Overview — what we’re analyzing and why it matters

“No‑logs” promises remain the single most marketable statement a VPN vendor can make. As of September 2026, those claims are more scrutinized and more technically specific than in 2024–25. Audits, memory‑only server designs and hardware attestation have become common defences, but legal compulsion and operational realities still create residual exposure. This update explains what modern audits and RAM‑only architectures actually prove, which technical advances materially reduce risk, where legal threat vectors still matter, and what both providers and buyers should require today.

Background — what led to this moment

The tension is unchanged: vendors sell privacy; investigators and courts seek data. Since the CLOUD Act (2018) and longstanding mutual legal assistance processes remain operative, a vendor’s legal domicile, staff locations, and the physical placement of servers still influence which authorities can compel data. Over the past two years providers have accelerated adoption of reproducible builds, signed golden images, continuous attestation, and confidential‑computing primitives (TPM/TEE) to harden no‑logs claims. At the same time, independent auditors and privacy‑focused researchers have pushed for more transparent methodologies and ongoing verification rather than single point‑in‑time reports.

Data and evidence — what modern audits and architectures test (and what they don’t)

“Independent audit” remains a broad label. By late 2026, audit reports and vendor disclosures have generally evolved in three ways: more methodological transparency, inclusion of hardware attestation evidence, and routine publication of deployment artifacts. Key verification elements to look for now:

  • Reproducible server builds and signed image hashes — auditors should be able to verify that the server binaries and configurations used in production match published, signed artifacts. Publication of image hashes and CI/CD logs makes tampering harder to deny.
  • Memory snapshot and forensic checks — modern audits commonly include RAM captures and live forensic checks that show no persistent logs at snapshot time. These are still point‑in‑time, so cadence and independence matter.
  • Continuous and hardware‑backed attestation — remote attestation using TPMs or confidential computing (Intel TDX, AMD SEV, ARM Confidential Compute Architecture) is increasingly used to prove that machines are running an approved image. Attestation logs that are publicly verifiable raise assurance above ad‑hoc snapshots.
  • Infrastructure and operational process review — beyond code, auditors examine provisioning, reimage cadence, incident response, key management, and third‑party dependencies (DNS, telemetry/analytics, control panels).
  • Pen testing and supply‑chain checks — as CI/CD and third‑party packages grow, supply‑chain audits and penetration testing against live control planes are now standard additions.

What audits do not—and cannot—prove:

  • That the vendor won’t change behavior after the audit window.
  • That law enforcement or a hostile hosting provider couldn’t obtain a live RAM image under compulsion or physical access.
  • That every edge case (crash dumps, misconfiguration, 3rd‑party analytics) has been exhaustively exercised in every regional deployment.

RAM‑only servers and confidential computing: improvements and remaining limits

RAM‑only or diskless designs remain the most pragmatic technical control to limit persistent logs. Since mid‑2025, several providers added confidential‑computing layers (TDX/SEV/CCA) and automated reimaging to their server fleets. These advances materially raise the technical bar but do not eliminate risk:

  • Swap, crash dumps, and journaling — servers must explicitly disable swap/pagefile, kernel crash dumps, and persistent system journals. Modern deployment templates usually include those settings, but operators must continuously verify them and publish checks.
  • Live acquisition risk — authorities with administrative control at the host (cloud provider or colo staff) can capture RAM while processes run. Confidential computing reduces the amount of plaintext exposed to host admins, but not every workload or provider environment supports it yet.
  • Hoster trust and contract controls — cloud providers can produce billing, metadata, or control‑plane logs; contractual controls and SOC/ISO evidence help but aren’t an absolute legal barrier to compelled disclosure in many jurisdictions.
  • Supply‑chain and operator error — the dominant residual risk remains human and third‑party dependencies: misapplied patches, accidental logging left on by devops, or analytics SDKs included in client apps.

Multiple perspectives — what vendors, auditors, privacy advocates and legal experts now say

  • Vendors — see public audits, signed images and attestation as differentiators. Many now publish reimage schedules and signed hashes; a subset has moved to continuous attestation feeds for critical exit infrastructure.
  • Independent auditors — argue for transparent methodology: disclose exact tests performed, supply forensic artifacts (hashes, memory snapshot proofs), and avoid marketing‑only statements. Auditors increasingly refuse black‑box engagements where methodology is undisclosed.
  • Privacy advocates — welcome hardware attestation and reproducible builds, but note that legal posture (where a company’s servers and personnel are) remains the decisive factor for high‑risk users.
  • Legal scholars and regulators — emphasize that no technical control can wholly override lawful process. The CLOUD Act, MLATs and local search/warrant powers continue to define compulsion pathways; privilege and contestation strategies matter as much as technical design for many cases.

