VPN No-Logs Audits: What They Cover and What They Miss

In late 2025, auditors from Deloitte Lithuania spent five weeks inside NordVPN’s infrastructure — interviewing engineers, inspecting live server configurations, and combing through deployment pipelines. Their conclusion made headlines: for the sixth time since 2018, the provider’s no-logs claim held up.

Here is what most of those headlines skipped: the report itself describes a point-in-time assessment. It verifies what the systems looked like between November 10 and December 12, 2025. Not before. Not after. Not under a court order that arrives next spring.

That gap — between what VPN no-logs audits actually verify and what users believe they verify — is the most misunderstood topic in the privacy industry. It matters to users choosing a provider, and it matters even more to founders in VPN development, because an audit is now the price of admission to every “best VPN” list and every AI-generated recommendation.

At Cure VPN, we have sat on both sides of the table: architecting infrastructure to survive audit scrutiny and helping white label partners understand what an inherited audit does and does not protect them from. This guide explains, plainly and without marketing gloss, what a no-logs audit covers, where its blind spots live, how to read one like a professional, and how to build — or choose — a VPN whose privacy survives contact with the real world.

What Is a VPN No-Logs Audit?

A VPN no-logs audit is an independent examination — usually by an accounting firm like Deloitte or a security lab like Cure53 — that verifies whether a VPN provider’s systems, configurations, and operations match its public claim of not recording user activity, IP addresses, or connection timestamps.

Most major engagements follow ISAE 3000 (Revised), an international assurance standard set by the IAASB — the same framework used for non-financial corporate assurance. During a typical engagement, auditors:

• Interview engineering and operations staff about logging practices.
• Inspect live server configurations, including specialty servers (multi-hop, obfuscated, static IP).
• Review deployment pipelines to confirm privacy settings ship consistently to every node.
• Examine what data is collected (crash reports, aggregate load metrics) and check it against the privacy policy.
• Issue a “reasonable assurance” opinion on whether reality matches the written no-logs statement.

Notice the careful wording. Auditors verify design and implementation as observed during the engagement window. They do not certify the past, guarantee the future, or promise the provider could never log if compelled. Understanding that boundary is the entire point of this article.

A VPN no-logs audit independently verifies that a provider’s servers and processes do not record user activity — but only at a specific point in time. It covers system configurations, staff practices, and infrastructure design; it does not cover future behavior, legal compulsion, or code the auditors never examined.

Why No-Logs Audits Became the Industry Standard

A decade ago, “no-logs” was a checkbox on a pricing page. Two scandals ended that era.

In 2016, court documents revealed that IPVanish — then advertising a zero-logs policy — had supplied connection records to US authorities in a criminal case. A year later, PureVPN’s logs helped the FBI identify a cyberstalking suspect, despite similar marketing. Neither company’s users had any way to know the claims were hollow until courtrooms exposed them.

The market’s answer was verification. NordVPN commissioned the first big-firm no-logs assurance from PwC in 2018. Competitors followed, and the arms race escalated: TechRadar reports that ExpressVPN has now published more than 19 third-party audit reports, while Surfshark completed its second Deloitte no-logs engagement in June 2025 and NordVPN its sixth in December 2025.

Today the incentive structure has fully flipped. Review sites treat a missing or stale audit as a red flag. More importantly for anyone in VPN development services, AI search engines — ChatGPT, Gemini, Perplexity, and AI Overviews — now weigh audit history heavily when answering “which VPN should I trust?” An unaudited provider is increasingly invisible at the exact moment users decide.

For consumers, audits replaced blind faith with evidence. For providers, they became a recurring operational cost and a design constraint. Both facts shape everything below.

What VPN No-Logs Audits Actually Cover

Modern assurance engagements are genuinely rigorous within their scope. Using the recent Deloitte engagements at NordVPN and Surfshark as reference points, a thorough no-logs audit examines six areas:

1. Server Configuration, Node by Node Type

Auditors inspect standard VPN servers plus specialty infrastructure — double-hop, obfuscated, static, and multiport servers — confirming that privacy-relevant settings (no traffic capture, no persistent connection records) apply uniformly. This matters because logging exceptions historically hide in “special” server classes.

