無日誌聲稱與獨立審計：377 項 VPN 私隱政策揭示甚麼

"No logs" is the most common promise in VPN marketing. It is also the hardest one for a buyer to check. A privacy policy can say "no logs" in the headline and describe, a few paragraphs later, which connection data it keeps and for how long.

At VPNRadarLab we score VPN services only from what the providers publish: privacy policies, audit reports, apps, jurisdictions, prices. That makes it possible to put three questions side by side for every service in the ranking. Does it promise no logs? Has someone outside the company checked? And what does the policy itself say about the IP address you connect from?

The numbers below cover the 377 services in our main ranking, from a data snapshot taken on 16 October 2026. Where a provider says nothing on a point, we count it as "not published", not as "no".

The claim is nearly universal

303 of the 377 services (80%) publish a no-logs policy. Another 26 have a qualified version, typically one that rules out logging browsing history but keeps connection times or IPs. 32 do not make the claim, and 16 publish nothing either way.

So the phrase by itself separates almost nothing. Four out of five services in the ranking use it.

Few have it checked

35 services have an independent no-logs audit. That is 9% of the ranking and 12% of the services that claim no logs. All 35 also publish a no-logs policy.

Our rule here is generous. We count an audit when the provider says one was done, even if it does not name the auditor or publish the report, because audit firms sometimes work under non-disclosure terms. Even so, 268 of the 303 services that promise no logs show no independent audit: for 123 our records say there is none, and 145 publish nothing about an audit.

Other checks are rarer still. 21 services publish a warrant canary, 20 a transparency report, and 3 point to a case, in court or otherwise, where the no-logs promise was tested in practice.

What the policies say about your IP address

The IP address you connect from is the piece of data that links VPN activity back to a person. Here is what the 303 no-logs policies say about it:

In other words, 22 services promise no logs and also state that they store the connection IP. 109 make the promise without saying anything about the IP. 61 of the 303 state that they keep session times.

Across the whole ranking, 45 services say in their own policy that they keep connection IPs. On VPNRadarLab each of them carries a red flag, which caps the overall score at 6.0 out of 10 whatever else the service does well.

Only 27 services have all three: a no-logs policy, an independent audit, and a policy that says connection IPs are not stored. That is 7% of the ranking.

Audited does not always mean "no IP at all"

The audited group is not uniform either. Of the 35 audited services, 27 state that connection IPs are not stored, 3 keep them temporarily or partly, and 5 do not say.

Two examples from the "temporary" group, quoted from the policies as recorded in our data:

• Surfshark (Netherlands) has a no-logs audit by Deloitte. Its policy says the user ID or IP and timestamps are kept temporarily and deleted within 15 minutes after the session ends.
• Proton VPN (Switzerland) has a published no-logs audit. Its policy says there are no permanent IP logs, with temporary storage for abuse and fraud prevention.

Neither of these is hidden; both are written down. That is the point of reading past the headline. "Temporary" is a different thing from "never stored", and the difference shows up in the policy text, not in the claim.

For comparison, Mullvad (Sweden), IVPN (Gibraltar) and Private Internet Access (USA) are audited and state that neither connection IPs nor session times are stored. CyberGhost VPN, Windscribe and TunnelBear state that connection IPs are not stored, but our records do not show an independent no-logs audit for them.

Jurisdiction: often not stated

Where a provider is based decides which law can compel it to collect data. Our data has two fields for this: the country and its membership of the 5/9/14 Eyes intelligence-sharing alliances.

117 of the 377 services do not state the country they operate under. The largest single jurisdiction is the USA with 92 services.

The audit rate is close to the same inside the Five Eyes (8 of 107) and outside all three alliances (12 of 137). Being outside the alliances does not make a provider more likely to have been audited, and in absolute numbers more of the services that store connection IPs sit outside the 14 Eyes (20) than inside the Five Eyes (12). Jurisdiction and logging policy are separate questions, and both need an answer.

How to read a no-logs claim

From going through these records, the useful order is:

1. Find what the policy says about the connection IP and session times. A clear "not stored" is a different promise from "kept for a short time" or silence.
2. Check whether there is an independent audit, who did it and what it covered. Our list of VPNs with an independent no-logs audit has the 35 services from the main ranking, plus two more outside it.
3. Check where the company is registered. If the provider does not say, treat that as missing information, not as a good sign. The VPN jurisdiction map shows where VPN companies are registered and which alliance each country belongs to.
4. Read the claim last. Almost everyone makes it.

How each of these points feeds the score is in the methodology.

Data

The analysis uses the same records as vpnradarlab.com. A snapshot of the top 100 of the ranking, with columns for the no-logs policy, the no-logs audit, jurisdiction, alliance and red flags, is published as open data under CC BY 4.0: github.com/vpnradarlab/vpn-ranking, DOI 10.5281/zenodo.23457598. Values that a provider does not publish are marked not_stated, not no.

Data and methodology: VPNRadarLab. This article was drafted with AI assistance from the site's published data and checked against it. The author is VPNRadarLab, the publisher of the data. VPNRadarLab has no affiliate links.