Your VPN Knows When You File: The Metadata Trail No CPA Ever Read

Ask most CPAs what their VPN collects and you'll hear the same answer: nothing, or close to it. The no-log policy says so, after all. But a no-log promise is almost always written about content — the sites you visit, the files you move, the data inside the tunnel. What it frequently excludes, in a footnote or a subclause, is session telemetry: the when, how long, and how often of your connections.

That telemetry is not harmless. For an accounting firm, it may be the most revealing data you generate.

The Calendar Hiding in Your Connection Logs

Consider what a session log actually contains. A timestamp when you connect. A timestamp when you disconnect. Sometimes a byte count. Individually, these are trivial. Aggregated over a season, they become a work product of their own.

A pattern of extended sessions ending near midnight in early April? That's an extension filer, or a firm pushing returns under the deadline. A cluster of short morning connections from a new remote hire in October? That's onboarding season, and it tells an observer when your firm is most likely to be training under-supervised staff. Spikes in session volume ahead of March 15 and April 15 map your partnership and individual filing calendar more precisely than any public schedule.

Now imagine that pattern sitting in a vendor's database, tied to your firm's static account, retained for twelve months or more. It is not a tax return. It is something arguably just as useful to a competitor, an attacker planning a phishing campaign timed to your crunch weeks, or a litigant in a client dispute.

Why "No Logs" Rarely Means No Logs

We reviewed the retention language of several mainstream commercial VPN providers and found a consistent pattern: policies that prominently declare a no-logging stance, then carve out connection timestamps, session durations, or "diagnostic" bandwidth figures as operational necessities.

The carve-outs exist for legitimate reasons — abuse prevention, capacity planning, fraud detection. But legitimate purpose and unlimited retention are separate questions. Very few vendors publish how long session metadata survives, who inside the company can query it, or whether it is included in the data sets sold, shared, or produced in response to legal process.

For a firm handling PTIN-holder obligations and taxpayer confidentiality under Section 7216, this gap matters. The IRS's Publication 4557 guidance asks practices to account for third-party data handling. Most firms can name their tax software vendors. Almost none can name what their VPN vendor retains about when they work.

The Negotiation Most Firms Never Attempt

Here is the part that surprises firm owners: this is negotiable. A solo practitioner buying a consumer plan at $4 a month has little leverage. A ten-partner firm representing thousands of taxpayer engagements has considerably more.

Before renewal, ask your vendor three questions in writing:

1. What session metadata is collected, and for how long is each element retained?
2. Under what circumstances is it disclosed — subpoena, litigation, marketing, product analytics?
3. Can retention be contractually limited for our account, with deletion on a fixed schedule?

Vendors respond to procurement pressure. A business-tier agreement can and frequently does include data-processing addenda that shorten retention windows and restrict disclosure. If a provider cannot or will not answer, treat that silence as a data point of its own.

What a Reasonable Policy Looks Like

A defensible session-telemetry posture for a US accounting practice looks something like this: connection metadata retained no longer than 30 to 90 days, tied to abuse prevention only; no retention of byte counts or destination-adjacent figures beyond that window; contractual deletion rights on termination; and disclosure limited to valid legal process with client notification where permitted.

You will not find that language in a consumer terms-of-service document. You will find it, or something close to it, if you ask for it in a business agreement — and if you are willing to walk when the answer is no.

The Deadline Is the Data

The uncomfortable truth is that your busy season is itself confidential information. It reveals which clients are late filers, when your systems are most vulnerable to social engineering, and when a ransomware actor might extract maximum leverage. Firms spend heavily on encrypting the contents of their work while leaving the rhythm of that work exposed by default.

Metadata is not the whole picture. But in the hands of someone patient, it is a sketch of the picture — drawn one timestamp at a time. It belongs on your vendor due-diligence checklist, next to the no-log policy you already read far more carefully than your competitors do.