2. What Metadata Exists Anywhere

Good audits enumerate every data flow: authentication events, crash telemetry, aggregate bandwidth counters. The test is whether anything collected could tie an identity to an activity or timestamp. Well-architected providers pass because the join is structurally impossible, not merely forbidden by policy.

3. Deployment and Configuration Management

A single misconfigured node can undo a fleet-wide policy. Consequently, auditors review provisioning pipelines — how a new server gets built, which image it boots from, and who can change logging settings — to confirm the no-logs configuration is enforced by automation rather than habit.

4. Staff Practices and Access Controls

Through interviews and evidence review, auditors check who can access production systems, whether debugging workflows create temporary logs, and how incident response avoids capturing user data.

5. Policy-to-Reality Alignment

The privacy policy gets compared line by line against observed systems. Discrepancies in either direction — collecting more than disclosed, or claiming less collection than reality — are findings.

6. Specialty Feature Behavior

Recent engagements explicitly covered obfuscated and multi-hop routing, verifying that censorship-circumvention features follow the same no-logs rules as standard connections. That scope expansion reflects real user risk: obfuscated-server users are often the ones with the most to lose.

Within this perimeter, a big-firm audit is strong evidence. The problems start at the perimeter’s edge.

What No-Logs Audits Miss

This is the section the marketing pages will not write, so we will. Six structural blind spots limit every no-logs audit, no matter how reputable the firm.

1. The Point-in-Time Problem

An ISAE 3000 engagement verifies a window — often four to six weeks. NordVPN’s own announcement of its sixth audit states plainly that systems were assessed “exactly as they operated during that period.” A provider could theoretically enable logging in January, disable it in October, pass a November audit, and re-enable it in January. Annual re-audits shrink this window; nothing eliminates it.

2. Legal Compulsion Is Out of Scope

No auditor can attest to what happens when a warrant, national security letter, or foreign data-retention order arrives. An audit verifies the provider does not log — not that it cannot be forced to start. Jurisdiction, gag-order law, and transparency-report history fill this gap, which is why sophisticated readers evaluate all three alongside the audit.

3. Sampling, Not Totality

Auditors inspect representative infrastructure, not every node in a 5,000-server fleet. Configuration drift on unsampled servers — the exact failure behind Windscribe’s 2021 incident, where Ukrainian authorities seized servers still holding an outdated private key on disk — can survive an audit that never touched those machines.

4. The Client App Is Usually a Separate Question

A no-logs assurance covers server infrastructure and operations. Client-side risks — leaky apps, flawed kill switches, vulnerabilities like 2023’s TunnelCrack (which coaxed several VPN apps, Surfshark’s included, into leaking traffic outside the tunnel on rogue Wi-Fi) — require separate security audits from labs like Cure53. A provider waving one report as proof of both is blurring categories.

5. Upstream and Sideways Visibility

Even a perfect no-logs VPN cannot audit the internet around it. Data-center operators see encrypted flows; payment processors hold billing identities; app stores record installs. An audit says nothing about correlation attacks by adversaries observing traffic at both ends of the tunnel.

6. Reasonable Assurance ≠ Guarantee

Assurance language is deliberately bounded: “in all material respects, in accordance with the description.” It is a professional opinion based on evidence obtained — meaningfully stronger than a pinky promise, meaningfully weaker than a mathematical proof. Treat it accordingly.

The honest summary: a no-logs audit is necessary but not sufficient. It proves discipline at a moment in time. Architecture, jurisdiction, track record under legal pressure, and repeat verification supply the rest of the trust equation.

Audit Types Compared: Assurance, Security, and Real-World Tests

Confusion between audit categories causes most misread trust signals. Here is the field in one table:

Verification Type	Who Performs It	What It Proves	What It Cannot Prove
No-logs assurance (ISAE 3000)	Big Four firms: Deloitte, PwC, KPMG	Servers/operations matched no-logs policy during the window	Future behavior, legal resilience, client-app safety
Security / penetration audit	Cure53, Securitum, VerSprite	Apps and infrastructure resist attack; no critical flaws found	That no data is logged; audits code, not policy
RAM-only architecture	Verified within audits	Nothing persists past reboot; seizure yields nothing	Live-memory access during operation
Transparency reports & warrant canaries	The provider itself	Volume and handling of legal requests	Accuracy (self-reported), gagged requests
Real-world incidents (raids, subpoenas)	Courts and police, involuntarily	The strongest evidence available: claims tested under force	Nothing — but you cannot schedule one

The strongest providers stack all five. A Deloitte no-logs report plus a Cure53 app audit plus RAM-only servers plus a clean incident history is a fundamentally different trust posture than any single line item.

