No-Logs Policy
BeginnerA VPN provider's promise not to record what you do through its servers — ideally proven by independent audits and real-world legal tests, not just marketing.
In depth
A no-logs policy claims the provider keeps no record of your browsing activity, connection timestamps, source IP, or bandwidth attributable to you. It is the single most quoted phrase in VPN marketing — and the single most abused, because every byte of your traffic passes through hardware the provider controls. The policy is a promise about restraint, and promises vary wildly in credibility.
What logs actually mean
- Activity logs: sites visited, DNS queries, traffic contents. No serious privacy VPN keeps these.
- Connection logs: your real IP, assigned VPN IP, session start/end. These are what de-anonymize users in subpoenas — the meaningful part of any no-logs claim.
- Aggregate diagnostics: anonymous server load and crash stats. Generally harmless and openly kept by most providers.
How to verify a claim
- Independent audits: recurring assessments by firms like Deloitte, KPMG or Cure53 that inspect servers and configurations — one-off audits age fast.
- Court evidence: the gold standard — cases where authorities demanded logs and the provider had nothing to hand over.
- RAM-only servers: infrastructure that cannot persist data across a reboot makes logging architecturally harder.
- Jurisdiction: where the company answers subpoenas matters less than its architecture, but data-retention-friendly bases deserve extra scrutiny.
Reality check
Free VPNs with no-logs slogans monetize somehow — several have been caught selling exactly the data they swore not to keep. Treat unaudited claims as decoration.
Examples
- A provider passes its fourth annual Deloitte audit verifying that connection logs are never written to disk.
- A subpoenaed VPN produces nothing usable in court because its RAM-only servers held no historical data.
- A free VPN's privacy policy fine print reveals it logs and sells browsing categories to advertisers despite a no-logs homepage banner.
Common use cases
FAQs
Not absolutely — you cannot prove a negative about someone else's servers. The strongest available evidence is recurring independent audits combined with court cases where the provider demonstrably had nothing to surrender.
Less than marketing suggests. A provider that genuinely keeps nothing has nothing to hand over regardless of jurisdiction; architecture beats geography. Jurisdiction matters most when policies are weak or unverified.
Almost all keep minimal operational data — aggregate server load, payment records, crash reports. The line that matters is whether anything can tie a specific user to specific traffic at a specific time.