How to Compare VPN Audit Dates

We earn a commission when you buy through some links on this site. Commissions never change our scores or rankings. How we make money

Where a date would have to come from

Every row is copied from vpn-comparison-2026.json. The date column is “not stored” on purpose. Follow the privacy source and read the report. If that URL is a privacy policy rather than an audit, write down that the file did not point you at a report.

Provider	audit_type	audit_firm	audit_date in file	Privacy source
ExpressVPN	independent	KPMG	not stored	https://www.expressvpn.com/blog/expressvpn-security-audit/
NordVPN	independent	Deloitte	not stored	https://nordvpn.com/blog/nordvpn-audit/
Surfshark	independent	not named	not stored	https://surfshark.com/security/audit
Proton VPN	independent	Securitum	not stored	https://proton.me/blog/proton-vpn-security-audit
Mullvad	independent	Cure53	not stored	https://mullvad.net/en/blog/cure53-vpn-client-audit
Private Internet Access	independent	not named	not stored	https://www.privateinternetaccess.com/blog/pia-has-never-provided-user-logs-to-any-third-party-ever/
Windscribe	independent	not named	not stored	https://windscribe.com/privacy
hide.me	independent	not named	not stored	https://hide.me/en/privacy
VyprVPN	self-published	not named	not stored	https://www.vyprvpn.com/blog/vyprvpn-no-log-audit
CyberGhost	self-published	not named	not stored	https://www.cyberghostvpn.com/en_US/blog/transparency-report/
PrivateVPN	none	not named	not stored	https://privatevpn.com/privacy/
IPVanish	none	not named	not stored	https://www.ipvanish.com/privacy-policy/
Hotspot Shield	self-published	not named	not stored	https://www.hotspotshield.com/privacy-policy/
Ivacy	none	not named	not stored	https://www.ivacy.com/privacy-policy/
TunnelBear	independent	not named	not stored	https://www.tunnelbear.com/privacy-policy

A comparison order that does not invent years

Read audit_type. Independent, self-published, and none are different evidence classes.
If audit_firm is present, the named firms in this file are only KPMG, Deloitte, Securitum, and Cure53.
Open the privacy source. Record the date the report itself prints. Do not fill a blank from a roundup.
Place that date in the methodology bands: within 18 months, 18 to 36 months, infrastructure-only, or none.
Read the band next to the privacy score. The composite still uses all eight weights. A fresh date does not lift streaming or connections.

The reading guide for audit_type sits on how to read a no-logs audit. This page only adds the date step the file cannot do for you.

Related on this site

Audited no-logs guide — parent cluster.
How to read a no-logs audit — type and firm, before the date.
Private Internet Access and Windscribe — independent, firm not named, so a blog date is not a named-firm date.
Methodology audit bands and comparison JSON.
Match engine.

FAQ

Does the comparison file include audit dates?

No. Providers have audit_type and sometimes audit_firm. There is no audit_date key. A blank is not a year you can estimate.

How does methodology treat an older audit?

A named-firm no-logs audit within 18 months is +15 to +20 privacy points. An audit 18 to 36 months old is +8 to +12. An infrastructure-only audit is +4 to +6. No independent audit adds zero. Those bands live on the methodology page.

Can two providers be ranked by audit date from this site alone?

Not from the JSON. Open each privacy source, record the date printed there, then apply the bands. A newer self-published note is a different class from an older named-firm report.

Affiliate status: Links on this page go to official provider websites. Our NordVPN and hide.me affiliate links are on the homepage and the NordVPN review. Scores are editorial from /data/vpn-comparison-2026.json (last verified 24 September 2026). v1.0 weights are unchanged. See ethics and methodology.