Sourced tracker
Every published VPN audit, by date
81 independent audits of 29 VPN providers by 23 audit firms: who checked what, when, what they found and whether the report is public. Newest first. Last checked 19 Oct 2026.
All audits, newest first
“What was checked” is the scope the audit itself states; anything outside it was not examined. An audit is a snapshot of the day it was done.
| Provider | Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|---|
| Mullvad | 1 Jun 2026 | Leviathan Security | Apps | Android app 2026.2 against the App Defense Alliance MASA profile; black-box, no code review. | Not published | Report SourceRead 18 Oct 2026 |
| X-VPN | 30 Apr 2026 | Deloitte | No-logs | Deloitte Singapore, ISAE 3000 limited assurance on configuration and operations against the no-logs statements, as of 28 February 2026; two observations reported fixed. | Not published | SourceRead 18 Oct 2026 |
| Malwarebytes Privacy VPN | 2 Apr 2026 | X41 D-Sec | Servers and infrastructure | Server infrastructure shared with AzireVPN: hardware and server-side software | 2 critical, 2 medium, 2 low | Report SourceRead 19 Oct 2026 |
| Mullvad | 6 Mar 2026 | Assured | Protocol | GotaTun 0.2.0, Mullvad's WireGuard implementation; DAITA, the CLI and external dependencies excluded. | 2 low | Report SourceRead 18 Oct 2026 |
| Surfshark | Mar 2026 | Cure53 | Protocol | Architecture and cryptography of the Dausos protocol; only a summary is published. | Not published | SourceRead 18 Oct 2026Report not public |
| Surfshark | 23 Jan 2026 | SecuRing | Servers and infrastructure | Black-box penetration test of the network infrastructure, 1 to 10 December 2025. | 1 medium | Report SourceRead 18 Oct 2026 |
| Mullvad | 21 Jan 2026 | X41 D-Sec | Backend and payments | White-box review of the account and payment API and backend; some findings redacted. | 3 medium, 2 low | Report SourceRead 18 Oct 2026 |
| Private Internet Access | 8 Dec 2025 | Deloitte | No-logs | Deloitte Audit Romania, ISAE 3000: server configuration as of 31 October 2025, including dedicated-IP tokens. | Not published | Report SourceRead 18 Oct 2026 |
| CyberGhost | 8 Dec 2025 | Deloitte | No-logs | Deloitte Audit Romania, ISAE 3000 limited assurance: server network, configuration, change management, incident response and dedicated-IP tokens. Third review. | Not published | Report SourceRead 18 Oct 2026 |
| Proton VPN | 1 Dec 2025 | Ruben Santamarta | Apps | Security audits of the apps by an independent researcher; the date is when Proton's article was updated. | Not published | SourceRead 18 Oct 2026 |
| TunnelBear | 24 Nov 2025 | Cure53 | Apps and infrastructure | Eighth annual white-box audit, October to November 2024: apps, backend and server configuration, public APIs and encryption. | Not published | SourceRead 18 Oct 2026Report not public |
| AmneziaVPN | Nov 2025 | 7ASecurity | Apps and infrastructure | Whitebox audit of apps, custom protocols, infrastructure and supply chain, December 2024 to January 2025 | 2 critical, 1 high | Report SourceRead 19 Oct 2026 |
| Mullvad | 23 Oct 2025 | Assured | Backend and payments | Penetration test of the customer web app. | 1 low | Report SourceRead 18 Oct 2026 |
| Proton VPN | 19 Sep 2025 | Securitum | No-logs | On-site no-logs audit in Zurich, August to September 2025. | Not published | Report SourceRead 18 Oct 2026 |
| Surfshark | 16 Jun 2025 | Deloitte | No-logs | ISAE 3000: standard, static and multiport servers and their deployment. | Not published | SourceRead 18 Oct 2026Report not public |
