A no-logs policy is a commitment by a VPN provider not to retain records of user activity (which sites you visit, when, from what IP). It's a privacy claim that can be true or false depending on the provider's actual technical architecture.
What "logs" can mean
VPN providers can keep several kinds of records:
- Activity logs β which sites you visited, what DNS queries you made, what data you transferred. The most sensitive category.
- Connection logs β when you connected and disconnected, your real IP, the server you used. Less sensitive but still potentially identifying.
- Diagnostic logs β aggregate performance data, anonymized error reports. Usually fine from a privacy standpoint.
- Account logs β your email, payment info, support tickets. Operational, but linkable to you.
"No-logs" usually means no activity logs and no connection logs. Account logs are usually retained for operational reasons but minimized.
Why it matters
If a VPN provider keeps logs, those logs can be:
- Subpoenaed by law enforcement.
- Stolen in a breach.
- Sold to data brokers (in the case of sketchy providers).
- Used internally to monetize user behavior.
A genuine no-log architecture means none of these are possible β the data simply doesn't exist to be exposed.
How to verify a no-logs claim
Independent audits
Reputable third-party firms (Cure53, KPMG, Deloitte, PwC, Securitum) review the provider's actual systems and publish reports. Notable audits in recent years:
- Mullvad β multiple Cure53 audits.
- ExpressVPN β PwC and KPMG audits.
- NordVPN β Deloitte audits.
- ProtonVPN β Securitum audits.
Court records
When providers have been compelled to disclose user data, what they can and can't produce is documented. Examples:
- Mullvad: police raid in 2023 left with nothing because there was nothing to seize.
- ExpressVPN: 2017 Turkey case β couldn't produce requested data.
- Private Internet Access: 2016 FBI case β couldn't produce requested data.
Technical architecture
Providers that genuinely don't log can describe their systems in ways that make logging structurally impossible: RAM-only servers, immutable container images, no shared storage for traffic data.
Common misconceptions
- "No logs" doesn't mean no data. Account data, billing info, and aggregate analytics may still exist.
- "Audited" doesn't mean infallible. Audits are point-in-time snapshots; providers can change configurations between audits.
- Marketing claims aren't audits. A provider saying "no logs" on their homepage means very little without external verification.