look, had a client ask about using their corporate vpn setup for some personal browsing. lmao. pulled the access logs they sent over for a security review. the metadata collection is insane - internal ips, timestamps down to the millisecond, dns queries held for 90 days. consumer vpns scream 'no logs' but you never really know. corporate ones? they log everything, it's the point. the dry humor is that the corp one is probably more secure technically but you're trading that for being the most interesting entry in an audit spreadsheet. your personal vpn might leak, their firewall definitely records you. i'll believe a consumer vpn's privacy claims when i see a real audit csv. but with the corporate stuff, the data is already there, staring back at you. just not in a good way.