What the file actually stores
Every row below is copied from vpn-comparison-2026.json. “Not named” means the audit_firm key is absent. Do not fill that gap from memory or from another site’s roundup.
| Provider | audit_type | audit_firm | Privacy | Composite |
|---|---|---|---|---|
| ExpressVPN | independent | KPMG | 96 | 91 |
| NordVPN | independent | Deloitte | 94 | 91 |
| Surfshark | independent | not named | 89 | 90 |
| Proton VPN | independent | Securitum | 98 | 89 |
| Mullvad | independent | Cure53 | 95 | 86 |
| Private Internet Access | independent | not named | 82 | 85 |
| Windscribe | independent | not named | 85 | 83 |
| hide.me | independent | not named | 92 | 82 |
| VyprVPN | self-published | not named | 88 | 81 |
| CyberGhost | self-published | not named | 75 | 80 |
| PrivateVPN | none | not named | 72 | 78 |
| IPVanish | none | not named | 65 | 77 |
| Hotspot Shield | self-published | not named | 68 | 75 |
| Ivacy | none | not named | 65 | 75 |
| TunnelBear | independent | not named | 85 | 75 |
A short reading order
- Confirm audit_type. Independent, self-published, and none are different evidence classes in this dataset.
- If audit_firm is present, open the privacy source URL and read what was in scope. The four named firms are KPMG, Deloitte, Securitum, and Cure53.
- If the type is independent and the firm is blank, treat the row as “third party claimed, firm not recorded here.” Surfshark is in that group.
- Put the result next to jurisdiction and the privacy score. The composite still uses all eight weights.
The parent ranking of providers with stronger audit evidence is the audited no-logs guide. A kill-switch outage does not rewrite this table; that question has its own page.
Related on this site
- Audited no-logs guide — parent cluster for this question.
- How to compare audit dates — the file stores no audit_date.
- Which jurisdiction matters — the other half of the privacy score.
- Kill switch failure and no-logs claims.
- Mullvad profile, Proton VPN profile, Private Internet Access, and Windscribe.
- Methodology and comparison JSON.
- Match engine on the homepage.
FAQ
What do independent, self-published, and none mean in this file?
Independent means the comparison file credits a third party. Self-published means the audit record on file is the provider’s own material. None means no audit is recorded. Only ExpressVPN, NordVPN, Proton VPN, and Mullvad also store an audit_firm name.
Which providers name an audit firm?
ExpressVPN names KPMG, NordVPN names Deloitte, Proton VPN names Securitum, and Mullvad names Cure53. Surfshark, Private Internet Access, Windscribe, hide.me, and TunnelBear are audit_type independent with no firm name in the file.
Does a named firm mean the provider will never keep logs?
No. Methodology treats an audit as evidence about the configuration and policy at audit time. The comparison file does not store audit dates. A named firm raises the citation quality. It does not guarantee future behaviour.