Don't Take Your VPN's Word for It: How to Actually Check What's Running on Your Device

Trust is a strange currency in the VPN industry. You're essentially handing your internet traffic to a company you've probably never heard of before a Google search, run by people you'll never meet, operating servers in jurisdictions you may not fully understand. In exchange, you get a promise.

"We don't log your activity." "We use military-grade encryption." "Your privacy is our top priority."

These statements appear on virtually every VPN provider's marketing page. Some of them are true. Some are misleading. A few are outright fiction. The uncomfortable reality is that most users have no idea which category their provider falls into — because they've never tried to check.

This article is about changing that. You don't need to be a developer or a security researcher to perform a meaningful audit of your VPN setup. You just need to know where to look.

Start With the Paper Trail: Reading Privacy Policies Like a Skeptic

Before you open a single terminal window, start with the document your VPN provider least wants you to read carefully: their privacy policy.

Most privacy policies are written to sound protective while preserving maximum flexibility for the company. Here's what to look for:

Vague logging language. Phrases like "we may collect connection metadata" or "aggregate, anonymized data" are red flags. True no-log providers should be specific about what they don't collect — timestamps, session durations, bandwidth usage, originating IP addresses. If the policy is fuzzy on these points, assume the worst.

Jurisdiction matters. A VPN incorporated in the United States is subject to US law, including the Foreign Intelligence Surveillance Act and National Security Letters, which can compel data disclosure with a gag order attached. Providers based in Switzerland, Iceland, or outside the Fourteen Eyes intelligence-sharing alliance operate under different legal constraints. Neither situation is automatically better or worse for your specific threat model, but you should know which one applies to your provider.

Third-party audits. Some reputable providers — Mullvad, ProtonVPN, and ExpressVPN among them — commission independent security firms to audit their no-log claims and publish the results. If your provider has never done this, or refuses to discuss it, that's worth noting.

Watch What Your VPN Client Actually Does

Once you've read the policy, it's time to watch the software itself. Even without reading source code, you can learn a surprising amount by monitoring what your VPN client communicates with.

On Windows, open Task Manager and switch to the "Details" tab while your VPN is running. Note which processes are active. Then open Resource Monitor (search for it in the Start menu) and navigate to the Network tab. You'll see every active network connection your computer is making, organized by process. Look for connections to IP addresses or domains that aren't your VPN provider's servers — particularly anything connecting to advertising networks, analytics platforms, or unfamiliar third parties.

On macOS, the built-in Activity Monitor works similarly. For more detail, a free tool called Little Snitch (there's a trial version) will show you every outbound connection attempt and let you block them individually. It's an eye-opening experience the first time you run it.

On mobile, your options are more limited, but both iOS and Android have battery and data usage screens that show per-app network activity. Unusual background data consumption from your VPN app when you're not actively using it deserves investigation.

The DNS Leak Test: Your Quickest Sanity Check

If you only do one thing after reading this article, make it this: run a DNS leak test.

Open a browser while connected to your VPN and visit dnsleaktest.com or browserleaks.com/dns. These sites will show you which DNS servers are actually handling your domain lookups. If the results show your ISP's servers — rather than your VPN provider's — your browsing activity is being logged somewhere you didn't intend, regardless of what the VPN's interface says.

This takes about 90 seconds and provides genuinely actionable information. Run it on your home network, your work network, and any other environment where you regularly use your VPN.

Open-Source VPN Clients: Transparency by Design

One of the most meaningful things you can do for your long-term privacy is choose a VPN client whose source code is publicly available and actively reviewed by the security community.

WireGuard is an open-source VPN protocol with a codebase small enough that individual researchers can meaningfully audit it — a significant advantage over the sprawling codebases of proprietary solutions. Many VPN providers now offer WireGuard as a connection option.

Mullvad's desktop client is fully open-source and available on GitHub. ProtonVPN's apps are also open-source across all platforms. With open-source software, you're not relying solely on the company's claims — you're relying on the fact that thousands of eyes have reviewed the code and would notice if it were doing something it shouldn't.

This doesn't mean closed-source VPNs are automatically untrustworthy. But transparency is a form of accountability, and accountability matters when your privacy is on the line.

Checking for Suspicious Background Processes

Some VPN clients install additional software components that run even when the VPN itself is off. These might be update daemons, crash reporters, or telemetry collectors. Some are benign. Others are not.

On Windows, open the Services panel (search "services.msc") and look for any services associated with your VPN provider. Note what they do and whether they're set to run automatically. On macOS, check System Settings > General > Login Items for anything your VPN installed that runs at startup.

If you find processes you can't identify or services that seem to have no clear purpose, search for them by name online. The security community tends to document unusual behavior quickly.

A Realistic Expectation

No audit you can perform as an individual user will give you the same confidence as a professional third-party security review. But that's not the point. The point is to move from blind trust to informed trust — to understand roughly what your VPN is doing, verify the basics, and make smarter decisions about which provider deserves your continued business.

A VPN that can't withstand even basic scrutiny probably isn't protecting you as well as it claims. The good news is that the tools to check are free, accessible, and take less time than most people think.