a particular scope and period. Infrastructure, configurations and ownership can change afterward. A penetration test, application code review and assessment of logging controls ask different questions; none should automatically be described as interchangeable. An audit is relevant evidence, not a lifetime certification or a substitute for the report.
A practical evidence checklist
- Who? Identify the audit firm and the organization commissioned.
- What? Establish the products, systems and claims within scope.
- When? Find the assessment period and publication date.
- Where? Look for an accessible report, not only a press release.
- Limitations? Read exclusions, findings and any described remediation.
Ownership and jurisdiction are context
Knowing the operating entity and its legal location helps you interpret a policy and direct a question. It does not by itself prove how the system is configured or predict every legal outcome. Likewise, a privacy-friendly reputation does not replace current documentation.
Compare claims fairly
Record what a provider explicitly says and what has not been established. If a report is restricted or unavailable, say that rather than inventing its conclusion. Ask the provider for a public reference when important details are missing.
Our profiles list published audit details and their sources when available. “Not confirmed” means the listing lacks sufficient sourced detail; it is not a finding that the provider failed a test. User ratings describe experiences and do not independently verify a no-logs policy.