Key takeaways
- A VPN can see everything you route through it. “No-logs” means it chooses not to record any of it, because data never stored can’t be leaked, sold, hacked, or subpoenaed.
- Activity logs (browsing, DNS, real IP) are the dealbreaker. Aggregate, anonymised connection logs are normal. Logs tied back to you are not.
- The slogan proves nothing on its own. Look for a recent independent audit, RAM-only servers, a clear jurisdiction, and minimal sign-up data.
Here’s the uncomfortable starting point: a VPN sees more of your traffic than your ISP does, because everything you do is routed through its servers. A “no-logs” policy is the provider’s promise not to write any of that down. Whether the promise is worth anything depends entirely on details the marketing page won’t tell you, so this guide is about finding them.
What a VPN can technically see
When you’re connected, the provider’s servers handle:
- The sites and services you connect to (and the DNS lookups that resolve them).
- Your real IP address and the VPN IP you’re assigned.
- When you connect, for how long, and how much data you move.
A genuine no-logs VPN deliberately discards this. The point isn’t that they’re saints. It’s that data they never store can’t be leaked, sold, hacked, or subpoenaed.
The two kinds of logs (only one is the dealbreaker)
| Log type | What it records | Verdict |
|---|---|---|
| Activity logs | Your browsing, downloads, DNS queries, real IP | The dangerous ones. A real no-logs VPN keeps none. |
| Connection logs | Timestamps, session length, bandwidth, which server you used | Some providers keep aggregate, anonymised versions to manage capacity. A little is normal. Logs that can be tied back to you are not. |
The standard you want: no activity logs, and no connection logs that identify an individual. When a policy says "no-logs", that's the bar it has to clear.
How to actually verify it
Stop reading the slogan. Look for evidence:
- An independent audit. Reputable providers pay outside security firms to inspect their servers and configs, then publish the report. Note what was audited and when.
- RAM-only (diskless) servers. If the infrastructure runs entirely in memory, every reboot wipes it. There's physically no disk for logs to persist on. It's a strong architectural signal, not just a promise.
- Jurisdiction and ownership. Know which country the company answers to and who owns it. Some jurisdictions can legally compel data retention or gag orders.
- Real-world tests. The strongest proof is a case where authorities demanded data and the provider genuinely had nothing usable to hand over.
- Minimal sign-up data. If you can register with just an email (no name, no extra detail), there's simply less to leak or hand over in the first place.
Audits age. A one-off audit from years ago is weaker than a recent, repeated one. Check the date and the scope before you give a provider credit for it.
What “no-logs” does not buy you
This is where people over-trust the label. A no-logs VPN hides your activity from the VPN company. It does not:
- Make you anonymous to sites you log into. You've identified yourself.
- Stop browser fingerprinting or cookies.
- Protect you from malware already on your device.
Treat it as one strong privacy layer, not an invisibility cloak.
The bottom line
A no-logs claim is only as good as the proof behind it. Favour providers that back it with a recent independent audit, RAM-only servers, a clear jurisdiction, and minimal sign-up data. And be sceptical of any that offer the slogan and nothing else.
Every provider in our rankings runs a strict no-logs policy, which is exactly why privacy is a level field there and the real differences come down to price, speed, and features.