The Real-World Test: Seizures, Subpoenas, and Raids

Audits are rehearsals. History provides the live performances, and the industry’s most instructive lessons come from moments when authorities tested no-logs claims by force.

ExpressVPN, Turkey (2017). Investigators seized an ExpressVPN server during a high-profile criminal case and found nothing usable — the architecture simply had no stored records to surrender. The incident predates the modern audit era, yet it remains the canonical proof that no-logs can be structural rather than rhetorical.

Private Internet Access, US courts (2016, 2018). Twice subpoenaed, twice able to produce only the fact that it had no responsive records. Courtroom validation carries evidentiary weight no commissioned report can match.

Mullvad, Sweden (2023). Police arrived with a search warrant; they left without taking anything after being shown that no customer data existed to seize. Architecture, again, did the talking.

Windscribe, Ukraine (2021) — the cautionary tale. Seized servers contained an unauditored legacy key on disk, theoretically enabling traffic impersonation. No user logs existed, but the incident exposed exactly the kind of operational drift that point-in-time audits can miss. To its credit, Windscribe responded with a full migration to RAM-only, diskless infrastructure and documented the overhaul publicly.

IPVanish (2016) and PureVPN (2017) — the negative proofs. Both provided user-identifying records to US authorities while advertising no-logs policies. These cases created the audit industry; they are why “trust us” stopped being an acceptable answer.

The pattern is unmistakable. Providers whose privacy is enforced by architecture — diskless servers, unjoinable data domains — pass involuntary tests. Providers whose privacy lives only in policy documents fail them. Audits, at their best, verify which category a provider belongs to.

How to Read a No-Logs Audit Like a Professional

Five checks separate an informed reading from a headline skim:

1. Check the date. Privacy researchers treat anything older than 24 months as stale. Infrastructure, staff, and ownership all change; a 2021 audit describes a company that may no longer exist. Annual cadence — the rhythm NordVPN and Surfshark now maintain — is the credible standard.
2. Check the scope. Did auditors inspect live server configurations and deployment pipelines, or merely review policy documents? Does the engagement cover specialty servers and obfuscated infrastructure? Scope paragraphs, not press releases, answer this.
3. Check the standard and the firm. ISAE 3000 (Revised) from a Big Four firm, or a named methodology from a recognized lab (Cure53, Securitum), signals rigor. An unnamed “independent expert” signals marketing.
4. Check availability. Full reports published openly (or at minimum to customers) beat summary blog posts. Be fair here, though: some providers restrict full technical reports for defensible security reasons — the distinction is whether the auditor, standard, window, and conclusion are all verifiable.
5. Cross-reference reality. Search the provider’s name alongside “subpoena,” “raid,” and “seizure.” Then read its transparency report and count how many data requests were answered with “no responsive records.” Audits plus incident history plus transparency cadence form the complete picture; any single element alone does not.

Designing for the Audit: A VPN Development Perspective

For readers on the building side — whether pursuing custom VPN development or evaluating platforms — the audit should shape architecture from day one. Retrofitting auditability into a logging-era codebase costs multiples of designing it in.

Four principles make a VPN app development project audit-ready by construction:

Make the damning join impossible. Billing identities, authentication events, and tunnel traffic should live in systems that share no common key. When auditors ask “could you correlate a user to an activity?”, the winning answer is “the schema forbids it,” not “we choose not to.”

Go diskless where traffic flows. RAM-only servers booting from signed, read-only images turn every reboot into a wipe and every seizure into an anticlimax. Auditors love them because impermanence is verifiable; adversaries hate them for the same reason.

Enforce configuration by pipeline, not policy. Every server should be built by the same automated process from the same audited image. Configuration drift — the Windscribe failure mode — dies when humans cannot hand-edit production nodes.

Log the system, never the user. Operations still needs observability. Aggregate load metrics, anonymized crash reports, and per-node health data provide it without creating subpoena bait. Scoping this boundary precisely is, in our experience, the hardest design conversation in enterprise VPN development — and the most valuable.

