Mullvad VPN offers the strongest privacy-first no-logs policy overall. It collects very little information when you create an account, does not require an email address, and says it does not log traffic, DNS requests, connection timestamps, IP addresses, bandwidth or user activity. On April 18, 2023, Swedish police searched Mullvad's office but left without customer information because the relevant data did not exist.

Proton VPN is the better choice if you prioritise recurring, publicly available independent audits. Proton's server infrastructure passed its fifth consecutive annual no-logs audit in 2026. Securitum conducted the audit, and Proton published the full report.

Best No-Logs VPNs at a Glance

VPN Strongest privacy feature Independent verification Main limitation
Mullvad VPN No email, username or password required; numbered accounts Public infrastructure testing and a real-world police search-warrant test Its infrastructure test could not verify every production server
Proton VPN Repeated audits of its VPN infrastructure Fifth annual Securitum no-logs audit published in 2026 Uses a Proton Account and may require email or phone verification
NordVPN Six independent no-logs reviews through 2025 PwC and Deloitte reviews Requires an account and collects more account information than Mullvad
ExpressVPN TrustedServer architecture designed to prevent persistent logs KPMG assessment completed in 2025 The audit report is available subject to KPMG's access terms
Surfshark Recent infrastructure and no-activity-log verification Deloitte reports in 2023 and 2025 The full 2025 report is restricted to Surfshark users

Why Mullvad VPN Has the Best No-Logs Policy

Mullvad's main advantage is how little information it needs before you connect to a server.

Mullvad creates a random numbered account instead of asking for a username, password or email address. The account stores the account number, expiry date and, where relevant, WireGuard configuration information. Mullvad also accepts cash and cryptocurrency. Payment methods such as PayPal and bank transfers can involve personal data.

Mullvad says it does not log:

  • Browsing traffic
  • DNS requests
  • Connection start or end times
  • Session duration
  • IP addresses
  • User bandwidth
  • Account activity linked to VPN usage

The company does retain limited operational information. Its servers send aggregated statistics, including total connections, CPU load and bandwidth totals, for server maintenance. Mullvad also stores certain website access logs for up to five minutes without IP addresses.

Those are not VPN activity logs, but they matter when interpreting the phrase "no logs." It does not mean that Mullvad stores no data of any kind.

Mullvad's strongest real-world test came on April 18, 2023, when Swedish police visited its office with a search warrant and intended to seize customer data. Mullvad says the police left without the requested information because the company did not have it. That does not replace a technical audit, but it shows how the data-minimisation model worked when tested in practice.

Mullvad's Important Audit Limitation

Mullvad's 2023 penetration test found no user activity logging on the VPN relays that auditors examined. The auditors could not confirm that every live production machine had the same configuration because the environment lacked certain remote-attestation and audit controls.

This does not make Mullvad's policy unreliable. It creates a clear distinction between the two leading options:

  • Mullvad has the stronger account-anonymity and data-minimisation model.
  • Proton VPN has stronger publicly documented evidence from recurring infrastructure audits.

Why Proton VPN Is the Best Audited No-Logs VPN

Proton VPN is the best alternative for users who want a no-logs claim tested repeatedly by independent auditors and supported by public reports.

For its 2026 audit, Securitum reviewed Proton VPN's server infrastructure for browsing activity, DNS queries, destination services, traffic contents and user-identifiable connection metadata. The report found no evidence that the examined infrastructure created persistent records capable of linking a user to VPN activity. Proton says the policy applies across its server regions and subscription tiers.

Proton VPN also provides:

  • Open-source VPN applications
  • Full-disk encryption on its VPN servers
  • Swiss corporate jurisdiction
  • A published transparency report and warrant canary
  • A no-logs policy covering its free and paid plans

The trade-off is account identity. Proton VPN uses a Proton Account, and account creation can involve an email address or a human-verification method. That does not mean Proton records VPN activity, but it gives the company more account-related information than Mullvad normally requires.

How NordVPN, ExpressVPN and Surfshark Compare

NordVPN

NordVPN has one of the most extensively reviewed no-logs programmes among large commercial VPN providers. It says its first two reviews were conducted by PwC Switzerland, followed by Deloitte reviews, including a sixth review in 2025. The company says its policy covers browsing activity and other sensitive usage data.

NordVPN suits users who want privacy alongside speed, streaming support and a large mainstream product. It is less suitable for maximum account anonymity because users create a Nord Account and provide ordinary billing information.

ExpressVPN

ExpressVPN's 2025 KPMG assessment examined its TrustedServer system and privacy controls as of February 28, 2025. KPMG provided reasonable assurance that the systems operated as designed and reported no issues with the safeguards intended to prevent activity and connection logs from being retained.

ExpressVPN is a credible option for users who value a RAM-based server architecture and a polished mainstream service. Its privacy evidence is strong, although access to the audit report is less open than Proton VPN's public reporting.

Surfshark

Surfshark says Deloitte conducted no-logs assurance reviews in 2023 and 2025. The 2025 review covered activity logs, IP-address storage, relevant configuration settings and server infrastructure. Surfshark says the full Deloitte report is available only to Surfshark users.

Surfshark is a reasonable budget alternative. Proton VPN offers more public audit transparency, while Mullvad requires less identifying information at signup.

What a Genuine No-Logs Policy Should Cover

A trustworthy VPN policy should explain both activity logs and connection logs.

Activity Logs

Activity logs can include:

  • Websites visited
  • DNS queries
  • Files downloaded
  • Applications used
  • The content or destination of network traffic

A VPN that records these details may be able to reconstruct your online activity.

Connection Logs

Connection logs can include:

  • Your original IP address
  • VPN server IP address
  • Connection date and time
  • Session duration
  • Data transferred
  • The VPN server used

Even without recording the websites you visit, connection records can sometimes connect a person to a particular VPN session. NordVPN treats these as separate categories of VPN logging and warns that extensive connection records can still create privacy risks.

When comparing providers, look for:

  1. Independent review of the server infrastructure
  2. A clear explanation of retained operational data
  3. A current privacy policy
  4. Public transparency reporting
  5. A stated process for handling government requests
  6. Minimal account and payment data collection

Final Verdict

Choose Mullvad VPN if your priority is limiting the information connected to your account. Its numbered accounts, lack of an email requirement, stated exclusions for activity and connection logs, and response to the 2023 police search make it the strongest overall choice.

Choose Proton VPN if public, recurring infrastructure audits matter more than anonymous account creation. Its fifth consecutive Securitum audit gives it the clearest publicly documented audit record in this comparison.

Neither service makes you completely anonymous. Websites can still identify you through account logins, cookies, browser fingerprinting and other tracking methods. A no-logs VPN limits what the VPN provider can retain. It does not erase the rest of your online trail.