Does proton vpn keep logs
Executive summary
Proton VPN publicly enforces a strict no-logs policy and says it does not record VPN session data or connection metadata, a claim repeatedly supported by independent audits and company transparency reporting [1] [2] [3]. That promise is subject to practical limits: Proton stores some account-related data by design and can be compelled by law under Swiss jurisdiction in specific, narrow circumstances — although its transparency reports show requests have often been denied and a 2019 court test reportedly found no logs to hand over [4] [5] [6].
1. Proton’s public promise: “no session logs” and Swiss protections
Proton’s official materials say the service “keeps no session logs” and does not record metadata that can personally identify users, emphasizing that servers are encrypted and under Swiss legal protections that do not mandate retention of user activity data [1] [2] [5]. The company highlights open-source apps, a published privacy policy, and features such as “Secure Core” routing and full-disk encryption on servers as structural supports for that promise [4] [2] [7].
2. Independent audits and transparency reporting that back the claim
Proton has submitted its no-logs claim to repeated third-party audits by Securitum, with public audit reports concluding no evidence of user activity logging, connection metadata storage, or traffic inspection contradicting the no-logs policy; press coverage frames these as multiple consecutive audit passes including a fourth audit reported in 2025 [3] [6] [8]. Proton also publishes transparency reporting showing how it handles legal requests, and Tom’s Guide noted Proton’s transparency figures (29 legal requests denied up to mid‑2025) as part of the corroborating material [6] [5].
3. What Proton does store, and the legal caveats
Proton’s privacy documentation clarifies that product-specific account data and authentication logs exist for legitimate service operation and security purposes, and that by default it does not keep permanent IP logs tied to accounts — a distinction the company makes between VPN session data (not logged) and account/administrative data (processed) [9] [2]. Proton itself warns that no technical architecture is inherently immune to accidental logging or misconfiguration, which is a reason it commissions recurrent audits to validate that additions to the service haven’t altered the no-logs posture [8] [3].
4. Real-world tests, limits of audits, and skeptical voices
The no-logs claim was reportedly tested in a 2019 legal proceeding where Proton said it could not produce logs because none existed, a point the company cites to illustrate practical compliance with its promise [4]. Audits examine technical and administrative controls but are time-limited snapshots and dependent on scope and methodology chosen by the auditor, a caveat that technical reporters stress even as they praise Proton’s recurring verifications [3] [8]. Critics and competitors have questioned whether any VPN can be fully trusted and some third-party blog posts have alleged discrepancies or expressed skepticism, though these critiques often lack the corroborating technical detail supplied by the audits or Proton’s transparency data [10] [11].
5. Bottom line — answer to the question “does Proton VPN keep logs?”
On the balance of available reporting, Proton VPN does not keep VPN session logs or connection metadata that would identify users, and that position is supported by multiple independent Securitum audits and Proton’s transparency reporting [1] [3] [6]. That conclusion comes with two important qualifiers stated in Proton’s own materials and in reporting: Proton does maintain some account-related and authentication data for legitimate service operation (not VPN session data), and it can be subject to lawful orders under Swiss law — though its transparency report shows many requests were denied and Proton has demonstrated in at least one legal test that it had no session logs to produce [9] [5] [4]. If absolute anonymity is required, users should weigh these nuances — the company’s audited no-logs posture is strong evidence of minimal logging, but audits are snapshots and do not replace continuous, independent verification by external investigators [3] [8].