No-logs policy

A no-logs policy, also called a zero-logs policy, is a VPN provider's promise that it does not collect or store records that could tie your identity to what you do online. When you connect, your traffic passes through the provider's servers, so the provider is in a position to see a lot. The policy describes what it chooses not to keep.

The policy is a legal and operational document, not a technical feature you can switch on. Its value depends on how precisely it is written, how the infrastructure is built, and whether anyone outside the company has checked it.

What a no-logs VPN should not keep

A strict policy covers two groups of data.

Activity logs show what you did: websites and domains visited, DNS queries, files downloaded, apps used. No reputable VPN should keep these.

Connection logs show how and when you used the service:

• Your real IP address when you connect
• The VPN IP address assigned to you
• Connect and disconnect timestamps
• Session duration
• Bandwidth used per session

Connection data is where policies differ most. Some providers keep nothing tied to an account. Others keep short-lived or aggregated data, for example total bandwidth per server or a count of active sessions to enforce a device limit. Aggregated, anonymous data is usually acceptable. Any record that combines a user ID with an IP address and a timestamp is not, because that combination can identify you.

What a no-logs policy does not cover

Every provider still holds some account data. This normally includes an email address, payment records and subscription status. If you pay by card, the payment processor also has a record. Some providers reduce this by offering anonymous account numbers instead of emails and accepting cash or cryptocurrency.

The policy also does not protect you from what you reveal yourself: logged-in accounts, browser fingerprinting, cookies and tracking by the websites you visit. A VPN hides your IP from sites and your traffic from your ISP, it does not make you anonymous.

How providers back up the claim

A no-logs statement is only as good as the evidence behind it. Common forms of proof:

• Independent audits. Firms such as Deloitte, PwC, KPMG, Cure53 or Securitum review server configurations and internal processes. Check the date and scope: an audit from several years ago, or one that covered only part of the network, says less.
• RAM-only servers. Servers that run entirely in memory lose all data on reboot, which makes accidental or forced retention harder.
• Court cases and seizures. Some providers have faced subpoenas or server seizures and had nothing to hand over. In 2023, Swedish police visited Mullvad's office with a search warrant and left without data, because none was stored.
• Transparency reports and warrant canaries. Regular reports on how many legal requests were received and how they were answered.
• Open-source apps. Published client code lets researchers check what the apps send. See open-source.

Jurisdiction and legal limits

Where a company is incorporated and where its servers sit both matter. Some countries have data retention laws that can force providers to log. In 2022, India's CERT-In rules required VPN providers to keep user data for five years, and several major VPNs removed their physical servers from India in response. Membership in intelligence-sharing alliances such as Five Eyes or Fourteen Eyes is often cited, though a well-built no-logs setup matters more than location alone, because a provider cannot hand over data it never stored.

A provider can also be ordered to start logging a specific user going forward. A policy cannot rule this out completely, which is why audits, RAM-only infrastructure and a track record count for more than wording.

What to check when comparing VPNs

Free VPNs deserve extra scrutiny, since a service that earns nothing from subscriptions may earn from data. Read the privacy policy, not only the marketing page.

A no-logs policy works best alongside other protections: a kill switch stops traffic leaking if the tunnel drops, and private DNS keeps your DNS lookups inside the encrypted connection instead of sending them to your ISP.