Budget reality belongs here too. When founders ask how much does VPN development cost, the audit line item surprises them: a big-firm assurance engagement plus a security audit typically runs $30,000–$80,000, recurring. Factor it in from the start, because in 2026 an unaudited VPN is a product with a ceiling.

Performance architecture and privacy architecture also intersect more than teams expect. Protocol and transport choices — the trade-offs we cover in TCP vs UDP VPN ports — determine what connection metadata even exists to not log. Obfuscation layers like the Shadowsocks VPN protocol add their own data-handling questions that auditors will probe. Even latency-focused products marketed toward the best VPN for gaming audience face the same scrutiny: gamers researching whether — as we explore in can a VPN increase my ping — a tunnel helps or hurts latency are the same users who read audit reports before subscribing. Trust and throughput sell together; every credible best gaming VPN ranking now lists audit status right beside speed tests.

What Audits Mean for White Label VPN Businesses

White label founders inherit their provider’s audit posture — for better or worse. This cuts both ways, so treat it as due diligence, not decoration.

What you inherit: the infrastructure’s no-logs architecture, its audit history, and its incident record. A white label VPN development platform built on RAM-only, audited infrastructure lets a new brand truthfully describe verified-by-design privacy from day one — a claim that would otherwise take years and six figures to earn.

What you do not inherit: your own legal obligations. Your brand publishes its own privacy policy, answers its own regulators, and faces its own app-store reviews. An upstream audit does not cover the analytics SDK you added to the app or the marketing pixels on your website. We have watched partners undermine genuinely clean infrastructure with a chatty third-party crash reporter bolted on at the brand layer.

Three questions every white label buyer should ask a prospective platform:

• Show me the audit. Firm, standard, date, and scope — in writing. “Our infrastructure is secure” is not an answer.
• Show me the architecture. Diskless traffic servers? Separated billing and connection domains? How is configuration enforced across the fleet?
• Show me the incident history. Seizures, subpoenas, breaches — and how each was handled. A well-handled incident (Windscribe-style transparency) can be a stronger signal than a suspiciously spotless record.

At Cure VPN, we hand partners this documentation during onboarding precisely because we would refuse to build on a platform that could not produce it. Our white label VPN compliance checklist walks through the brand-layer obligations — regional privacy law, app-store disclosures, payment compliance — that no upstream audit can cover for you.

Expert Insights from the Cure VPN Team

Field notes from living with audits, rather than reading about them:

Insight 1: The audit finds what your debug logs hid. Our first internal pre-audit exercise surfaced a “temporary” troubleshooting log a well-meaning engineer had enabled on two nodes eight months earlier. Nothing sensitive was in it — but its existence would have been a finding. Since then, log creation on traffic servers requires a signed change ticket that auto-expires in 72 hours. Assume auditors will find the thing you forgot; better yet, build systems where forgetting is impossible.

Insight 2: Interviews expose culture, not just configs. Auditors asked our on-call engineers how they debug connection failures without user data. The team answered fluently because the constraint is real in daily work. Providers that treat no-logs as a marketing layer stumble in these interviews — and experienced auditors notice hesitation.

Insight 3: The re-audit is the real audit. Anyone can prepare a clean snapshot once. Passing again a year later, after feature launches, fleet expansion, and staff turnover, proves the discipline is institutional. This is why we advise partners to discount single, years-old reports heavily and weight audit cadence instead.

Insight 4: Users read audits emotionally; buyers must read them technically. After a competitor’s audit announcement, we watched forum sentiment treat it as a permanent guarantee. Six months later, that provider changed ownership. The audit still described the old company. When we evaluate infrastructure — our own or anyone’s — we date-stamp every trust signal and ask what has changed since.

Insight 5: Design reviews with auditors beat remediation with auditors. Bringing assurance practitioners into architecture discussions before building our multi-hop feature cost a few consulting days. Retrofitting audit-compliant data handling afterward would have cost a rebuild. If you are scoping VPN development in 2026, put “auditor design review” in the plan next to “penetration test.”

