Privacy Tools Guide

Every VPN provider claims “we don’t keep logs.” But when pressed by law enforcement (subpoenas, warrants), dozens have suddenly recovered logs or handed over traffic metadata. How do you know if a provider’s “no-logs” claim is real or marketing theater?

Table of Contents

VPN logs typically contain:

Legal risk: If logs exist, law enforcement can obtain them via subpoena, seizing user activity.

Practical risk: If logs exist, data breach = your browsing history leaked to hackers.

Verification Methods

Method 1: Check for Registered Business Address (Not Anonymous)

How: Look up the company’s incorporation records.

Tool: Delaware Division of Corporations (UCC search), WHOIS lookup

What to look for:

Example (Real): ExpressVPN — TunnelBear Limited, registered Toronto, Canada. Public officers named.

Example (Sketchy): “VPN-Ultra-2024 Ltd” registered in Panama with anonymous ownership = high risk.

Why this matters: If a company won’t put its name on the business, you can’t sue them for false advertising. They can disappear and reappear under a new name.

Action: Only use providers incorporated in countries with strong corporate law (Canada, US, Germany, Switzerland).

Method 2: Check for Third-Party Audits

How: Search for published audit reports from reputable firms.

Firms that audit VPNs:

Red flags:

Where to find audits:

Example (Good):

Example (Bad):

What to look for in audit:

  1. Server audit: Are servers controlled by provider or rented from hosting (risk: hosting company logs)?
  2. Logging audit: Did auditors check application code for logging statements?
  3. Network audit: Are there backdoors or unauthorized access points?
  4. Scope: Does audit cover operational practices (backups, staff access) or just code?

Cost: Reputable audits cost $200K+. If a VPN can’t afford it, that’s a signal.

Method 3: DNS Leak Test (Active Test)

How: Connect to VPN, then test whether your DNS requests leak (go to ISP instead of VPN).

Tool: dnsleaktest.com (free)

How it works:

  1. Visit dnsleaktest.com without VPN (note your “real” DNS server, usually ISP)
  2. Connect to VPN
  3. Revisit dnsleaktest.com
  4. Check if DNS server changed (should be VPN’s DNS, not ISP’s)

What you’re testing: If DNS leaks, VPN provider (and ISP) can see every website you visit, even if traffic is encrypted.

Example results:

Limitation: This test shows if DNS leaks NOW. It doesn’t verify that provider doesn’t log DNS historically.

Method 4: Traffic Analysis (Advanced)

How: Run packet sniffer to see what data leaves your device when using VPN.

Tool: Wireshark (free, open-source), tcpdump (CLI)

How it works:

  1. Start packet capture before connecting to VPN
  2. Connect to VPN
  3. Browse normally for 10 minutes
  4. Stop capture, analyze

What to look for:

Interpretation:

Example (tcpdump output):

Good:
17:34:22.123456 YOUR-IP.12345 > VPN-SERVER-IP.1194: UDP (encrypted data)
17:34:22.124567 VPN-SERVER-IP.1194 > YOUR-IP.12345: UDP (encrypted data)

Bad:
17:34:22.123456 YOUR-IP.12345 > 8.8.8.8.53: DNS query (YOUR ISP CAN SEE THIS)
17:34:22.124567 YOUR-IP.12345 > 142.251.32.14.443: HTTPS (GOOGLE's IP, DESTINATION VISIBLE)

Limitation: This test shows current behavior, not historical logging. But if traffic is properly encrypted and routed through VPN tunnel, it’s harder to log.

Method 5: Check Country of Operation vs Jurisdiction

How: Research where VPN provider operates servers and which courts have jurisdiction.

Why this matters: If VPN operates in USA, US courts can subpoena logs. If in Russia, but servers in Netherlands, Dutch courts might override claims.

Countries with strong privacy laws (good):

Countries with weak privacy laws (bad):

Red flag: Provider says “no logs” but operates servers in USA or hosts on Amazon AWS USA (AWS is US company, subject to US law).

Example:

Method 6: Check Subpoena/Law Enforcement History

How: Search for cases where provider claimed “we have no logs to provide.”

Where to look:

What to look for:

  1. How many requests did provider receive from law enforcement?
  2. How many did they comply with?
  3. Did they comply because “logs existed” or because they challenged subpoena?

Example (Good): ExpressVPN transparency report (2023):

Example (Bad): VPN-Ultra:

Method 7: Check Application Code for Logging (Open Source)

How: Download VPN app code and search for logging statements.

Tool: GitHub search, grep (command line)

Example (WireGuard):

git clone https://github.com/wireguard/wireguard-go.git
grep -r "log\|Log\|LOG" src/
# If lots of logging statements, check if they're debug-only or active

What to look for:

Limitation: This test only checks app code. Provider could add logging on server side, not in app.

