Thought experiment: design an architecture that passes this audit scope as written that allows for logging of user activity.
I can think of at least one.
I can think of at least one.
Unless you're de-facto part of the government like Google and Microsoft - I see no good reason to log anything more than what's legally required.
1. Browsing habits would hardly have an affect on the vast array of data to have an effect on ads presented to you, unless you care about your privacy. Its all target auidence and marketing (look at ExpressVPN or Surfshark. They all offer privacy but never follow up)
2. Their algorithms can avoid showing you ads derived from the VPN if it detects the usage of your actual IP
actually a very interesting experiment
I don't know if they are logging or not. They say they aren't. The audit says they didn't see evidence that they are.
It's impossible to prove a negative.
It's quite common for servers to boot from the network and have no disk, and have application logs actually sent to a log server via http/udp [0].
[0] For example: https://docs.splunk.com/Documentation/Splunk/9.1.0/Data/HECE...