What Is a VPN No-Log Policy and How to Verify Claims

A no-log policy is a VPN's promise not to record what you do online. Almost every VPN makes this promise, so the useful question is which logs it means, and whether anyone has checked.

What "no logs" usually covers

• Activity logs: the sites you visit, your DNS lookups and the content of your traffic. A trustworthy no-log VPN keeps none of these.
• Connection logs: when you connected, for how long, how much data, your real IP address and the server you used. Policies vary a lot here. Some keep nothing; others keep some of it for a short time "to run the service".
• Account data: your email and payment details. Some VPNs let you pay in cash or crypto with no email, which leaves almost nothing to hand over.

Read the privacy policy itself, not the homepage. Look for exactly what's collected, how long it's kept, and whether it's tied to your account.

How to verify the claim

1. Independent audits. Several large VPNs pay audit firms or security companies to check their no-log claims and publish the reports. Look for a recent audit (within the last year or two) that covers the servers, not just the policy wording.
2. Real-world tests. The strongest evidence is when authorities came asking and there was nothing to give. When Turkish authorities seized an ExpressVPN server in 2017, no user logs were found. When Swedish police arrived at Mullvad's office with a search warrant in 2023, they left without data, because none was stored.
3. RAM-only servers. Servers that run from memory, with no hard drives, lose everything when they restart. Many providers now use them.
4. Transparency reports. Some providers publish how many legal requests they got and what they could provide.
5. Ownership and jurisdiction. Know who owns the VPN and which country's laws apply. Several well-known VPN brands belong to the same few parent companies.

Red flags

• Free VPNs with no clear business model. If you're not paying, your data may be the product.
• Vague wording like "we don't log anything that identifies you", with no detail.
• No audits, no named company behind the service, or a policy that changed quietly.

A no-log VPN is only part of the picture

Even the best no-log VPN can't help if your browser leaks your real IP address. WebRTC, which powers video calls in the browser, can reveal it. WebRTC Privacy Shield stops that leak in Chrome, and free leak tests show whether your setup is safe. Sites can also still track you through cookies and accounts you sign in to. See do you actually need a VPN?