What is a no-log VPN policy, explained

It is every provider’s number-one selling point: “no-log policy,” “zero logs,” “we know nothing about you.” But what does a no-log VPN policy actually mean, and more importantly, how do you know it holds up? A VPN shifts trust away from your internet provider and onto the VPN company, which necessarily sees your traffic pass through its servers. The whole question is what it keeps. Here is what no-log really covers, the crucial difference between types of logs, and how to check that a provider is not spinning a story.

What exactly is a no-log VPN policy?

A no-log policy, also called a “zero-logs” policy, is a VPN provider’s commitment to not record or retain the data that could tie an online activity back to a specific user. In practice, a genuinely no-log service keeps neither the list of sites you visit, nor your originating IP address, nor detailed timestamps of your sessions. Here is how a credible absence of logs is built, technically.

In other words, a credible no-log policy rests on three pillars: a clear commitment, an architecture that allows it, and independent proof. If any of the three is missing, caution is warranted.

Connection logs or activity logs: the difference that changes everything

Not all “logs” are equal, and this is where a lot of marketing keeps things blurry. You need to tell two broad families of logs apart.

Activity logs (usage logs) are the most sensitive: they record what you do, namely the sites and apps you open, your DNS queries, downloaded files and browsing history. A VPN that keeps this kind of data is disqualified for privacy on the spot, because this is exactly what a VPN is supposed to hide.

Connection logs cover session metadata: connect and disconnect timestamps, originating IP address, the IP of the server used, and the volume of data exchanged. Taken together and stamped to the second, they can be enough to re-identify a user. Some providers keep an aggregated and anonymized version (total connection counts, server load) to run their network, which is generally acceptable, as long as that data can never be linked back to an individual.

Why independent audits matter so much

A provider can write “no-log” in big letters on its homepage: none of it is binding until a third party has checked. That is the whole point of the independent audit, run by an external firm that inspects the servers, configuration and internal processes, then publishes a report. There are generally two levels: the security audit (hunting for flaws) and the no-log assurance audit (confirming no sensitive data is retained), the one that matters most for privacy.

The most transparent providers now publish these reports regularly. A few benchmarks verified in mid-2026:

Why the provider’s jurisdiction tips the scales

A no-log policy that looks perfect on paper can be undermined by the country where the provider is legally based. Some states impose mandatory data retention for connection records, or can compel a company to monitor a user, sometimes without being allowed to talk about it. That is why jurisdiction gets so much attention.

People often mention the intelligence-sharing alliances known as the “5/9/14 Eyes”, agreements to exchange information between countries (the United States, the United Kingdom, part of Europe and so on). A provider based outside these zones is seen as less exposed to data requests. This is why many VPNs pick privacy-friendly jurisdictions such as Panama (NordVPN), the British Virgin Islands (ExpressVPN), Switzerland (Proton VPN) or Sweden for Mullvad, which is known for collecting very little.

RAM-only servers, a technical guarantee of no-log

An argument that is increasingly highlighted, and rightly so: servers running entirely in memory (RAM-only). On a traditional server, data is written to a hard drive and stays there, even after power-off. A RAM-only server, by contrast, uses no permanent storage: everything it holds is erased on the next reboot. That makes it impossible to keep durable logs or to seize a drive full of history during a physical raid.

It is a real privacy advantage. NordVPN, ExpressVPN (via TrustedServer) and Proton VPN, among others, have rolled this architecture out across their networks. It makes the no-log promise structurally more credible, because it no longer rests only on the provider’s goodwill, but on a technical constraint.

How do you check a provider’s no-log policy?

You do not need to be a security expert to sort the wheat from the chaff. A simple checklist is enough to rule out hollow promises:

• Read the privacy policy, not just the marketing page. It should clearly state what is not collected (IP, sites, DNS, times) and what may be.
• Look for a recent independent audit, with the name of the firm (Deloitte, KPMG, Cure53, Securitum) and the date. Be wary of the word “audited” with no readable report.
• Check the jurisdiction: where is the company legally based, and does that country impose data retention?
• Look at the architecture: RAM-only servers, modern protocols (WireGuard, or Lightway for ExpressVPN), open-source apps where possible.
• Search for legal precedents: several serious providers have had servers seized without any usable data being found, the best proof of a real no-log policy.

A no-log policy is not something you take on faith: you read it, audit it and verify it.

What a no-log policy does NOT do

The essential honesty check. An audited no-log policy is crucial, but it works no miracles:

• It does not make you anonymous. The provider sees your traffic pass in real time, it simply chooses to keep none of it. A VPN stays a privacy tool, not an invisibility cloak.
• It does not protect you if you identify yourself (Google account, social media, online purchase): the service then knows who you are, logs or not.
• It does not make up for bad habits: weak passwords, no antivirus, clicking on phishing. No-log protects the VPN’s logs, not your machine.
• Ultimately, it rests on trust: even audited, you take the provider’s word that it applies what it declares. Audits and legal precedents reduce that risk, without removing it entirely.