What Does 'No-Logs' Actually Mean for a VPN?

A "no-logs" (or "zero-logs") VPN is one that says it does not keep records of what you do while connected — which sites you visit, your real IP address, or the timestamps that could tie activity back to you. It matters because the VPN provider is the one party that can see your traffic, so its logging policy decides whether your history exists anywhere to be handed over, leaked, or sold.

"No-logs" printed on a homepage is a promise, not proof. The thing that turns it into evidence is an independent audit you can read, with a date on it.

What a genuine no-logs policy should cover

Not all logs are equal, and the word alone hides a lot. A meaningful no-logs policy should be clear that it keeps no records of the things that could identify you or your activity:

• Activity logs — the sites and services you connect to. These are the ones that matter most, and a real no-logs VPN keeps none.
• Connection logs — your real IP, the VPN IP you were assigned, and precise timestamps. Kept together, these can de-anonymise you even without activity logs.
• Some minimal, aggregate data (like total load per server) is normal and usually harmless — the test is whether anything is tied to an individual user.

Why independent audits are the real signal

Because you can't inspect a provider's servers yourself, the credible substitute is an independent audit: a reputable outside firm examines the systems and configuration and publishes what it found. A handful of firms do this work at a level the security community takes seriously — including PwC, KPMG, Deloitte, Cure53 and Securitum. What you're looking for is a report that is recent, names the auditor, and describes what was actually checked, not a vague badge.

Several major providers do publish repeated audits. Proton VPN, for example, has passed independent no-logs audits several years running (its recent reviews were carried out by Securitum), and NordVPN has had its no-logs setup examined multiple times by firms including PwC and Deloitte since 2018. Mullvad goes a step further on the design side — it lets you sign up with no email and pay in cash, so there's less identifying information for it to log in the first place, and it runs regular third-party audits. These are facts about their published practices as of September 2026; always check the current report yourself, because audits are snapshots in time.

Jurisdiction and RAM-only servers

Two related details often come up. Jurisdiction is the country a provider is based in and the laws that can compel it to hand over or start collecting data — a genuine no-logs policy limits what there is to hand over, but the legal setting still matters. RAM-only (or "diskless") servers are designed so that everything is wiped on every reboot and nothing is written to a permanent disk; the idea is that even a seized server holds nothing. Both are supporting evidence, not guarantees on their own.

The honest bottom line

No-logs is the most important promise a VPN makes and the hardest for you to verify, which is exactly why an independent, dated audit should be non-negotiable. But remember what it does and doesn't buy you: even a perfect no-logs VPN doesn't make you anonymous — it just means your history isn't sitting on the provider's servers. We're blunt about that limit in do VPNs make you anonymous, and we fold audits into the broader checklist in what a VPN is.

The strongest proof: real-world tests

An audit is a planned inspection; the most convincing evidence is unplanned. Over the years, a few no-logs providers have been put to the test when authorities seized servers or demanded data — and had nothing meaningful to hand over, because there genuinely were no logs to produce. Those episodes are worth more than any marketing claim, because they show the policy holding up under exactly the pressure it exists to withstand.

This is also where jurisdiction and design come together. A provider can only hand over what it has, so a genuine no-logs setup limits the damage of any demand — but a provider based somewhere that can force it to start logging quietly is a weaker proposition than one that can't. The combination to look for is a no-logs policy, an independent audit confirming it, and ideally a track record of that policy surviving contact with the real world.

Red flags in a logging policy

Because "no-logs" isn't a regulated term, the wording of a privacy policy tells you a lot. A few things should give you pause: vague promises with no audit to back them; a policy that says it keeps no "activity" logs while staying quiet about connection logs and timestamps; and a free service that can't explain how it pays for its servers. Any one of these doesn't automatically mean a provider is dishonest, but together they're a signal to look harder.

It's also worth reading past the headline. Some providers keep minimal, aggregate data — the total load on a server, say, or the number of active connections — and disclose it plainly; that's normal and not a concern, because none of it is tied to an individual. The problem cases are the ones that are either evasive about connection data or contradicted by their own fine print. A policy that's specific, plainly written, and matched by an audit is the reassuring combination.