This page answers six questions about nine VPN providers: who runs each one, where the company is based or registered, who owns it, what its privacy policy says about logs, which outside firm last audited it, and whether its servers run from memory only.
The providers are NordVPN, Surfshark, Proton VPN, ExpressVPN, Private Internet Access, CyberGhost, IVPN, Windscribe and Mullvad. Every cell links to the provider’s own page or the auditor’s report, and every cell was checked on 10 November 2026. Where we quote a logging policy, the words are the provider’s, not ours.
Some of these companies belong to the same group. Some audits cover a provider’s servers or its no-logs policy, while others cover a single app or feature. The table shows those details so you can compare like with like. Mullvad is listed for information only.
| Provider | Company and where it is based or registered | Parent company or ownership group | Logging policy (provider's words) | Most recent independent audit | RAM-only servers |
|---|---|---|---|---|---|
| NordVPN | nordvpn S.A., Panama City, Republic of Panama Source, checked 10 Nov 2026 | Nord group; the policy refers to “other Nord group companies” Source, checked 10 Nov 2026 | “We do not store used bandwidth, traffic logs, IP addresses, or browsing information.” Source, checked 10 Nov 2026 | No-logs: Deloitte Lithuania, 2025 (engagement 10 Nov to 12 Dec 2025, report issued 12 Dec 2025, ISAE 3000 (Revised)); server infrastructure, configurations and deployment processes, including standard VPN, Double VPN, obfuscated and Onion Over VPN servers. Full report for Nord Account users. Source, checked 10 Nov 2026 | Yes Source, checked 10 Nov 2026 |
| Surfshark | Surfshark B.V., Amsterdam, the Netherlands Source, checked 10 Nov 2026 | Merged with Nord Security into one group (2022); Surfshark said then that the two would continue to operate as autonomous companies Source, checked 10 Nov 2026 | “We don’t store any information that could lead us to see your online activities.” Source, checked 10 Nov 2026 | Security: Cure53, 2026 (Feb–Mar), architecture and cryptography of the Dausos protocol. No-logs: Deloitte, 2025 (ISAE 3000 report in the user account). Source 1, Source 2, checked 10 Nov 2026 | Yes Source, checked 10 Nov 2026 |
| Proton VPN | Proton AG, a Swiss corporation; address in Plan-les-Ouates, Geneva, Switzerland Source 1, Source 2, checked 10 Nov 2026 | Proton AG; primary shareholder is the non-profit Proton Foundation Source, checked 10 Nov 2026 | “All Proton VPN servers are encrypted and we do not log VPN session data.” Source, checked 10 Nov 2026 | No-logs: Securitum, 2026, Proton VPN server infrastructure (fifth consecutive annual no-logs audit). Source, checked 10 Nov 2026 | No; all servers use full-disk encryption Source 1, Source 2, checked 10 Nov 2026 |
| ExpressVPN | Express Technologies Ltd., British Virgin Islands Source, checked 10 Nov 2026 | Ultimate holding company: Kape Technologies PLC (UK) Source, checked 10 Nov 2026 | “We do not collect logs of your online activity while you are connected to our Services …” Source, checked 10 Nov 2026 | No-logs: KPMG LLP, 2025 (TrustedServer system and privacy policy claims as of 28 Feb 2025, ISAE (UK) 3000 Type 1). Report available after accepting KPMG’s terms. Newer audits listed by ExpressVPN cover other products. Source 1, Source 2, checked 10 Nov 2026 | Yes Source, checked 10 Nov 2026 |
| Private Internet Access | PIA Private Internet Access, Inc., Denver, Colorado, United States Source, checked 10 Nov 2026 | Parent not named on the pages we checked; the policy mentions “our ultimate holding company” and separately names Kape Technologies Source, checked 10 Nov 2026 | “We collect and retain zero user logs.” Source, checked 10 Nov 2026 | No-logs: Deloitte Audit Romania, 2025, ISAE 3000 (Revised); VPN configuration, management systems and token-based dedicated IP system. Source, checked 10 Nov 2026 | Yes Source, checked 10 Nov 2026 |
| CyberGhost | CyberGhost S.R.L., Bucharest, Romania Source, checked 10 Nov 2026 | Ultimate holding company: Kape Technologies PLC Source, checked 10 Nov 2026 | “… we do NOT track user traffic performed inside the CyberGhost VPN tunnel …” Source, checked 10 Nov 2026 | No-logs: Deloitte Audit Romania, 2025, ISAE 3000 (Revised); VPN server network, configuration, change management, incident response and dedicated IP token system. Source, checked 10 Nov 2026 | Yes Source, checked 10 Nov 2026 |
| IVPN | IVPN Limited, registered in Gibraltar Source, checked 10 Nov 2026 | IVPN Limited, 100% owned by its founder and CEO Source, checked 10 Nov 2026 | “We do not log any data relating to a user’s VPN activity (while connected or connecting to the VPN).” Source, checked 10 Nov 2026 | Security: Cure53, 2026 (July), Unlinked Access feature (not the VPN servers); full report published. No-logs: Cure53, 2019 (March), IVPN privacy-related claims. Source 1, Source 2, checked 10 Nov 2026 | Partly: a small number of pilot gateways are RAM-only; other servers use full-disk encryption Source, checked 10 Nov 2026 |
| Windscribe | Windscribe Limited, Ontario, Canada Source, checked 10 Nov 2026 | Not stated publicly on the pages we checked (Windscribe Limited is named as the owner; no parent company named) Source, checked 10 Nov 2026 | “… we do not store any historical logs on who used which IP address …” Source, checked 10 Nov 2026 | Security: Packetlabs, 2024 (June), FreshScribe server infrastructure (20 repositories, about 80,000 lines of code; external and internal penetration testing). Source 1, Source 2, checked 10 Nov 2026 | Yes Source, checked 10 Nov 2026 |
| Mullvad Listed for information only | Mullvad VPN AB, Gothenburg, Sweden Source, checked 10 Nov 2026 | Owned by parent company Amagicom AB Source, checked 10 Nov 2026 | “We do not keep activity logs of any kind.” Source, checked 10 Nov 2026 | Security: Leviathan Security Group, 2026, Android app (MASA assessment). Infrastructure: Cure53, 2024 (VPN infrastructure). Source 1, Source 2, checked 10 Nov 2026 | Yes Source, checked 10 Nov 2026 |
How we built this table
We read each provider’s privacy policy, terms, about page and audit pages, plus the audit reports or summaries they link to. We copied what those pages say and nothing more. If the pages we checked did not state something, the cell says so.
For audits, we list the most recent independent audit of the VPN service that the provider names. Where that audit covers only an app or a feature, we also show the latest audit of the servers or of the no-logs policy. We also note the scope, because an audit of one app says little about the servers.
We did not run our own tests for this table. It contains no speed, streaming or price claims.
Limits
- An audit is a snapshot. It describes systems as they were during the audit period, not today.
- Privacy policies and ownership change. A cell is only as current as its check date.
- Several full audit reports are only available after signing in or accepting the auditor’s terms. In those cases, and for some audits where we did not open the full report, we relied on the provider’s own description.
- A no-logs audit checks what the auditor was shown. It cannot prove that no logs will ever be kept.
- We quote providers’ own words. Quoting a claim is not the same as confirming it.
Affiliate disclosure
This table contains no affiliate links. Honest VPN Guide is not part of any affiliate program. If a program is approved later, commissions will not affect what goes into this table. Our Advertising and Affiliate Disclosure explains how the site may make money.
Our Privacy Policy explains how this site handles reader data, and the Legal Notice shows who publishes it.