Proton VPN’s 2025 no-logs policy audit is now available
from the team:
Hey everyone,
We are now able to share that Proton VPN has successfully passed its 4th consecutive independent audit of our strict no-logs policy, conducted by Securitum, a leading European security auditing company.
Key takeaways from the audit:
- No activity or metadata logs are kept anywhere on our servers.
- No inspection of user traffic occurs.
- Robust administrative and technical controls are in place, including automated configuration management and a dual-control change process.
- The no-logs policy is enforced uniformly across all servers, regions, and subscription tiers.
Don’t trust, verify is not just something we preach, but something we practice, so our no-logs policy has now been verified by independent experts; you don’t have to take our word for it.
📖 Read the full audit report here
Stay safe,
Proton Team
20 replies
Sorry to be a downer, but audits of software that isnt selfhosted are kinda useless. Unless they allow spontaneous unannounced inspection of their infrastructure, they can just do whatever they want after the audit.
The only thing you can truly know is that you exist. Sorry to be a downer
Descartes, chill.
I do not think, therefore I do not am
Well, would you trust the company that's actually gone through the audits, or the one that skips them to save money & be cheaper?
Only the one that just open sources their code and encourages people to self host.
You can't self host a VPN, what would be the point?
Well, yes, you can self host a VPN to access your home network, I do that as well. That is not the context for proton et al though, and you can't self host a privacy VPN.
Lemmy is "self hosted" that doesnt mean every user has their own instance...
That doesn't mean that instance owners can't do shady shit. Open source is meaningless when you're talking about a service provider.
To expand, you don't want your service provider to open source all of their configs. Audits like the one Proton went through require admin access to systems that you absolutely don't want the public to have.
This is just like Lemmy. The actual code is open sourced. But instance configs aren't (for good reason)
Proton isn't a developer when it comes to their VPN service. They most likely are utilizing open source solutions to run it, but they're not operating a code base for it.
Their clients are open source, though.
And I'm saying this as a cyber security expert who uses Proton for personal use.
So would you equate a company that doesn't do any audits as the same caliber?
I would trust some real court case where they end up turning up nothing because they have nothing.
https://protonvpn.com/blog/transparency-report
The code is open source so feel free to audit it anytime you wish. But the audits are there for a third-party evaluation by actual experts.
Red flags, red flags everywhere
Such as?
Red flags, they're everywhere.
Was he not clear about that?
There's even some in the room with me right now.
Huge Red Flag: