Why is the phrase alone not enough?
Providers can use “no logs” to describe different things. One may mean no browsing history, while still processing session timestamps or diagnostics. Another may separate VPN infrastructure from the account and payment systems. The useful unit is the individual data category, not the slogan.
Open the current privacy policy and make a table for:
- browsing activity and destination services;
- DNS queries;
- source and assigned IP addresses;
- connection start, duration and transferred volume;
- app telemetry, crash reports and diagnostics;
- account, subscription, payment, support and abuse-prevention data; and
- retention, aggregation, deletion and user-choice rules for each category.
Also identify whether optional analytics are truly optional and whether the policy differs by app store, device, free plan or website.
How do independent reports help?
A report can test a management assertion against stated criteria. The KPMG ExpressVPN report linked here, for example, names the subject matter, date and scope rather than offering a timeless certificate. NordVPN’s announcement says its 2025 engagement was its sixth; the underlying report and access conditions remain important when evaluating the exact conclusion.
Read the report type, assessor, date, entities, systems and exclusions. A security assessment, penetration test and no-logs assurance engagement answer different questions even when marketing calls all three an “audit.”
What conclusion is justified?
State the narrow result: the provider makes specified claims, and a named report provided specified assurance for a defined scope and time. Then list what remains outside that scope. Do not translate that into “anonymous,” “zero data” or a guarantee about future operation.