Implications — what this means for buyers and operators in Sept 2026

Technical advances shrink the technical attack surface: reproducible builds, signed images, frequent reimaging, continuous attestation and confidential computing make it substantially harder for vendors to retain undisclosed persistent logs. But legal avenues to compel data have not materially changed. That leads to a three‑part reality for buyers:

  1. Technical assurance is necessary but not sufficient — prefer vendors publishing signed golden images, CI/CD provenance, attestation logs and frequent forensic audits.
  2. Legal posture matters — company domicile, staff locations, and contractual protections with hosting providers still determine who can seek disclosure and how easily it can be enforced.
  3. Operational transparency and independent monitoring are new differentiators — vendors that publish machine‑readable attestation feeds, reimage timestamps, and granular audit methodology offer materially higher assurance than those that publish a single static report.

Updated checklist — what to demand from vendors in Sept 2026

When evaluating no‑logs claims, look for this package of verifiable artifacts and commitments:

  • Signed and versioned server images and build scripts — with published hashes and CI/CD provenance.
  • Continuous attestation evidence — public, machine‑verifiable attestation tokens (TPM/TEE) or ledgered attestation logs showing servers booted known images.
  • Frequent forensic audits — reports that include RAM snapshot methodology, timestamps, and raw artefact hashes rather than high‑level summaries.
  • Operational runbooks and hardening docs — explicit configurations disabling swap, crash dumps, and persistent journaling, and automated tests that detect regressions.
  • Minimal metadata policy — clear published retention windows, proof of automatic deletion, and no‑analytics SDKs in client software.
  • Transparency reporting and legal policy — counts of legal requests, how orders were handled, and a public commitment to contest overbroad requests where possible.
  • Third‑party contract disclosure — describe relationships with cloud/colocation providers and DNS/CDN partners and what legal process applies to them.

How different users should evaluate vendors now

Not all users need the same level of assurance. Updated guidance for September 2026:

  • Casual privacy user — prefer vendors with clear audits, RAM‑only claims, and good UX. Signed images and reimage cadence are nice‑to‑have but not essential.
  • High‑risk individuals (journalists, dissidents) — require reproducible builds, continuous attestation, minimal metadata, documented legal‑defence posture, and multi‑layer defenses (e.g., Tor over VPN, ephemeral client setups, anonymous payments). Avoid vendors with opaque third‑party analytics.
  • Enterprises and compliance buyers — require contractual SLAs, right‑to‑audit clauses, periodic forensic audits, and clear incident response timelines; insist on supplier chain transparency for hosting and DNS providers.

Outlook — what to watch for next

Through late 2026, expect three developments that could change the balance of assurance:

  1. Wider deployment of confidential computing and remote attestation — as cloud providers broaden TEE support, attestation will likely become a common baseline for exit servers.
  2. Standardization of audit methodologies — pressure from auditors and privacy communities may produce de‑facto standards (checklists and reporting templates) that raise and harmonize expectations.
  3. Regulatory and litigation tests of transparency tools — cases testing the legality of warrant canaries, gag orders and the enforceability of contractual protections with hosting providers could clarify legal exposure in specific jurisdictions.

Practical summary — the balanced answer for September 2026

Audits and RAM‑only servers materially reduce the chance of persistent logs. Since 2024, the industry has adopted stronger technical and attestation controls that make no‑logs claims more verifiable. Still, legal compulsion and live acquisition remain real risks. The most credible vendors combine reproducible, signed build artifacts, continuous hardware attestation, frequent forensic audits with published methodology, minimal metadata retention, transparent third‑party contracts, and a legal posture prepared to contest overbroad orders. For users, the right choice depends on your threat model; for high‑risk scenarios, pair a vetted VPN with additional layers (Tor, compartmentalized devices, anonymous payments) and insist on the artifacts listed above.

FAQ

Does a RAM‑only server guarantee law enforcement can’t get my data?

No. RAM‑only servers reduce the risk of long‑term persistent logs on disk, but they don’t prevent authorities with administrative or physical access from capturing memory while a process is running. Confidential computing reduces host visibility but is not universally deployed. Treat RAM‑only as a strong mitigation, not an absolute protection.

Do SOC 2 or ISO 27001 audits prove a VPN is no‑logs?

No. SOC 2 and ISO 27001 assess controls and processes but do not directly verify the absence of specific logging artifacts. Prefer audits that include forensic memory snapshots, reproducible build verification, and detailed methodology over a generic compliance certificate alone.

What is remote attestation, and why should I care?

Remote attestation uses hardware features (TPM, TEE) to cryptographically prove a server booted and is running a specific signed image. Public attestation logs raise the technical cost of covert logging because they let third parties verify a machine’s state. For high‑assurance use cases, prefer vendors that publish attestation tokens or feeds.

How often should servers be reimaged or re‑provisioned?

There’s no universal interval, but frequent, automated reimaging (daily or weekly for critical exit nodes) combined with signed golden images and published reimage timestamps significantly increases assurance. The key is automation and verifiable provenance, not a single cadence number.

What should a transparency report include in 2026?

A modern transparency report should publish counts of legal requests, the vendor’s response, examples of orders where data were not produced, and high‑level descriptions of legal challenges. Where possible, include machine‑readable attestation archives and links to audit artifacts. Specifics will vary by jurisdiction, but openness about process and outcomes is essential.