| Surfshark | 9 Jun 2025 | SecuRing | Apps | Web, desktop and mobile apps and extensions, February to April 2025; only an attestation letter is published. | Not published | SourceRead 18 Oct 2026Report not public |
| ExpressVPN | Jun 2025 | KPMG | Privacy policy | ISAE 3000 assurance on the privacy and no-logs commitments. | Not published | Report SourceRead 18 Oct 2026 |
| Mullvad | 19 May 2025 | Assured | Apps | The installer and downloader (VPN loader): protocol and source code. | Not published | Report SourceRead 18 Oct 2026 |
| IPVanish | 10 Apr 2025 | Schellman | No-logs | No-logs audit concluded on 21 February 2025: interviews, server configuration review and test traffic | Not published | SourceRead 19 Oct 2026Report not public |
| Mullvad | 27 Mar 2025 | NCC Group | Apps | Android app 2024.9 against the MASA profile; black-box, no code reviewed. | Not published | Report SourceRead 18 Oct 2026 |
| AdGuard VPN | 25 Mar 2025 | Leviathan Security | Apps | Android app, App Defense Alliance Mobile App Security Assessment (MASA) Level 2 | Not published | SourceRead 19 Oct 2026Report not public |
| NordVPN | 18 Feb 2025 | Deloitte | No-logs | Deloitte Audit Lithuania, fifth engagement, with access from 18 November to 20 December 2024. | Not published | SourceRead 18 Oct 2026Report not public |
| Mullvad | 11 Dec 2024 | X41 D-Sec | Apps | Penetration test and source review of the VPN app on all platforms, October to November 2024. | 3 high, 2 medium, 1 low | Report SourceRead 18 Oct 2026 |
| AmneziaVPN | Dec 2024 | 7ASecurity | Apps | Review of the Android, iOS and desktop clients plus the AmneziaWG and XRay services | Not published | Report SourceRead 19 Oct 2026 |
| ExpressVPN | Nov 2024 | Cure53 | Apps | Aircove routers, second audit. | Not published | Report SourceRead 18 Oct 2026 |
| ExpressVPN | Oct 2024 | Cure53 | Protocol | Lightway after its rewrite in Rust, fourth audit. | Not published | Report SourceRead 18 Oct 2026 |
| Opera VPN | 25 Sep 2024 | Deloitte | No-logs | Infrastructure of the free browser VPN on desktop, Android and iOS, June to August 2024; Opera VPN Pro excluded. | Not published | SourceRead 18 Oct 2026Report not public |
| ExpressVPN | Sep 2024 | Praetorian | Protocol | Lightway, third audit; the public report is the retest. | Not published | Report SourceRead 18 Oct 2026 |
| Proton VPN | 12 Jul 2024 | Securitum | No-logs | On-site no-logs audit in Geneva, July 2024. | Not published | Report SourceRead 18 Oct 2026 |
| Brave VPN | 8 Jul 2024 | Assured | Servers and infrastructure | Guardian VPN relays and API servers, including logging, March to April 2024. | 6 medium, 11 low | Report SourceRead 18 Oct 2026 |
| Mullvad | 27 Jun 2024 | Cure53 | Servers and infrastructure | One OpenVPN and one WireGuard staging server plus the Ansible code, with a privacy focus. | 1 medium, 1 low | Report SourceRead 18 Oct 2026 |
| hide.me | 7 Jun 2024 | Securitum | No-logs | VPN container image, configuration files, deployment process and staff interviews against the no-logs claim, as of March 2024. | Not published | Report SourceRead 18 Oct 2026 |
| Windscribe | Jun 2024 | Packetlabs | Servers and infrastructure | The FreshScribe VPN server stack. | Not published | SourceRead 18 Oct 2026 |
| ExpressVPN | Jun 2024 | Cure53 | Browser extension | The VPN browser extension, second audit. | 1 medium | Report SourceRead 18 Oct 2026 |
| Psiphon | May 2024 | Cure53 | Protocol | White-box test of the Psiphon Tunnel Core code, April to May 2024; no critical findings, one high. | Not published | SourceRead 18 Oct 2026 |
