{
  "observed_at": "2026-09-12",
  "guide_path": "/guides/vpn-audits-no-logs-explained",
  "formula": "row_class = inspected if full_report_inspected AND report_availability == full_report; uninspected_report if report_availability == full_report AND not inspected (cover-only canvas, login/NDA/email gate); announcement if report_availability == announcement_only; product_class = inspected if any inspected row; else announcement if any announcement or uninspected_report; else claim if logging_policy == no_logs_claim; else none if audits array empty; else unknown if audits key missing; announcement_only is not inspected; Type I is design not operating effectiveness; a pentest is not a no-logs ISAE; a no-logs ISAE is not zero retained account/payment/metadata; report_date is point-in-time not continuous assurance",
  "count_formula": "inspected_count + announcement_count + uninspected_count = classified_rows; 0+2=2 NordVPN; 3+0=3 Surfshark; 1+1=2 Proton; 6+1=7 IVPN; 2+2=4 TunnelBear; 4+0=4 Mullvad pentests not a no-logs ISAE",
  "hand_arithmetic": [
    {
      "product": "nordvpn",
      "inspected_count": 0,
      "announcement_count": 2,
      "uninspected_count": 0,
      "row_sum": 2,
      "product_class": "announcement",
      "note": "0+2=2. Both Deloitte rows are announcement-only. Login-walled PDF was not opened."
    },
    {
      "product": "surfshark",
      "inspected_count": 3,
      "announcement_count": 0,
      "uninspected_count": 0,
      "row_sum": 3,
      "product_class": "inspected",
      "note": "3+0=3. Deloitte ISAE 3000 PDF inspected. Separate pentest/summary PDFs are not a second no-logs ISAE."
    },
    {
      "product": "proton-vpn",
      "inspected_count": 1,
      "announcement_count": 0,
      "uninspected_count": 1,
      "row_sum": 2,
      "product_class": "inspected",
      "note": "1+1=2. 2025 Securitum PDF inspected. 2026 Drive canvas is cover-only, not inspected."
    },
    {
      "product": "ivpn",
      "inspected_count": 6,
      "announcement_count": 1,
      "uninspected_count": 0,
      "row_sum": 7,
      "product_class": "inspected",
      "note": "6+1=7. 2019 Cure53 no-logs PDF inspected. 2026 Unlinked Access is announcement-only."
    },
    {
      "product": "tunnelbear",
      "inspected_count": 2,
      "announcement_count": 2,
      "uninspected_count": 0,
      "row_sum": 4,
      "product_class": "inspected",
      "note": "2+2=4. TB-11/TB-10 PDFs inspected. 8th/9th annual blogs are announcement-only."
    },
    {
      "product": "mullvad",
      "inspected_count": 4,
      "announcement_count": 0,
      "uninspected_count": 0,
      "row_sum": 4,
      "product_class": "inspected",
      "note": "4+0=4. X41/Cure53/Assured PDFs inspected. Not a no-logs ISAE."
    }
  ],
  "assumptions": [
    "Announcement-only audits are not inspected reports.",
    "A full_report URL that was not opened (cover-only canvas, login, NDA, email or dashboard gate) is not inspected.",
    "Type I is design, not operating effectiveness.",
    "A pentest or source-code audit is not a no-logs ISAE.",
    "A no-logs ISAE is not zero retained account, payment or metadata records.",
    "report_date is point-in-time, not continuous assurance.",
    "Inspected-report counts are integers, not billed totals.",
    "Same class on two products is not a ranking.",
    "ACSC Using VPNs (October 2021) is organisational, not a consumer no-logs shopping list.",
    "Not a numeric security score and not a Privacy Act determination."
  ]
}