- Schellman Compliance’s latest audit of IPVanish has confirmed no traffic, metadata, or session logging
- The audit is the third since 2022, and marks the second audit since IPVanish committed to annual audits
- It follows IPVanish’s recent RAM-only server rollout and expansion to a 150-location network
IPVanish has announced the results of its third independent no-logs audit, and once again its privacy claims have a clean bill of health.
The audit was completed by Schellman Compliance, a leading provider of attestation services, on September 25, 2026.
Following two previous third-party audits in 2022 and 2025, the review is the latest in what's become an annual tradition for the VPN provider: inviting an outside firm to poke holes in its no-logs policy.
According to the results shared, the policy is accurate and fully aligned with IPVanish’s public privacy commitments – with its zero-logs promise strictly enforced across the company’s global server network.
Proof, not promises
The evaluation was comprehensive. Schellman’s auditors were given unrestricted access to IPVanish’s systems, configurations, and teams.
Interviews were conducted with engineering and operations staff, and company workflows were reviewed alongside infrastructure, internal documentation, and the administrative procedures governing the VPN app itself.
They also ran test traffic exercises – simulating real-world scenarios and watching closely for any evidence of VPN logging, including DNS queries, VPN metadata, and server responses.
The conclusion: no records of browsing traffic, session history, or connection metadata are collected or stored on active servers. Further, any real-time systems used to detect network abuse operate purely in memory, leaving nothing behind.
The auditors also checked IPVanish’s internal safeguards, confirming that any changes to how its servers work need sign-off from multiple people. This makes it much harder for logging to be quietly switched back on.
“A no-logs policy is only as credible as the evidence behind it,” said Subbu Sthanu, General Manager, Consumer Cybersecurity at IPVanish.
“People shouldn’t have to rely on promises when it comes to their privacy. By committing to annual independent audits of our no-logs policy, we’re making transparency and accountability an ongoing practice, not a one-time exercise.”
Customers who want to dig deeper can download the full report themselves via the Security Reports page in the My IPVanish account portal.
Part of a bigger picture
The audit doesn’t arrive in isolation. IPVanish has spent the past year restructuring its plans – Essential, Complete, and Advanced – around a suite of security extras, while growing a server network that now spans more than 150 locations.
Meanwhile, the company is midway through migrating its infrastructure to RAM-only servers, which wipe all data on every reboot and eliminate the possibility of storage-based logging; it has pledged to complete that transition by 2027.
Taken together, the picture is of a provider treating privacy less as a marketing slogan and more as something baked into how it operates.
In a market where rivals like NordVPN and ExpressVPN have made repeat audits their own baseline, the third-party stamp of approval is now a must-have rather than a nice-to-have. IPVanish seems intent on keeping up.