Platforms where this is possible:

  1. Third-party audits
    • Has the provider commissioned independent audits by reputable firms (Deloitte, PwC, Cure53)?
    • Are audit reports publicly available, or behind a NDA?
    • How recent is the latest audit? (Annual audits are strong; audits older than 2 years are questionable)
  2. Warrant canary
    • Does the provider publish a warrant canary or transparency report?
    • How frequently is it updated? (Monthly is better than annually)
    • Has the canary been continuous or has it lapsed? (Lapses suggest legal action)
  3. Infrastructure transparency
    • Does the provider disclose server locations and data center operators?
    • Do they own servers or rely on cloud providers?
    • What is the provider’s headquarters jurisdiction and privacy law strength?
  4. Code availability
    • Is the VPN client code open-source and auditable?
    • Have independent audits examined the code?
    • Does the code contain logging functionality? (Publicly auditable clients have no logging code)
  5. Historical compliance
    • Has the provider been subpoenaed or demanded data? (Warrant canary or transparency reports show this)
    • Did they successfully resist disclosure or comply with warrants?
    • Have any privacy incidents been disclosed? Platforms where this is NOT possible:
    • ExpressVPN (proprietary)
    • NordVPN (proprietary)
    • Surfshark (proprietary)

Decision Matrix

Method What It Tests Time Required Difficulty Cost
Business registration Legitimacy + legal liability 10 min Easy Free
Third-party audit Code/operations review 30 min research Easy Free
DNS leak test Current DNS leaks 5 min Easy Free
Packet analysis Current traffic leaking 20 min Hard Free (Wireshark)
Jurisdiction review Legal exposure 30 min Medium Free
Subpoena history Past compliance 30 min Easy Free
Code audit App logging statements 1-2 hours Hard Free (open-source)

Recommended workflow:

  1. Check business registration (10 min)
  2. Search for third-party audit (10 min)
  3. Run DNS leak test (5 min)
  4. Review jurisdiction (20 min)
  5. Search subpoena history (20 min)

Total: 65 minutes, free, covers 80% of risk.

Red Flags for “No-Logs” Claims

Flag 1: No published third-party audit

Flag 2: Business registered in country with weak privacy laws

Flag 3: Advertises “easy money” or “referral bonuses”

Flag 4: No transparency report on law enforcement requests

Flag 5: Frequent server/location changes

Flag 6: User testimonials instead of technical claims

FAQ

Q: Can I trust a VPN provider’s claims at all? A: Yes, but verify. Use combination of audit + jurisdiction + subpoena history. No single test is sufficient.

Q: Is “no-logs” legally enforceable? A: Not really. A provider can be required by court order to turn over logs even if they claim “no logs.” That’s why some providers (Mullvad, Proton) accept cash and use temporary accounts (can’t identify users anyway).

Q: Does open-source VPN code mean no logging? A: No. Code can be audited, but server-side could still log. Server-side logs are what law enforcement cares about, and you can’t audit server code by definition.

Q: Is VPN legal? A: Yes, in most countries. Illegal uses (copyright infringement, harassment) are illegal regardless of VPN. Using VPN itself is legal in US, UK, Canada, most of EU.

Verification steps:

  1. Search for third-party audits: “Provider X audit site:deloitte.com OR site:pwc.com”
    • If no results, no independent audit. This is marketing without verification.
  2. Look for warrant canary: “Provider X warrant canary OR transparency report”
    • Check when it was last updated. If no canary exists, the provider hasn’t committed to transparency.
  3. Check server locations: Visit their website, look for “data center locations” or “server ownership”
    • If vague (“various locations worldwide”), they’re hiding something. Legitimate providers list specific countries.
  4. Research jurisdiction: Where is Provider X headquartered?
    • Switzerland, Sweden, Iceland are strong. Panama is weak. US/UK are risky.
  5. Check if code is open-source: “Provider X VPN client github”
    • If not open-source, logging cannot be independently verified.
  6. Test for leaks: Visit dnsleaktest.com and browserleaks.com while connected
    • Should show VPN IP, not your real IP
    • If real IP appears, VPN is leaking
  7. Look for privacy incidents: “Provider X privacy breach OR logging discovered OR false claims”
    • Search news for any instance of the provider being caught logging despite claims.
  8. Check payment methods: How can you pay?
    • Bitcoin/cryptocurrency anonymous: better
    • Credit card linked to identity: worse
    • PayPal/Stripe tied to accounts: worse
  9. Verify kill switch: Disconnect VPN and verify internet stops
    • Internet should go offline immediately when VPN drops
    • If traffic continues, kill switch is broken

Provider X with no audit, no canary, Panama headquarters, closed-source client, DNS leaks, payment tied to identity, and a 2020 article about logging allegations is high-risk regardless of marketing copy. Cost: $3-12/month for VPN that provides zero privacy benefit over ISP (who already logs more).

Provider Y with annual Deloitte audits, monthly warrant canary, Switzerland headquarters, open-source client, passes leak tests, accepts Bitcoin payments, and clean incident history provides genuine privacy. Cost: $5-8/month for actual privacy.

The $5-10/month difference between genuine and fake privacy is the best ROI in personal cybersecurity.

Making Your Choice

For maximum verifiable privacy: Use Mullvad (open-source, monthly canary, Sweden jurisdiction, owned infrastructure) or IVPN (open-source client, audited, Gibraltar jurisdiction).

For strong privacy with user interface polish: Use ProtonVPN (annual audits, quarterly transparency, Switzerland jurisdiction).

Avoid ExpressVPN (no deep audits, no canary, US jurisdiction) and NordVPN (weak transparency, Panama jurisdiction) despite aggressive marketing.

The cost difference is minimal ($5-8/month). The privacy difference is substantial. Spend the extra $20/year on a verifiable provider rather than gambling on marketing claims.

Built by theluckystrike — More at zovo.one

Explore Our Developer Guides

© 2026 theluckystrike Developer Guides