What an audit means here
We intend independent reviews to examine code and infrastructure within an agreed scope. The engagement will define the auditor's access and methodology. We will publish that scope and the resulting report so readers can assess what the audit establishes and what remains outside it.
The planned review areas include:
1. Privacy audits
A privacy review would compare the service's runtime behaviour with the published policy, including browsing logs, DNS handling, account records and operational data. Its report would describe the evidence and limits of the findings rather than treat all records as a single yes-or-no question.
2. Cryptographic audits
A cryptographic audit reviews protocol implementations. We use WireGuard with ChaCha20-Poly1305 — both well-studied — but configuration matters. The auditor verifies key derivation, nonce handling, key rotation, and our defence against known attack classes (Heartbleed-style memory leaks, timing-channel attacks, downgrade attacks).
3. Infrastructure audits
An infrastructure review would inspect a defined sample of servers and their logging, access and deployment configuration. The report would identify the sample, methods and limitations, including the distinction between browsing logs and temporary connection state.
Build verification and audit scope
Build verification, code review and infrastructure audits answer different questions. Any future report will state which clients, versions and build processes it covers. Signing a binary or publishing source does not, by itself, establish the absence of telemetry or replace an independent audit.
How audit findings get handled
We will categorise findings using standard severity scales (CVSS for security, qualitative for policy issues). For each finding, this page will record:
- The original auditor description and severity.
- Our remediation plan and target date.
- The actual remediation date and a re-audit confirmation, where applicable.
- If a finding cannot be remediated quickly, the workaround and its expiry.
We will not silently rewrite or remove findings. If an auditor's wording needs correction, we will publish a note alongside the original.
FAQ
Why no completed audits yet?
GhostShield launched in 2025 and has not yet commissioned an independent audit. Until one is published here, our no-logs policy is our own statement, and this page says so plainly.
What if an audit finds a serious issue?
We will publish the finding, the remediation plan, and the remediation deadline on this page, and email all paying customers with the same information within 7 days of confirming the finding. The bar for “serious” is anything that would let an attacker identify a specific user's traffic, or compromise the no-logs claim.
How can users verify a finished audit was real?
When a report is available, we will publish the auditor's signed report and contact information, plus an engagement confirmation on the auditor's website where available. Readers will be able to contact the firm to confirm.