Explainer
"Independently audited" can describe very different pieces of work. This page covers the kinds of audit, what each one can show, and the questions to ask before an audit changes your mind about a provider.
An audit shows that a named party examined a defined set of systems at a certain time and reported what it found. That is useful, and it is much narrower than the phrase "independently audited" on a front page suggests.
Before an audit changes your view of a provider, you need to know what kind it was, what it covered, when it took place and whether you can read the report.
| Kind | What it can show | What it cannot show |
|---|---|---|
| No-logs assessment | Systems in scope were not set up to keep the records in question during the review | What happens outside that period or those systems |
| Client or code audit | Security flaws in the app or code that was reviewed | How the servers are run, or what the company stores |
| Infrastructure audit | How the examined servers and systems are configured | Whether unexamined servers match them |
| Penetration test | What testers could break into within the agreed limits | That nothing else could be broken, or anything about logging |
| Certification | A company's processes meet a named standard within a stated boundary | Anything about your traffic, unless the boundary includes it |
A claim can be true and still answer a different question from yours. A clean review of an app says nothing about whether a company can link a session to a person.
An audit reports on a period that has ended. The configuration can change the day after the auditors leave, and nothing in the report would show it.
It also relies on what the company shows. Auditors can inspect systems and question staff, but they have limited means of finding something built to stay hidden from them. The provider also normally pays for the work and agrees its boundaries. None of this makes audits worthless, and it does make them one kind of evidence among others.
Other evidence can come from events the provider did not arrange, such as a seized server or a court order that produced nothing. These are rare, and they also describe one moment.
The register treats an audit as evidence with properties: who did it, to what standard, how much of it was published and how old it is. The questions and the methodology set out how much each of those counts, and how that weight fades over time.
A record cites the audit behind each value and gives its date, so you can open the source yourself. For the many providers with nothing to cite, the record says that as well, and the score reflects it.
It shows what the auditors found on the systems in scope during the period they looked. It cannot show what happened before or since, or on systems they did not examine. It is good evidence and still falls short of proof.
Usually the provider. That does not make the work worthless, since an auditing firm has its own reputation at stake, but the provider chooses the firm, agrees the scope and often decides how much of the report you see.
Not necessarily. The absence of an audit means that nobody independent has checked, so you are relying on the provider's word. The risk may be low or high, and without evidence you cannot tell which.
Next
Every explainer ends by naming the pages that own what it only touched.
Public Wi-Fi is less dangerous than the advertising says, because HTTPS already seals most of what you send. A VPN still hides which sites you reach, and some real risks remain that it does nothing about.
A DNS leak happens when your VPN carries your traffic but the name lookups go around it, which shows your network the sites you visit. This page covers why that happens and how to check for it.
A kill switch stops your traffic when the VPN tunnel drops, so it cannot carry on unprotected without your noticing. Kill switches differ in what they cover, and the differences decide when one actually helps.
Both make a request from another address. A VPN normally carries all your device's traffic and encrypts it; a proxy usually handles one app and may encrypt nothing at all. Here is how to tell which one you have.
Many people do not. A VPN solves a few specific problems well and does nothing for the rest, so the answer depends on which problem you have. This page goes through the common ones.
A VPN asks you to trust one company. Tor splits your connection across three relays so that no single one sees both who you are and where you are going. They solve different problems, and neither replaces the other.
What happens to a packet between your device and a website when a VPN is on: the handshake, the tunnel, the name lookup and the exit. Each step also explains one way a VPN can fail.
In most of the world, using a VPN is legal. A short list of countries restricts, licenses or blocks them, and what you do through one is a separate question everywhere. This page is a map of that, not legal advice.
Running a VPN costs money every month, so a free one is paid for by something. This page sets out what that usually is, what has gone wrong in practice, and how to tell a sample from a business model.
A VPN protects one stretch of the path: your device to its server. This page covers everything outside that stretch, from your browser and your accounts to malware, a dropped tunnel and the claims made in the advertising.
One encrypted hop between your device and the internet. This page is the starting point for the section: what the hop does, who it hides you from, who it hands the view to instead, and which of the promises made for it survive contact with the mechanism.
Not an explainer but the model itself, for a reader who got to the end of this page and wants to know how the judgement is made.
What the register knows about this market as a whole, and what it does not — every figure from the index, none from a survey.