| Private Internet Access | 25 Apr 2024 | Deloitte | No-logs | Deloitte Audit Romania: servers, network and incident management, dedicated IP. | Not published | SourceRead 18 Oct 2026Report not public |
| ExpressVPN | 16 Apr 2024 | Nettitude | Apps | Windows app, checking the fix for the split-tunnelling DNS leak. | 1 medium | Report SourceRead 18 Oct 2026 |
| IVPN | 11 Apr 2024 | Cure53 | Backend and payments | Customer website, API, web servers and web infrastructure, in a test environment without production access. | 2 low, 2 info | Report SourceRead 18 Oct 2026 |
| Brave VPN | 19 Mar 2024 | Assured | Backend and payments | White-box test of the Guardian app backend APIs, February 2024, commissioned by DNSFilter. | 1 high, 8 medium, 10 low | Report SourceRead 18 Oct 2026 |
| Kaspersky VPN | 6 Feb 2024 | AV-Test | Apps | A test commissioned by Kaspersky of the Windows and Android apps: speed, encryption and IP leak protection. Not a no-logs or infrastructure audit. | Not published | Report SourceRead 18 Oct 2026 |
| Mozilla VPN | 6 Dec 2023 | Cure53 | Apps | The VPN apps for macOS, Linux, Windows, iOS and Android, tested in 2023; two items rated critical or high, all addressed. | Not published | Report SourceRead 18 Oct 2026 |
| ExpressVPN | Dec 2023 | KPMG | Privacy policy | Assessment of the privacy policy claims. | Not published | Report SourceRead 18 Oct 2026 |
| Hotspot Shield | 25 Aug 2023 | Aon | No-logs | Free and paid tiers, client and server side, against the privacy policy's logging claims; security controls and hosting excluded. Summary report only. | Not published | SourceRead 18 Oct 2026Report not public |
| Betternet | 25 Aug 2023 | Aon | No-logs | Review of Betternet's privacy-policy claims on data collection and logging, free and paid tiers | Not published | SourceRead 19 Oct 2026 |
| Mullvad | 9 Aug 2023 | Radically Open Security | Servers and infrastructure | Two RAM-only VPN servers, including a check for logging; binaries and hardware excluded. | Not published | SourceRead 18 Oct 2026Report not public |
| Proton VPN | 1 May 2023 | Securitum | No-logs | On-site no-logs audit in Zurich, April to May 2023. | Not published | Report SourceRead 18 Oct 2026 |
| PureVPN | 17 Apr 2023 | KPMG | No-logs | KPMG Canada checked four no-log claims on 7 servers in 6 countries in February 2023; the letter says it was not a security or full privacy assessment. | Not published | SourceRead 18 Oct 2026Report not public |
| IVPN | 15 Mar 2023 | Cure53 | Servers and infrastructure | Operating system and setup of the upgraded VPN gateway servers, in a test environment without production access. | 1 medium, 6 low, 1 info | Report SourceRead 18 Oct 2026 |
| Mullvad | 17 Feb 2023 | Assured | Backend and payments | Account and payment API, tested in November 2022. | None reported | Report SourceRead 18 Oct 2026 |
| FastestVPN | 29 Jan 2023 | Altius IT | No-logs | No-log audit of the VPN app, servers, features and legal policies | Not published | Report SourceRead 19 Oct 2026 |
| Surfshark | 25 Jan 2023 | Deloitte | No-logs | Server configuration and deployment, API, network software and staff interviews. | Not published | SourceRead 18 Oct 2026Report not public |
| Bitdefender VPN | 25 Jan 2023 | Aon | Servers and infrastructure | Privacy assessment of the VPN platform of Pango, Bitdefender's infrastructure partner at the time; Bitdefender's privacy policy now names a different processor. | Not published | SourceRead 18 Oct 2026Report not public |
