What Is a No-Logs VPN? How to Read a Logging Policy

Almost every VPN seller uses some form of the phrase "no logs". It sounds like a guarantee, and many buyers treat it as the single most important feature. In reality it is a claim, and claims vary a great deal in what they cover, how precise they are and whether anyone has checked them.

This article is educational. It explains what logs are, what a no-logs claim can and cannot tell you, how to read a VPN logging policy line by line, and what audits and transparency reports actually prove. It is not a statement about the logging practices of any particular service. Whichever service you use, read its own privacy policy and terms.

What "logs" means in a VPN context

A log is simply a record. Servers, apps and networks create records constantly, for good reasons such as fixing faults and for less comfortable ones such as profiling users. When people talk about a VPN keeping or not keeping logs, they usually mean several different kinds of data bundled together.

Connection logs (metadata). These describe the fact that you connected: the time you connected and disconnected, how much data moved, which VPN server you used, and perhaps the original IP address you connected from. Even without any record of the sites you visited, connection logs can show when someone was online.

Activity or usage logs. These describe what you did while connected: websites or domains visited, DNS queries, files downloaded, apps used. These are the most sensitive records, and they are what most people mean when they ask whether a VPN "logs".

Diagnostic and error logs. Software crashes and fails, and engineers need information to repair it. Short-lived technical logs about errors are common. The question is what they contain and how quickly they are deleted.

Account and payment records. The seller usually keeps an email address, an order history and payment confirmations, because it must deal with billing, refunds and legal obligations. These are not browsing logs, but they connect your identity to a purchase.

Aggregate statistics. Counts such as total bandwidth on a server help with capacity planning. When they are properly aggregated they do not point at individuals, but a policy should say so.

Seeing these categories separately is the first step to reading any policy. A provider might truthfully say it keeps no activity logs while still keeping connection timestamps for a short time. Neither sentence is lying; they simply describe different things.

What a no-logs claim does and does not tell you

A no-logs claim says that the provider does not keep some defined set of records about its users. It does not by itself tell you which records, for how long, or how anyone could confirm it. The table below shows the gap between a typical claim and what you would want to know.

The claim says	What it leaves open
We keep no logs	Which logs? Activity only, or connection data too?
We do not track your activity	Is connection metadata, such as timestamps, kept?
We delete data immediately	How is "immediately" defined, and where is it written first?
Independent audit passed	Which audit, what scope, when, and is the report public?
We have never received a valid request	Is there a published transparency report to back this?

None of these gaps means the provider is dishonest. They show why the label alone is not enough and why the details matter.

Why logging matters at all

It helps to be concrete about the risks, so that you weigh them sensibly rather than emotionally.

• Data breaches. Records that exist can leak. A provider that never stores something cannot lose it.
• Legal requests. A provider can be required by a court or authority in its jurisdiction to hand over what it holds. If the data does not exist, there is less to hand over.
• Insiders and misuse. Staff or contractors with access to detailed records are a risk in any organisation.
• Commercial use. Some free services earn money by using or selling data about their users. This is a major reason to check how a free VPN is funded.

The point of a VPN is to move trust. Without one, your internet provider or the Wi-Fi operator can see where your traffic goes. With one, that visibility shifts to the VPN provider. A logging policy is the provider's statement of how it intends to handle that trust. The VPN protection article explains what is shifted and what is not.

How to read a VPN logging policy

A policy is a document, and you can read it critically in a few minutes. Work through these questions.

1. Does it list specifics, or only slogans?

Good policies name what is collected and what is not: IP addresses, timestamps, DNS requests, bandwidth, session length, device identifiers. A policy that only says we value your privacy is marketing, not a policy.

2. Does it separate connection data from activity data?

Look for both. If the text speaks only about browsing activity and says nothing about connection times or your original IP, the gap is worth a question to support.

3. Does it give retention periods?

"We do not keep it" is different from "we keep it for 24 hours". Both can be reasonable, but the second is more precise. Be wary of phrases like as long as necessary without a figure.

4. Does it cover the app and website too?

The VPN tunnel is one thing. The sales website, the app, support tickets and crash reporters may collect their own data, such as analytics and device information. A thorough policy covers these as well.

5. What does it say about payment and account data?

You can expect an email address and order records to exist. A policy should explain which payment information is kept by the seller, and which is held by the payment processor. For example, a card payment may be handled entirely by a processor, so the seller never sees your full card number.

6. Who is the data shared with?

Look for the words third parties, partners and affiliates. Ask whether any are advertisers or analytics providers.

7. How does it handle legal requests?

A clear policy says what the provider does when it receives a valid request and whether it publishes information about such requests.

