Proton VPN’s no-logs policy confirmed by an external audit

Update August 1, 2023: This article was updated to feature the latest audit of our no-logs policy by Securitum, which was concluded on April 26, 2023. You can read Securitum’s audit of our no-logs policy from 2022 here.

Today, we are excited to announce we passed a new milestone in our drive to make Proton as transparent as possible with the completion of a third-party audit of our infrastructure that confirmed our strict no-logs policy(new window). Now, when we say we are a no-logs VPN, it is not just a claim: it has been double-checked by independent experts.

As an organization founded by scientists who met at CERN, we believe in peer review and transparency. This is also why we make all our apps open source so that anyone can examine our code. 

Of course, we understand that not everyone has the time or skills to inspect code themselves. That is why, in addition to our internal audits, we regularly submit our apps to third-party security audits(new window) and make the results public. This way, everyone can get an independent expert’s opinion of our apps’ security.

In the most recent security audit of all Proton apps(new window), security experts from Securitum(new window), a leading European security auditing company that oversees more than 300 security testing projects every year for major corporations and banks, uncovered no significant security issues. This shows that Proton’s internal audits and culture of secure software development are effective. And because our apps’ code is entirely open source(new window), our security is bolstered by our bug bounty program(new window), which brings security experts together from all around the world to check our applications. 

However, with a VPN service, it’s also important to verify what is happening on the server side and not just the application side. 

Why it’s important to verify a VPN’s no-logs policy

When you connect to a VPN, it becomes your internet provider, meaning any VPN provider is technically capable of tracking and logging what you do online. While many VPNs claim to have no-logs policies, these policies do not always hold up when put to the test. 

Proton VPN’s strict no-logs policy was tested in a legal case in 2019(new window). We were ordered to turn over logs to help identify a user, but we were unable to comply because these logs did not exist. Proton VPN’s Swiss jurisdiction also confers additional benefits for VPN services. For example, within the current Swiss legal framework, Proton VPN does not have any forced logging obligations. However, there remains the possibility that an incorrect server configuration or flawed system architecture could cause logs to be accidentally stored.

To address this, we asked Securitum to perform a thorough examination of our infrastructure and server-side operations. Securitum security experts spent several days on site reviewing our VPN configuration files and server configurations, assessing our operating procedures, and interviewing our staff. The audit was extensive and checked the following:

  • Does Proton VPN track your activity on VPN servers (servers that are passing the traffic)?
  • Does Proton VPN log metadata about the activity on VPN servers, such as DNS traffic?
  • Does Proton VPN inspect or log the network traffic on VPN servers?
  • Does Proton VPN monitor or log information about which services (websites, servers, etc.) you connect to?
  • Does Proton VPN monitor which services (websites, servers, etc.) have been used by a specific VPN server?
  • Does Proton VPN apply the same privacy policy to all servers, regions, and subscription tiers?
  • Does Proton VPN have a specific process to ensure that any unauthorized configuration change (such as “log=false” to “log=true”) will be detected? Will it trigger an automatic alarm?
  • Does Proton VPN have a proper change management process in place to ensure that any authorized changes applied to the logs-related configuration files are reviewed and approved by another employee (dual control)?
  • Do VPN configuration files have any logging enabled?
  • Does Proton VPN log information about which VPN server you are connected to at a given time (or which users are connected to a specific VPN server at a given time)?

The resulting report confirms that we do not keep any metadata logs, do not log your VPN activity, and do not engage in any practices that might compromise your privacy. 

You can read the full report from Securitum below:

Trust through transparency

At Proton, we believe that all claims should be investigated and verified, including our own. Going forward, we will continue to perform periodic security audits and publish the results so you can read an independent security professional’s report before you entrust us with your data.

If you are a security researcher, we also invite you to support security at Proton through our bug bounty program(new window) that offers generous bounties to anyone who can identify vulnerabilities in our open-source services.
Sign up for Proton VPN(new window) to get a transparent, open-source, and fully audited no-logs VPN that respects your privacy

Protect your privacy and security online
Get Proton VPN free

Related articles

What is AirTag stalking?
In an era of “smart devices” that often double as spy devices, AirTags are tracking tools that are open about their function and can be vital in helping locate lost items (as anyone who has lost their car keys can attest to). However, as a recent cla
How to fix a "Your connection is not safe" error
As you surf the web using your browser, you’ll no doubt encounter websites that your browser will refuse to load, instead showing some variation of an error message, such as Your connection is not private or Warning: Potential Security Risk Ahead. 
Your search history is a window into your inner life. Anyone with access to it knows what your hobbies and interests are, your sexual orientation and preferences, the things that worry you (for example your medical concerns), your political affiliati
how to flush dns blog
  • Privacy deep dives
A DNS cache is a record of all the websites you’ve visited over a set amount of time. Simply put, your DNS cache is a list of websites you visited in the past that’s stored on your device. Your computer uses it to speed up visits to those same websit
Is Temu legit?
  • Privacy basics
Temu has become an unavoidable brand. Unknown to most up to a year ago, the online retailer exploded onto the digital scene in the United States with lavish ads and a riveting social media campaign, and has started its takeover in Europe now, too. As
We examIne whether the controversial Chinese video platform is safe to use
  • Privacy basics
In this article, we take an in-depth look at whether the wildly popular social media platform TikTok is safe to use. Several countries recently banned government officials from using TikTok, and now the US House of Representatives has passed the Pro