| AmneziaVPN | Jan 2023 | 7ASecurity | Apps | Whitebox review of the Windows, Linux, macOS and Android clients, carried out in May 2022 | Not published | Report SourceRead 19 Oct 2026 |
| ExpressVPN | Nov 2022 | Cure53 | Protocol | Lightway, second audit. | 5 low, 4 info | Report SourceRead 18 Oct 2026 |
| Mullvad | 21 Oct 2022 | Atredis Partners | Apps | Penetration test and source audit of the apps on five platforms. | Not published | Report SourceRead 18 Oct 2026 |
| ExpressVPN | Oct 2022 | Cure53 | Browser extension | The VPN browser extension, first audit. | Not published | Report SourceRead 18 Oct 2026 |
| CyberGhost | 22 Sep 2022 | Deloitte | No-logs | ISAE 3000 review of whether the privacy policy matches the server configuration; the report is available from Deloitte on request. | Not published | SourceRead 18 Oct 2026Report not public |
| Mullvad | 14 Sep 2022 | Assured | Servers and infrastructure | Self-hosted authoritative DNS servers, before they went into production. | None reported | Report SourceRead 18 Oct 2026 |
| ExpressVPN | Sep 2022 | KPMG | No-logs | ISAE 3000 Type 1 assurance on the no-logs policy. | Not published | SourceRead 18 Oct 2026Report not public |
| ExpressVPN | Sep 2022 | Cure53 | Apps | iOS app. | Not published | Report SourceRead 18 Oct 2026 |
| Private Internet Access | 30 Aug 2022 | Deloitte | No-logs | Deloitte Audit Romania: server configuration as of 30 June 2022. | Not published | SourceRead 18 Oct 2026Report not public |
| ExpressVPN | Aug 2022 | Cure53 | Apps | Linux app. | Not published | Report SourceRead 18 Oct 2026 |
| ExpressVPN | Jul 2022 | Cure53 | Apps | macOS app. | Not published | Report SourceRead 18 Oct 2026 |
| Mullvad | 22 Jun 2022 | Assured | No-logs | Two WireGuard and one OpenVPN server, freshly installed: configuration and any customer logging. | Not published | Report SourceRead 18 Oct 2026 |
| Lantern | 5 May 2022 | NCC Group | Apps | White-box assessment of the Lantern client on Windows, Android and iOS, with a 2022 review after remediation | Not published | Report SourceRead 19 Oct 2026 |
| ExpressVPN | May 2022 | Cure53 | Servers and infrastructure | White-box review of TrustedServer, the in-house VPN server software. | None reported | Report SourceRead 18 Oct 2026 |
| Proton VPN | 22 Apr 2022 | Securitum | No-logs | First no-logs audit. | Not published | SourceRead 18 Oct 2026 |
| IPVanish | 4 Apr 2022 | Leviathan Security | No-logs | No-logs audit: staff interviews, system configuration, server deployment and test traffic | Not published | SourceRead 19 Oct 2026Report not public |
| ExpressVPN | Apr 2022 | F-Secure | Apps | Windows app version 12. | Not published | SourceRead 18 Oct 2026Report not public |
| Opera VPN | 30 Mar 2022 | Cure53 | Apps and infrastructure | VPN backend plus desktop and mobile clients; only a summary report is published. | Not published | Report SourceRead 18 Oct 2026 |
| Windscribe | Mar 2022 | Leviathan Security | Apps | Source review of the Android and iOS apps; Windscribe says all issues were fixed. | Not published | Report SourceRead 18 Oct 2026 |
| Mozilla VPN | 1 Sep 2021 | Cure53 | Apps | The Mozilla VPN apps, tested in March 2021. | 1 high, 2 medium | Report SourceRead 18 Oct 2026 |
| Windscribe | Sep 2021 | Leviathan Security | Apps | Code review of the desktop client. | Not published | Report SourceRead 18 Oct 2026 |
| ExpressVPN | Aug 2021 | Cure53 | Protocol | Lightway, first audit. | Not published | Report SourceRead 18 Oct 2026 |
