Penetration Test Report (Securitum): securitum protonmail vpn audit

Security report
SUBJECT
Verification of Proton VPN’s No-Log policy
DATE
18.08.2025 – 19.09.2025
LOCATION
Zürich, Switzerland
AUTHORS
Martin Matyja,
Maciej Szymczak
VERSION
1.0
+48 (12) 352 33 82 www.securitum.com
securitum@securitum.com www.sekurak.pl
1
Executive summary
This report summarizes the findings of an independent security assessment conducted by Securitum,
commissioned by Proton AG. The primary objective of this engagement was to validate that Proton's VPN
server infrastructure strictly adheres to its publicly stated No-Logs policy. This policy asserts that no user
activity or identifying metadata is logged or stored, thereby protecting user privacy and anonymity.
The full text of the Proton VPN No-Logs policy is available for review at the following locations:
• https://protonvpn.com/features/no-logs-policy
• https://protonvpn.com/support/no-logs-vpn/
To achieve this objective, Securitum dispatched two senior security consultants to the Proton AG office in
Zürich, Switzerland. The on-site assessment occurred between August 18 and August 20, 2025, constituting six
person-days of focused technical evaluation. Throughout the engagement, Securitum auditors worked
directly with Proton's senior engineers responsible for the VPN infrastructure. The assessment involved
technical inspection, configuration review, and system analysis to verify that the deployed environment
contains no mechanisms capable of collecting or retaining user-identifiable data or internet activity logs.
Engagement scope and methodology
The assessment was designed to provide a comprehensive and practical validation of Proton VPN's No-Logs
policy. Securitum's methodology combined documentation review, technical interviews, process evaluation,
and direct, hands-on inspection of production systems.
It should be noted that throughout the engagement, Proton's engineering team demonstrated a high level of
transparency and cooperativeness. All inquiries were answered with detailed technical explanations, and
auditors were provided with the necessary access and demonstrations to verify the claims made in the No-
Logs policy. This open and collaborative approach was essential for the successful completion of this
assessment.
The scope of the audit covered Proton VPN's production server infrastructure. It was confirmed that this
infrastructure runs on bare-metal servers fully owned and controlled by Proton AG. Some servers utilize
lightweight, OS-level containerization, but the underlying physical hardware remains under Proton's exclusive
control. This provides a strong foundation for security and privacy by eliminating reliance on third-party cloud
infrastructure providers for the core VPN service.
Audit activities
The following activities were performed to achieve the engagement's objectives:
+48 (12) 352 33 82 www.securitum.com
securitum@securitum.com www.sekurak.pl
2
Documentation review and technical interviews
Analysis of technical architecture diagrams and system documentation, supplemented by in-depth
discussions with Proton's senior engineers to establish a thorough understanding of the VPN infrastructure,
data flows, and component interdependencies.
Live system inspection and configuration analysis
Direct, hands-on examination of production VPN server components. To ensure an unbiased sample,
Securitum auditors independently and randomly selected production servers for each verification procedure.
The analysis focused on system configurations, running processes, and storage to identify any mechanisms
capable of collecting or retaining user data.
Change and deployment process review
Evaluation of the operational security practices governing configuration changes and new server
deployments. This was done to verify that processes are in place to prevent the unauthorized or inadvertent
introduction of logging mechanisms.
Data leakage analysis
Inspection of server storage and memory for evidence of out-of-band data persistence that could contravene
the No-Logs policy, such as un-swapped memory blocks or temporary file caching.
Key areas of investigation
The audit was structured to answer critical questions derived directly from the assertions made in the No-Logs
policy. The core focus was to verify the following:
1. Is user activity tracked or logged on the production VPN servers that handle user traffic?
2. Is connection metadata, such as DNS queries or session timestamps, logged on VPN servers?
3. Is user network traffic actively inspected, or its contents logged on VPN servers?
4. Is information monitored or logged regarding the specific services (e.g., websites, external servers) a
user connects to?
5. Are aggregate logs maintained that correlate services accessed (e.g., websites, servers) with the
specific VPN server used?
6. Is the No-Logs policy applied uniformly across all servers, in all geographic regions, and to all user
subscription tiers?
7. Is an automated process in place to detect and generate alerts for unauthorized configuration
changes that could enable logging (e.g., changing a "log" parameter from false to true)?
8. Is a formal Change Management process, incorporating a dual-control (four-eyes) principle, enforced
for all authorized changes to logging-related configurations?
9. Do the active configuration files for the core VPN services contain any enabled logging directives?
10. Is information logged that associates a specific user with a specific VPN server they are connected to?
The detailed findings related to these investigation areas are presented in the subsequent sections of this
report.
+48 (12) 352 33 82 www.securitum.com
securitum@securitum.com www.sekurak.pl
3
Scope exclusions
The scope of this engagement was specifically focused on the production VPN server environment and its
adherence to the No-Logs policy. The following areas were explicitly excluded from the scope of this audit:
• The Continuous Integration/Continuous Deployment (CI/CD) pipeline.
• A formal source code review of the VPN software and its associated libraries.
• Ancillary Proton systems, such as accounting or account management platforms.
• Static or dynamic binary analysis of the VPN client or server software.
Limitations of the assessment
This assessment provides a point-in-time validation of Proton VPN's production environment as it existed
during the on-site engagement. The findings are based on a guided review process, where Securitum auditors
observed live systems as demonstrated by Proton's senior engineers. While this provides a high degree of
assurance, it is distinct from an unsupervised, direct forensic investigation. The assessment was also
conducted on a representative sample of production servers and did not encompass every server in Proton's
global fleet. The conclusions in this report are based on the systems and evidence presented to the auditors
during the defined engagement period.
Historical context and current scope
Securitum has previously conducted independent assessments of Proton VPN's No-Logs policy in 2022, 2023,
and 2024. These audits serve as a consistent, year-over-year validation of Proton's commitment to user
privacy. The public reports from these prior engagements are available for review:
• Consolidated blog post: https://protonvpn.com/blog/no-logs-audit/
• 2022 audit report: https://drive.proton.me/urls/521N34GHTM#PVwqewJVFgyS
• 2023 audit report: https://drive.proton.me/urls/TEGZZ53M28#lPz2jeVjV6Mp
• 2024 audit report: https://drive.proton.me/urls/ED8G4GC5MG#pM52Y8RMXIKn
Since the 2024 assessment, the Proton VPN platform has undergone significant evolution, including the
introduction of new features and infrastructure enhancements. The scope of this 2025 audit was
comprehensive and specifically included the verification of these new components and configurations to
ensure they remain fully compliant with the No-Logs policy.
Recommendations
The technology landscape and the Proton VPN platform are in a constant state of evolution. To provide