VPN no-log policies: what gets tested and what's just a promise

Every VPN provider’s marketing page says some version of “we don’t log your activity.” That claim means very different things depending on the provider, and almost none of it gets checked the way you’d hope. Here’s what a no-log policy is actually claiming, how it can be tested, and why “no logs” is a much narrower promise than most people assume.

What “no logs” is actually claiming

VPN providers generally split their data into a few categories, and the honest ones say so explicitly. Activity logs cover which websites you visited, what you downloaded, and what you searched for, this is the category most people picture when they hear “no logs.” Connection logs cover timestamps of when you connected and disconnected, how much bandwidth you used, and sometimes which server you picked. Aggregate or diagnostic data covers crash reports, load statistics across servers, and sometimes an approximate count of concurrent users per location.

A “no-log” policy usually means no activity logs. Many providers still keep some connection metadata, at least briefly, to manage server load or debug abuse complaints. That’s a reasonable trade-off, but it’s not the same thing as “we retain nothing about you,” and a policy that blurs the two is worth reading twice.

It’s also worth being precise about what’s technically possible. Routing your traffic requires some ephemeral state, your device has to be matched to an outbound connection for the seconds that packet is in flight. The question is whether that state gets written to a disk, tied to a timestamp, and kept anywhere past the session. Momentary state is a given.

A policy is not evidence

Here’s the part that gets skipped in most comparisons: a no-log policy is a written promise. On its own, it’s not verified by anything except the provider’s word and, in some cases, its jurisdiction’s laws around data retention. Nothing stops a company from publishing “we keep no logs” while running infrastructure that logs by default because nobody configured it otherwise. Nothing stops a company from meaning it sincerely today and changing its mind, or its ownership, next year.

That’s just describing the starting position, and it accuses no specific provider of anything. You’re trusting marketing copy until something independent checks it.

What an audit actually checks

Independent audits are the most common form of verification, and they’re genuinely useful, but they check a narrower thing than people assume. A no-logs audit typically means a third-party security firm reviews server configurations, source code for logging calls, and the actual deployed infrastructure, and compares what they find against the written policy.

What a competent audit can tell you:

• Whether the servers are configured to write persistent logs at all
• Whether the codebase contains logging functions that contradict the stated policy
• Whether the infrastructure matches what the company describes publicly

What an audit can’t tell you:

• What the infrastructure looks like six months after the audit, since configurations change and audits are a snapshot
• Whether every server in every region was covered, since audits often sample a subset
• Whether the company would comply if compelled by a court to add logging going forward, since an audit measures the current state, not future conduct

Diskless or RAM-only server designs are one of the more meaningful technical claims a provider can make, because a server that never writes to persistent storage can’t hand over historical logs even if it wanted to, a reboot clears it. That’s a stronger structural argument than a policy statement, but it still relies on the provider actually running that architecture consistently, which is exactly what an audit is supposed to confirm.

The real test: what happens when someone asks for the data

The closest thing to an actual test of a no-log claim is a real legal request rather than an audit. When a court, law enforcement agency, or government orders a provider to hand over data, or when servers get physically seized as part of an investigation, whatever the provider produces (or fails to produce) is the closest thing to ground truth available. If a provider has nothing to hand over because nothing was ever stored, that event becomes public evidence the policy held up under pressure. If a provider hands over connection data despite having claimed not to keep any, that’s evidence the policy didn’t match reality.

The honest caveat here is that this kind of test is rare. Most VPN providers’ no-log claims have simply never been through this, because no event has forced the question. That means for the overwhelming majority of providers, “no logs” is an audited or unaudited policy, not a policy that’s been stress-tested by an actual legal demand. When you’re comparing providers, it’s worth distinguishing between “has an audit” and “has been through a real request and the outcome is documented,” because those are different levels of confidence.

Warrant canaries, a statement a company updates periodically to indicate it hasn’t received a secret data request, are a weaker signal than either of these. They rely on the absence of an update meaning something, they can be legally risky for a company to maintain depending on jurisdiction, and plenty of providers have quietly dropped them. Treat a canary as a minor supporting detail, not proof of anything on its own.

Jurisdiction shapes what can be demanded, not what’s true

You’ll see a lot of talk about which countries are inside or outside various intelligence-sharing alliances, as if being headquartered in the right country makes a provider safe. Jurisdiction matters, it determines what a government can legally compel a provider to do and how transparently that process happens, but it doesn’t substitute for logging discipline. A provider in a country with weaker privacy law that genuinely retains nothing has nothing to be compelled to hand over. A provider in a country with strong privacy law that retains connection metadata for troubleshooting still has something to hand over if a court orders it. This is a general pattern, not a specific legal claim about any country or company, and it’s not a substitute for actually reading a provider’s policy or your own legal situation if that’s relevant to you.

What a no-log policy does and doesn’t protect against

A solid, audited, ideally tested no-log policy limits what a single company can be compelled to produce about your VPN sessions. That’s a real and useful thing. It is not the same as being untraceable, and no VPN, on its own, makes you anonymous. A few reasons why:

• If you log into an account through the VPN, that site now knows who you are regardless of what the VPN logged.
• Browser fingerprinting, cookies, and device characteristics can identify you across sessions independent of your IP address.
• The VPN provider itself becomes a new point of trust, you’ve shifted who can see your traffic pattern from your ISP to the VPN, not eliminated the possibility of anyone seeing it.
• Sophisticated correlation techniques, matching traffic timing at the entry and exit points of a network, exist and are a known limitation of VPN privacy in general, not something a no-log policy addresses.

All of this is a reason to be precise about what a no-log claim is actually solving for: keeping one company from being a convenient single source of your browsing history, not making you invisible. It is not a reason to avoid VPNs.

A short checklist

When you’re evaluating a specific provider’s claim, a few questions do more work than the marketing page:

1. Does the policy define exactly what “logs” excludes, or is it a vague blanket statement?
2. Has an independent firm audited the infrastructure, and how recently?
3. Did that audit examine deployed servers and code, or just review the written policy?
4. Has the provider ever been party to a legal request or server seizure, and is the outcome documented anywhere credible?
5. Is there a maintained warrant canary, and has it actually been updated recently?

None of these questions gets you certainty. They get you a more honest picture than “no logs, trust us.”

Want more explainers like this that stick to what’s actually verifiable? Head back to The Privacy Wire homepage for the rest of our coverage on VPNs, encryption, and everyday digital security.