Spot on, I've seen plenty of so called audits that are just a badge and some vague docs. If you don't see the logs, test conditions, and protocols laid out in the report then it's pretty much marketing fluff. Trust but verify is the name of the game, especially when dealing with VPNs that claim...