Statistics and Data: The State of VPN Auditing (2026)

Citable figures, sources named:

• NordVPN completed its sixth independent no-logs assurance in December 2025, conducted by Deloitte Lithuania under ISAE 3000 (Revised) over a five-week window covering standard, Double VPN, Onion Over VPN, and obfuscated servers. (NordVPN disclosure; Tom’s Guide; TechRadar)
• ExpressVPN has published more than 19 third-party audit reports, the deepest public audit history in the industry. (TechRadar)
• Surfshark released its second Deloitte no-logs assurance report in June 2025, expanding scope across standard, static, and multiport servers. (TechRadar; Surfshark)
• Privacy researchers now treat audits older than 24 months as stale, and the absence of any audit as a disqualifying red flag. (Redact.dev VPN logging analysis, 2025)
• Verified real-world tests of no-logs claims include the ExpressVPN Turkey seizure (2017), PIA subpoenas (2016, 2018), and the Mullvad raid (2023) — each yielding no user data. (Public court records and provider disclosures)
• Counter-examples remain instructive: IPVanish (2016) and PureVPN (2017) supplied user records to authorities despite advertised no-logs policies — the scandals that created the modern audit norm. (US court filings)
• The broader context: the VPN market reaches $86 billion in 2026 with 1.75 billion users worldwide, meaning audit-backed trust now differentiates products in a mainstream market, not a niche one. (The Business Research Company; VPNpro)

One narrative connects these numbers: verification has professionalized. The question buyers ask has shifted from “do you log?” to “who checked, how recently, and what happened when someone tested you?”

Common Mistakes When Evaluating Audits

1. Treating one audit as a lifetime guarantee. It describes a window, not an era.
2. Confusing a security audit with a no-logs audit. Cure53 finding “no critical flaws” says nothing about logging; Deloitte confirming no-logs says nothing about app vulnerabilities.
3. Ignoring scope paragraphs. A “policy review” and a live-infrastructure inspection carry very different weight under the same word, “audit.”
4. Skipping jurisdiction analysis. A pristine audit inside a mandatory-data-retention jurisdiction is a contradiction waiting for a court order.
5. Accepting summaries without verifiable details. Firm, standard, dates, and conclusion should all be checkable.
6. Overweighting a spotless incident history. Providers with zero legal contact may simply be small; a subpoena answered with “no records exist” is stronger evidence.
7. For white label founders: assuming the upstream audit covers your brand layer. Your SDKs, your pixels, your policy — your liability.
8. For builders: scheduling the audit after launch “once revenue justifies it.” By then, architecture decisions that fail audits are load-bearing.

Best Practices for Providers and Buyers

For VPN users:

• Prefer providers with recent (under 24 months), repeated, big-firm or named-lab audits.
• Stack signals: audit + RAM-only architecture + transparency reports + incident history.
• Read the scope; skim the press release last, not first.

For VPN builders and businesses:

• Architect the impossible join: billing, auth, and traffic data must never share a key.
• Deploy diskless traffic servers from signed images; enforce config by pipeline.
• Commission both audit types — assurance for the no-logs claim, security for the apps — and re-audit annually.
• Publish what you can; document why when you cannot.
• Bring auditors into design reviews before major features, not after.

For white label partners:

• Demand your platform’s audit documentation, architecture summary, and incident history in writing.
• Audit your own brand layer: SDKs, analytics, and marketing tools can leak what the tunnel protects.
• Complete a full white label VPN compliance checklist — regional privacy law and app-store disclosures remain yours alone.

Frequently Asked Questions

What is a VPN no-logs audit?

A VPN no-logs audit is an independent verification — typically by firms like Deloitte, PwC, or KPMG under the ISAE 3000 standard — that a provider’s servers, configurations, and operations do not record user activity, IP addresses, or timestamps, as observed during the audit window.

Do no-logs audits guarantee a VPN never logs?

No. Audits provide “reasonable assurance” for a specific point in time. They cannot certify past behavior, future behavior, or what happens under legal compulsion. Repeated annual audits plus RAM-only architecture close most — not all — of that gap.

Which VPNs have passed independent no-logs audits?

NordVPN has passed six assurance engagements since 2018 (PwC, then Deloitte), Surfshark has passed two Deloitte reviews (2023 and 2025), and ExpressVPN has published more than 19 third-party audit reports across security and privacy scopes.

Who performs VPN no-logs audits?

Big Four accounting firms (Deloitte, PwC, KPMG) handle assurance engagements on logging claims, while specialized security labs (Cure53, Securitum, VerSprite) audit application and infrastructure security. Credible providers commission both.

What is ISAE 3000 in VPN auditing?

