Due Diligence in the Tunnel: Reading a VPN's No-Log Policy Like a Financial Statement

When a client hands you financial statements, you don't take the numbers on faith. You look for the audit opinion, you check who issued it, and you note the qualifications. VPN providers deserve the same skepticism — arguably more, since the data flowing through their servers includes Social Security numbers, payroll records, and unpublished financials for every client you serve.

Yet most accounting firms accept a "no-logs" badge on a marketing page as though it were an unqualified opinion. It isn't. It's management's representation, and anyone who has sat through a single attestation engagement knows what representations are worth without corroboration.

The Three Tiers of a No-Log Claim

Not all logging policies are created equal, and it helps to sort them the way you'd sort assurance levels.

Tier one: marketing claims. The provider says it keeps no logs. There is no supporting evidence, no third-party involvement, and no recourse if the claim proves false. Treat this like an unaudited pro forma — interesting, but not decision-grade.

Tier two: independent audits. Several major providers — NordVPN, ExpressVPN, Surfshark among them — have commissioned third-party firms to examine their infrastructure and policies. These audits are meaningful, but read the scope carefully. Some cover only server configuration at a point in time; others examine the full logging pipeline. A limited-scope audit is a review, not an examination.

Tier three: real-world corroboration. The strongest evidence comes from incidents. When a provider's servers are seized or breached and independent forensics confirm that nothing recoverable existed, that's the equivalent of a clean opinion backed by actual workpapers. It has happened for a handful of providers. It has not happened for most.

Jurisdiction Is the Fine Print Nobody Reads

Where a VPN company is incorporated determines which governments can compel disclosure and what data retention mandates apply. Providers based in the Five Eyes alliance — the US, UK, Canada, Australia, and New Zealand — operate under legal frameworks that permit intelligence sharing. Others sit under Fourteen Eyes or in jurisdictions with mandatory retention laws that can quietly contradict a no-log promise.

This matters for a US firm for a practical reason: if you ever need to document your vendor's data handling for a cyber insurance application, a client's due diligence questionnaire, or an IRS Publication 4557-aligned safeguard review, "the vendor says so" is a weak answer. "The vendor is incorporated in Panama, has published two independent audits, and had its no-log architecture verified during a 2021 server seizure" is a defensible one.

Note the nuance, though. A US-based provider isn't automatically worse — US companies are subject to American legal process, which means subpoenas arrive through courts rather than through opaque channels, and a provider can fight an overbroad request. Offshore jurisdictions offer less transparency about how requests are handled, not necessarily more protection.

What an Auditor or Client Would Actually Ask

If a peer reviewer, an insurance underwriter, or a client's IT security team examined your remote-access stack, here are the questions you should be able to answer about your VPN vendor today:

1. Who performed the most recent independent audit, when, and what was the scope? Ask for the report or the public summary. Reputable providers publish them.
2. What is the provider's legal jurisdiction, and does that country have mandatory data retention laws?
3. Does the policy distinguish between connection logs, usage logs, and payment records? Most providers retain some billing data. That's normal. What matters is whether it can be correlated with activity.
4. Is the audit a one-time event or recurring? Infrastructure changes. A 2020 audit says little about 2025 configurations.
5. What is the RAM-only (diskless) server architecture? Providers that run everything in memory reduce the risk that data persists on physical drives — a technical control that makes no-log claims more credible.
6. Has the provider ever disclosed a breach or a server seizure, and how did it communicate that? Silence after an incident is itself a red flag.

Building This Into Your Vendor File

Treat VPN due diligence like any other third-party risk assessment. Create a one-page vendor summary per provider: jurisdiction, audit history with dates and auditor names, logging policy highlights, breach disclosure history, and the date of your last review. Revisit it annually — ideally before January, not during it.

The parallel to your professional life is direct. You wouldn't sign an opinion based on management's word alone, and you shouldn't route client tax returns through a tunnel based on a homepage badge. The providers that welcome scrutiny — publishing audit reports, naming their auditors, disclosing incidents — are behaving like firms you'd want to work with. The ones that won't are asking you to extend trust on credit.

Busy season compresses everyone's judgment. Do this homework now, while there's still time to switch vendors without touching fifty workstations in February.