Due Diligence Runs Both Ways: Putting VPN Vendors Through a Third-Party Risk Assessment

Consider the standard you apply to a client's third-party service provider. Before relying on a payroll processor or a cloud-hosted tax software environment, you want evidence: a SOC 2 report, a breach history, a clear understanding of who holds the data and under what legal regime. You certainly don't accept a website banner that says "trusted by thousands." Yet when it comes to the VPN tunneling every remote work session through, that banner is precisely what many firms accept.

This inconsistency deserves scrutiny. A VPN provider occupies an unusually privileged position in your firm's security architecture: it can observe connection metadata, DNS queries, and traffic patterns that, in aggregate, could reveal which clients you are servicing and when. Treating that provider as an unaudited third-party vendor is not paranoia. It is professional skepticism applied where it has arguably been missing.

The No-Logs Claim Is an Assertion, Not an Audit

Nearly every commercial VPN advertises a no-logs policy. From an assurance standpoint, a policy is a management assertion — the same category of statement you would never accept from a client without corroborating evidence. The question is not whether a provider claims not to log, but whether anything validates the claim.

The most meaningful corroboration available today is an independent security audit conducted by a reputable firm, covering the vendor's infrastructure and logging practices, with the methodology and scope published. A handful of major providers — including NordVPN, ExpressVPN, and Surfshark — have commissioned such audits and made summaries public. Others rely on "warrant canaries" or on court records from real-world cases in which authorities reportedly recovered little or no usable data. Those are useful signals, but they are retrospective, not preventive. An audit you can read is worth more than a claim you must take on faith.

When evaluating any provider, ask three questions: Was the audit performed by an identifiable third party? Does the report cover the specific systems that handle user data, or only a narrow slice? And is it recent — within the last 12 to 24 months? A 2019 audit of infrastructure that has since been rebuilt tells you very little about 2025.

Jurisdiction Is the Legal Substance of Privacy

Where a VPN is incorporated determines which governments can compel disclosure of your firm's connection records. A provider headquartered in the United States is subject to US legal process, including national security letters and gag-ordered requests. Providers based in Panama, the British Virgin Islands, or Switzerland operate under different — sometimes more restrictive — regimes regarding data retention and compelled disclosure.

There is no universally correct answer. A US-based provider may respond more cooperatively to a US subpoena directed at someone else's account; an offshore provider may simply have nothing to hand over. What matters for due diligence is that the jurisdiction is disclosed plainly and that the provider explains, in concrete terms, how legal requests are handled. Vague marketing about "privacy-friendly jurisdictions" without supporting detail should be treated the way you'd treat a client's unsupported revenue figure — as a red flag requiring follow-up.

Transparency Reports Show Behavior Under Pressure

A transparency report is the VPN industry's equivalent of a disclosures section in audited financial statements: it reveals how the entity actually behaves when the stakes are real. The better providers publish these reports at regular intervals, detailing the number and type of legal requests received, how many were complied with, and on what grounds.

Two things matter here. First, consistency — a report published annually for the last several years indicates an institutional commitment, not a one-time marketing exercise. Second, candor — reports that acknowledge takedowns, law-enforcement requests, and even security incidents (such as NordVPN's 2018 disclosure of a third-party datacenter breach) demonstrate a level of honesty that pure-positive marketing cannot. A vendor that has never published a transparency report is asking your firm to assume the absence of requests, which is not an assumption a compliance-minded practice should make.

A Due-Diligence Checklist for Your Next VPN Renewal

Before your firm renews or selects a provider, work through the following, much as you would any critical vendor:

1. Independent audit evidence. Locate the most recent third-party audit, note the auditing firm, the scope, and the date. If none exists, treat the no-logs claim as unverified.
2. Jurisdiction and legal exposure. Confirm the corporate domicile and read the provider's explanation of how it handles government requests.
3. Transparency reporting cadence. Check whether reports are published regularly and whether they include specific counts rather than generalities.
4. Payment and account data. Determine what identifying information the service retains — email addresses, billing records, payment processors — since "no logs" rarely covers account metadata.
5. Corporate history. Note that many popular VPNs are owned by a small number of parent companies, notably Kape Technologies and Ziff Davis. Ownership concentration affects independence and should be a known fact, not a surprise.
6. Breach and incident history. Search for past incidents and evaluate how the vendor responded: prompt disclosure and remediation is a better signal than silence.

Document your findings the way you would in a vendor risk assessment file. If a client's peer reviewer or your cyber insurance carrier asks why you selected a given provider, "it ranked well on a review site" is a weak answer; "it publishes an annual independent audit, files regular transparency reports, and discloses its jurisdiction and data practices" is a strong one.

Skepticism Is a Feature of the Profession

None of this implies the VPN industry is uniquely untrustworthy. It implies that your firm's standard of evidence should not drop simply because the vendor sells privacy rather than payroll processing. The same professional skepticism you bring to an engagement letter applies to the terms of service and privacy policy of the tool carrying your clients' most sensitive data.

The encouraging news is that the market is moving in the right direction. Audits, transparency reports, and canaries were rare five years ago; today, several major providers publish them as a matter of course. The firms that benefit from that progress are the ones that demand it — and that read the evidence before the tunnel, not after the breach.