Our Commitment to Transparency
At KernelVPN, we believe trust should be verified, not assumed. That's why we regularly commission independent security audits from leading cybersecurity firms to verify our no-log policy and infrastructure security.
Latest Audit Results
- Auditor: Cure53 (Berlin, Germany)
- Date: January 2026
- Scope: Server infrastructure, client applications, no-log policy verification
- Result: No critical or high-severity issues found. No-log policy verified.
What Was Audited
- Server Infrastructure: All production servers were verified to run on RAM-only — no data can be physically stored on disk.
- Client Applications: iOS, Android, macOS, and Windows apps were tested for vulnerabilities including data leaks, insecure connections, and improper encryption implementation.
- No-Log Policy: Server configurations, code, and network architecture were verified to confirm that no user activity, connection logs, or IP addresses are recorded.
- DNS Leak Protection: Verified that all DNS queries are routed through the encrypted tunnel with no leaks.
Previous Audits
- 2025 Q3: PwC Switzerland — No-log policy verification (Passed)
- 2025 Q1: Cure53 — Infrastructure security audit (Passed, 2 low-severity issues resolved)
- 2024 Q3: Deloitte — SOC 2 Type II compliance audit (Passed)
Open Source Commitment
Our client applications are open source, allowing anyone to inspect our code. We also publish a warrant canary that is updated quarterly to confirm we have not received any secret government requests for user data.