No-Logs VPN Policy: Which Records Still Exist and How the Claim Is Tested

A no-logs policy is a written promise by a VPN provider not to record what a subscriber does through the tunnel or store data linking a session to a person. The catch: the provider writes its own definition of "logs", so the phrase rarely means nothing is stored. Activity records are usually excluded, but connection metadata, account details and analytics are another story, and the privacy policy shows which of those survive.

Three layers of VPN records and what each one exposes

Above these layers sits the account itself: email, payment record, support chats. Almost every provider keeps those, and most policies exclude them from the word "logs". Some also hold session details in memory while the tunnel is live and wipe them minutes after disconnect; a good policy states how long.

Why an IP address plus a timestamp can be enough

Investigators often skip browsing history entirely. If the VPN can name the real IP online at 21:14, and a website logs the VPN exit that requested a page in that same minute, the two entries meet through time correlation and the subscriber is identified. A byte counter alone reveals only volume, not behaviour. Two unnamed cases show the risk: after a 2011 court order and in a 2017 US cyberstalking investigation, providers that had promised not to track activity still handed over stored connection IPs and timestamps that pinned down a user.

What "no logs" in an advert leaves out

Marketing copy targets activity, since that is the easiest part to drop. Keeping the service alive requires some state: while the tunnel is up the server knows your address, the device limit requires counting active sessions per account, and apps report crashes. Payment processors and support chat tools may hold their own records under separate policies. And in some countries a judge can order a provider to start logging one named subscriber going forward, which no past audit can rule out.

Four ways a no-logs claim gets tested

Independent audits

An outside firm inspects servers, configuration and procedures and reports whether identifying data is kept, but the result covers one point in time; the site's glossary entry on no-logs audits explains what such a report contains.

RAM-only servers

Servers running from memory leave nothing after a reboot or a seizure. They do not stop logging while the machine runs, so treat this as one layer, not proof.

Court cases and seized servers

A subpoena, warrant or seized server that yields no user data tests the claim under real pressure. In the site's data, OVPN won a court case over an information injunction, which counts as the claim holding up in practice.

Transparency reports

A published report shows how many legal requests arrived and in how many cases data was handed over. For a provider keeping nothing, that figure should read zero. A warrant canary, a regularly renewed statement that no gagged order has arrived, is a related signal.

Lines in a privacy policy that decide the question

• An explicit list of what is collected, stating connection IP, session times and bandwidth or denying it.
• A retention period per item. UK guidance on the storage limitation principle requires organisations to justify how long personal data is kept, so "temporarily" without a number is a warning sign.
• Who data is shared with: payment processors, analytics kits, support chat tools.
• What the provider can hand over to law enforcement.
• The legal entity, where it is incorporated and when the policy was last revised.

When deletion happens "after the session", look for minutes or hours; when data is "anonymised", check what is removed (account ID, source IP).

No-logs claims across the VPNRadarLab main ranking

Of the 377 services with enough published data in the main ranking, 303 state a no-logs policy, 35 have an independent audit, only 3 have the claim proven in practice, and 91 privacy policies admit they keep session times. Where the data says "not stated", the provider does not publish that point; it is not a "no". For a sorted shortlist with scores, see the no-logs VPN ranking.

FAQ

Is any VPN completely free of logs?

No. Live sessions and billing require some records; what matters is how briefly they are kept and whether they can be tied to your account.

Can a court force a no-logs VPN to start logging?

In some countries, yes, for one identified subscriber going forward. That is why the home jurisdiction matters even after a clean audit.

Does a no-logs policy cover the VPN's website and apps?

Usually not. Trackers on the site and analytics inside the app fall under different sections of the document, so read those too.

The no-logs promise in brief

The label means whatever the provider's definition says. Before trusting it, check a written list of collected items with a retention period for each, an outside audit, and a transparency report showing requests answered without data. A court demand or seized server that produced nothing seals the picture. Without at least two of these, you are relying on advertising.