8. Is it dated and versioned?

A policy that carries a date and keeps older versions available is easier to trust than one that changes silently.

Audits explained: what they prove and what they do not

The words VPN audit appear on many sales pages. In practice the term covers several quite different activities, so it helps to know the main types of VPN security audit.

Audit type	What it examines	What it can show
Logging or policy audit	Whether systems and settings match the stated logging policy	The provider's setup matched its claims at the time
Infrastructure audit	Servers, configuration, access controls	How the service is built and run
Application security audit	The apps and code, often through penetration testing	Whether known classes of software flaws were found
Protocol or cryptography review	The connection protocol and its use of encryption	Whether the design and implementation are sound

Whenever you see an audit mentioned, ask a handful of questions.

1. Who did it? Is the firm independent of the provider, and does it have a track record?
2. What was the scope? A review of a few servers is not a review of everything. Scope is usually stated in the report summary.
3. When was it done? Systems change. An audit from several years ago says little about today.
4. Is the report public? A published report, or at least a published summary, is easier to evaluate than a logo and the word audited.
5. Were problems found and fixed? A report with findings that were later resolved is often more convincing than a spotless one with no detail.

An audit is a snapshot. It does not prove the provider will behave the same way next year, and it does not prove that nothing was changed after the auditors left. It is still useful evidence, much better than an unsupported slogan.

Transparency reports

A transparency report is a periodic publication that lists the number and type of legal requests a provider received and how it responded. It helps in two ways: it shows whether a provider is willing to publish information about its own conduct, and it shows what happens when the provider is asked for data. Reports that are regular, detailed and dated are more useful than a single page that was never updated.

Three policy snippets, read critically

These made-up examples show the kind of reading that helps. They do not quote any real service.

Snippet A: "We take your privacy very seriously and never sell your information." This says what the seller does not do with data. It does not say what is collected or for how long. Not selling data is good, but it is not the same as not keeping it.

Snippet B: "We do not store browsing history, DNS queries or traffic contents. Connection timestamps and the originating IP address are removed when the session ends. Account and payment records are kept for as long as the law requires." This is specific. It lists categories, says what is deleted and when, and admits that some account data is retained. You can still ask support how session data is handled in practice, but the text is a workable starting point.

Snippet C: "Limited diagnostic data may be collected to improve the service." This is vague. Which data, for how long, and shared with whom? Ask questions or look for the fuller version in the privacy policy.

Notice that the most honest sentences are often the least flattering ones. A policy that admits some data is kept, and says why, usually deserves more trust than one that promises everything is erased.

Limits and what to watch for

Even the best logging policy has boundaries, and understanding them keeps your expectations realistic.

• It only covers the provider. Websites you visit keep their own records. Apps on your phone talk to their own servers. If you log in to an account, the service knows who you are no matter what the VPN does.
• A VPN does not make you anonymous. Reducing what one party can record is not the same as being anonymous. See can a VPN make you anonymous for the reasoning.
• A policy is a promise, not a mechanism. Unless something can be checked, you are trusting the provider's word and its legal setting. This is why audits and transparency reports help even though they are imperfect.
• Jurisdiction matters, but not simply. The rules a provider must follow depend on where it is based and where it operates. Do not assume that one country is automatically safe or unsafe; read what the provider says about legal requests.
• Free services deserve extra scrutiny. If you do not pay, ask how the service earns money. The answer may involve your data.
• Your device is a log source too. Browser history, app caches and operating system records exist on your own phone or laptop. Private browsing and a VPN address different things, as explained in common VPN security myths.

A short checklist before you trust a logging claim

1. I can name the categories of data the provider says it does not keep.
2. I know whether connection metadata is mentioned.
3. Retention periods are stated, not hinted at.
4. The policy covers the app, the website and support, not just the tunnel.
5. Any audit has a named firm, a scope, a date and a public summary.
6. There is a transparency report or a clear statement on legal requests.
7. The wording admits limits instead of promising perfection.
8. I understand that the claim still does not make me anonymous.

If you cannot tick most of these, that is not proof of anything bad, but it is a reason to choose a shorter commitment and keep your expectations modest. The wider pre-purchase checklist covers billing, refunds and support alongside privacy.

Summary

A no-logs claim is a statement by a VPN provider about the records it does or does not keep, and it can mean very different things. Learn the types of logs, read the policy for specifics, retention periods and scope, and treat audits and transparency reports as useful but limited evidence that apply to a stated scope and a point in time. Remember that no logging policy covers the websites you use, your device or your own accounts.

If you want a simple, fixed-length VPN pass with no automatic renewal while you evaluate any provider's privacy terms for yourself, the pricing page shows how our passes work.