from the team:


Hey everyone,

We are now able to share that Proton VPN has successfully passed its 4th consecutive independent audit of our strict no-logs policy, conducted by Securitum, a leading European security auditing company.

Key takeaways from the audit:

  • No activity or metadata logs are kept anywhere on our servers.
  • No inspection of user traffic occurs.
  • Robust administrative and technical controls are in place, including automated configuration management and a dual-control change process.
  • The no-logs policy is enforced uniformly across all servers, regions, and subscription tiers.

Don’t trust, verify is not just something we preach, but something we practice, so our no-logs policy has now been verified by independent experts; you don’t have to take our word for it.

📖 Read the full audit report here

Stay safe,

Proton Team

you are viewing a single comment's thread
view the rest of the comments
[–] -1 points 1 year ago (15 children)

Sorry to be a downer, but audits of software that isnt selfhosted are kinda useless. Unless they allow spontaneous unannounced inspection of their infrastructure, they can just do whatever they want after the audit.

  • source
  • hideshow 15 child comments
  • [–] 52 points 1 year ago (3 children)

    The only thing you can truly know is that you exist. Sorry to be a downer

  • source
  • parent
  • hideshow 3 child comments
  • [–] 18 points 1 year ago (6 children)

    Well, would you trust the company that's actually gone through the audits, or the one that skips them to save money & be cheaper?

  • source
  • parent
  • hideshow 6 child comments
  • [–] -4 points 1 year ago (5 children)

    Only the one that just open sources their code and encourages people to self host.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 10 points 1 year ago (4 children)

    You can't self host a VPN, what would be the point?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 year ago (2 children)

    Lemmy is "self hosted" that doesnt mean every user has their own instance...

  • source
  • parent
  • hideshow 2 child comments
  • [–] -1 points 1 year ago*

    To expand, you don't want your service provider to open source all of their configs. Audits like the one Proton went through require admin access to systems that you absolutely don't want the public to have.

    This is just like Lemmy. The actual code is open sourced. But instance configs aren't (for good reason)

    Proton isn't a developer when it comes to their VPN service. They most likely are utilizing open source solutions to run it, but they're not operating a code base for it.

    Their clients are open source, though.

    And I'm saying this as a cyber security expert who uses Proton for personal use.

  • source
  • parent
  • load more comments (1 reply)