IPVanish says its third independent no-logs audit found no records of customers’ browsing activity, DNS queries, or individual VPN connections in the systems examined.
The full report also details what the VPN provider does keep for abuse prevention, confirming that aggregate usage statistics are retained for up to 24 hours.
Schellman Compliance completed the assessment on September 25, 2026, and IPVanish announced the results on November 5. The review follows a 2025 assessment by Schellman and a 2022 review by Leviathan Security Group.
For users of the consumer VPN product, the distinction between activity logs and aggregate statistics matters because a VPN routes internet traffic through the provider’s servers. Individual connection records could let a provider link a session to a customer’s IP address, while aggregate figures can measure usage volume without identifying whose traffic contributed.
What Schellman tested
According to the report shared with CyberInsider, Schellman examined the standard software image used to configure production servers and checked the logging settings on a sample VPN server. Auditors observed a user connect to the server and visit a test destination, then inspected sample logs. They found logging disabled in the configurations they examined and no records of the user’s traffic, activity, or connection details in the logs they checked. A separate system log contained only machine specifications.
Schellman also inspected the VPN’s abuse-monitoring settings and a sample monitoring log. IPVanish processes the underlying data in memory and retains only aggregate usage statistics. The report says those statistics contain no customer IP addresses, DNS queries, or traffic content. Auditors checked the deletion settings and found that IPVanish kept aggregates for a maximum of 24 hours.
How IPVanish controls configuration changes
The auditors checked the safeguards that govern changes to production systems. They reviewed deployment settings and a sample change and found that a product owner and a second reviewer must approve configuration changes before deployment. They also examined records from weekly meetings where IPVanish reviews changes for unauthorized deployments.
The report’s findings on consistency across servers, regions, and subscription tiers drew on interviews with IPVanish developers and evidence that production servers use a shared baseline image. The direct connection and log checks described in the report used a sample server.
IPVanish says subscribers can download the full assessment from the Security Reports page in the My IPVanish account portal.
Leave a Reply