The kinds of data a VPN could log
- Activity logs: websites visited, DNS requests, files downloaded. A privacy VPN should never keep these.
- Connection logs: your real IP address, connection times, the server used, data transferred. Strong no-logs VPNs avoid storing anything that links a session to you.
- Account data: email, payment records and support tickets. Most providers keep some of this to run the service. A few let you sign up with only an account number and pay in cash or cryptocurrency.
- Aggregate data: such as total load on a server, which can’t identify individuals.
How independent audits work
Several providers have hired outside security and accounting firms to check their no-logs claims. Audits vary a lot, so read the report or summary and check:
- Scope: was it the privacy policy, the server infrastructure, the apps, or all of them?
- Date: an audit is a snapshot. Recent and repeated audits are more reassuring.
- Access: did auditors inspect live servers and configurations, or rely on interviews and documents?
Real-world events can also be evidence: some providers have had servers seized or received legal demands and been able to show that no user data was stored.
Infrastructure that supports no-logs
- RAM-only (diskless) servers: run from memory, so data is wiped on reboot and nothing is written to a hard drive.
- Owned vs rented servers: providers that control their hardware rely less on third-party data centres.
- Open-source apps: anyone can inspect the code.
Jurisdiction and ownership
A VPN company must follow the laws where it’s based and where its servers are. Some people prefer providers outside the “Five Eyes”, “Nine Eyes” or “Fourteen Eyes” intelligence-sharing alliances, though a genuinely log-free service has little to hand over wherever it’s based. Ownership matters too: check who owns the brand, because several well-known VPNs share a parent company.
Last updated: 13 October 2026