ISAE 3000 (Revised) is the international standard for non-financial assurance engagements, set by the IAASB. It defines how auditors gather evidence and express opinions, giving VPN no-logs reports a recognized, comparable methodology.

How often should a VPN be audited?

Annually is the credible modern cadence. Privacy researchers generally treat any audit older than 24 months as stale, since infrastructure, ownership, and staff change quickly.

What do no-logs audits miss?

Six things, chiefly: behavior outside the audit window, legal compulsion, unsampled servers (configuration drift), client-app vulnerabilities, upstream observers like data centers and payment processors, and the gap between “reasonable assurance” and absolute proof.

What is a RAM-only VPN server?

A RAM-only (diskless) server boots from a read-only image and keeps all runtime data in volatile memory, so every reboot wipes everything and a physical seizure yields no stored data. Audits frequently verify this architecture because it makes no-logging structurally enforceable.

Has a no-logs claim ever been tested in court?

Yes, repeatedly. Private Internet Access twice told US courts it had no responsive records; server seizures from ExpressVPN (Turkey, 2017) and a police raid on Mullvad (2023) produced no user data. Conversely, IPVanish and PureVPN cases showed logs existing despite no-logs marketing — the failures that made audits standard.

Do white label VPNs inherit their provider’s audit?

Partially. The infrastructure’s audited architecture carries over, but the brand’s own privacy policy, added SDKs, analytics, and legal obligations do not fall under the upstream audit. White label founders must verify the platform’s documentation and separately audit their brand layer.

How much does a VPN no-logs audit cost?

A big-firm assurance engagement plus a companion security audit typically costs $30,000–$80,000, recurring annually. Teams budgeting VPN development should treat it as core infrastructure cost, not optional marketing.

Are audited free VPNs trustworthy?

Rarely audited at all, is the honest answer. Free services monetize somehow — often through data — and independent verification of free-tier no-logs claims remains uncommon. Audit status is one of the fastest ways to separate serious providers from data brokers with apps.

Can I read the full audit reports myself?

Sometimes. Some providers publish full reports openly; others restrict them to customers or share summaries, citing security. At minimum, the auditing firm, standard, engagement dates, and conclusion should be publicly verifiable.

Is a no-logs audit or a real-world seizure better proof?

They answer different questions. An audit proves systematic design under cooperative inspection; a seizure or subpoena proves behavior under adversarial force. The strongest trust cases — and the providers professionals recommend — have both.

Conclusion: Trust Is Architecture, Verified Repeatedly

VPN no-logs audits transformed an industry of promises into an industry of evidence — and that is genuine progress. Still, an audit is a photograph, not a covenant. It captures a system at a moment; only architecture makes privacy durable, and only repetition makes verification meaningful.

Read audits for scope and date, not headlines. Stack them with RAM-only design, transparency history, and courtroom track records. And if you are building rather than buying, design for the auditor from the first schema diagram — because in 2026, provable privacy is not a feature. It is the product.

Key Takeaways

• A no-logs audit verifies a point in time, under ISAE 3000-style assurance — powerful evidence, never a guarantee.
• Coverage is real: live configs, specialty servers, deployment pipelines, staff practices, policy alignment.
• The blind spots are structural: audit windows, legal compulsion, sampling, client apps, upstream observers.
• Real-world tests are the gold standard: ExpressVPN, PIA, and Mullvad passed involuntarily; IPVanish and PureVPN’s failures created the audit era.
• Cadence beats headlines: repeated annual audits (NordVPN’s six, Surfshark’s two) outweigh any single report; anything older than 24 months is stale.
• Builders must design for the audit — impossible data joins, diskless fleets, pipeline-enforced configs — and white label brands must verify what they inherit.

Built to Be Verified — That’s the Cure VPN Standard

Everything this article recommends is how we build at Cure VPN: RAM-only traffic servers, structurally separated data domains, pipeline-enforced configurations, and audit documentation we hand to every white label partner on day one. You get infrastructure engineered to pass inspection — cooperative or otherwise — plus the compliance guidance to keep your brand layer as clean as the tunnel beneath it.

Talk to the Cure VPN team for a free consultation on launching a verifiably private VPN brand, or a technical walkthrough of our audit-ready architecture. In a market where trust is the product, build on infrastructure that has nothing to hide — and can prove it.