DuckDuckGo has built its reputation on prioritizing user privacy, and its VPN service is no exception--albeit it comes at a cost. With a myriad of VPN options available, DuckDuckGo's offering initially appeared to stand out as a reliable choice. However, concerns about privacy and security often arise when utilizing such services: How effectively does this VPN safeguard user data? Is the company potentially accessing browsing information during usage?
To address these concerns, DuckDuckGo enlisted the expertise of the independent cybersecurity firm Securitum to evaluate its "no-logs" policy. This policy asserts that no user data--such as activity, timestamps, or metadata--is recorded or stored on the company's egress servers, which facilitate data transmission. The audit was conducted from October 2025 to January 2026, with Securitum's senior security consultants examining DuckDuckGo's engineering practices.
Securitum's Findings on DuckDuckGo's Compliance
Upon completion of the audit, Securitum concluded that DuckDuckGo's VPN adheres to its no-logs policy. The firm confirmed that the service does not track or log user activity on its egress servers, having analyzed random live servers without uncovering any tracking evidence. Additionally, DuckDuckGo refrains from recording user-specific connection metadata, such as DNS traffic. While the service employs a caching system to enhance performance, all data is purged after a standard 24-hour period, and the cache is structured to prevent post-destruction access.
The audit also highlighted that DuckDuckGo's VPN does not inspect or log user network traffic, and its "Scam Blocker" feature operates locally on users' devices rather than on DuckDuckGo's servers. Importantly, the VPN does not monitor the websites or servers accessed by users, a crucial aspect of any VPN service. Although Securitum provided constructive feedback regarding the implementation of "enhanced file integrity," DuckDuckGo has already begun addressing this recommendation. The no-logs policy is uniformly applied across all servers and regions, ensuring consistent privacy protections globally.
Furthermore, the auditors noted that altering log-related configurations is intentionally difficult, ensuring that "no single engineer can unilaterally modify logging configurations or deploy unapproved code." The audit also found that DuckDuckGo's VPN and Subscription APIs utilize distinct authentication tokens, preventing any connection between user accounts and VPN activities.
Understanding the Audit's Limitations
While Securitum's audit presents a positive outlook, it is essential to approach these findings with caution. The conclusion affirms that DuckDuckGo "fully complies with the privacy commitments outlined in its No-Logs policy," but this does not guarantee the VPN is flawless. There may still be vulnerabilities when compared to other VPNs; the audit simply confirms compliance with the stated policy.
Nonetheless, this audit provides valuable reassurance to users of DuckDuckGo's VPN, allowing them to browse confidently knowing that their data is not being stored on the company's servers, even while traveling.