| Surfshark | Apr 2021 | Cure53 | Servers and infrastructure | Servers, VPN configuration and related infrastructure; only a management summary is published. | Not published | SourceRead 18 Oct 2026Report not public |
| Mullvad | 20 Jan 2021 | Cure53 | Servers and infrastructure | First infrastructure audit, December 2020; six issues from informational to high, no breakdown given. | Not published | Report SourceRead 18 Oct 2026 |
| Mullvad | 25 Jun 2020 | Cure53 | Apps | Desktop 2020.4, Android and iOS apps; the worst finding was rated medium. | Not published | Report SourceRead 18 Oct 2026 |
| ExpressVPN | Jun 2020 | PwC | Backend and payments | PwC Switzerland on the build verification process. | Not published | SourceRead 18 Oct 2026Report not public |
| ZeroTier | 23 Mar 2020 | Trail of Bits | Protocol | One-week review of the ZeroTier 2.0 cryptographic design; a preliminary review, not a code audit. | Not published | Report SourceRead 18 Oct 2026 |
| ExpressVPN | Jun 2019 | PwC | Privacy policy | PwC Switzerland on privacy policy compliance and TrustedServer. | Not published | SourceRead 18 Oct 2026Report not public |
| VyprVPN | 9 Nov 2018 | Leviathan Security | No-logs | No-log assessment of VyprVPN, final report with retest, prepared for Golden Frog | Not published | Report SourceRead 19 Oct 2026 |
By audit firm
| Auditor | Audits | Providers |
|---|---|---|
| Cure53 | 22 | ExpressVPN, IVPN, Mozilla VPN, Mullvad, Opera VPN, Psiphon, Surfshark, TunnelBear |
| Deloitte | 10 | CyberGhost, NordVPN, Opera VPN, Private Internet Access, Surfshark, X-VPN |
| Assured | 8 | Brave VPN, Mullvad |
| Leviathan Security | 6 | AdGuard VPN, IPVanish, Mullvad, VyprVPN, Windscribe |
| Securitum | 5 | hide.me, Proton VPN |
| KPMG | 4 | ExpressVPN, PureVPN |
| 7ASecurity | 3 | AmneziaVPN |
| Aon | 3 | Betternet, Bitdefender VPN, Hotspot Shield |
| X41 D-Sec | 3 | Malwarebytes Privacy VPN, Mullvad |
| NCC Group | 2 | Lantern, Mullvad |
| PwC | 2 | ExpressVPN |
| SecuRing | 2 | Surfshark |
| Altius IT | 1 | FastestVPN |
| Atredis Partners | 1 | Mullvad |
| AV-Test | 1 | Kaspersky VPN |
| F-Secure | 1 | ExpressVPN |
| Nettitude | 1 | ExpressVPN |
| Packetlabs | 1 | Windscribe |
| Praetorian | 1 | ExpressVPN |
| Radically Open Security | 1 | Mullvad |
| Ruben Santamarta | 1 | Proton VPN |
| Schellman | 1 | IPVanish |
| Trail of Bits | 1 | ZeroTier |
No public audit found
We looked on these providers’ own security and privacy pages and found no published independent audit: Astrill (checked 19 Oct 2026), Avira Phantom VPN (checked 19 Oct 2026), Edge Secure Network (checked 19 Oct 2026), F-Secure VPN (checked 19 Oct 2026), iCloud Private Relay (checked 19 Oct 2026), iTop VPN (checked 19 Oct 2026), Mysterium VPN (checked 19 Oct 2026), NetBird (checked 19 Oct 2026), OVPN (checked 19 Oct 2026), Planet VPN (checked 19 Oct 2026), PrivadoVPN (checked 19 Oct 2026), PrivateVPN (checked 19 Oct 2026), Turbo VPN (checked 19 Oct 2026), Urban VPN (checked 19 Oct 2026), VPN Unlimited (checked 19 Oct 2026), ZoogVPN (checked 19 Oct 2026).
How this page is kept
- Only the provider’s own pages and the auditors’ published reports count. Reviews and news are used only to find them.
- Every row is tied to a short sentence on its source, and a script re-reads each source weekly; a changed source is re-checked by hand before the row changes.
- “Report not public” means the provider announced the audit but the report is available only on request or not at all.
- The same records feed leak issues by provider and each provider’s leak-test page.