A "no-logs" promise only matters if you understand which logs the provider means and whether you can actually verify the claim. The phrase appears on nearly every VPN landing page, yet it covers wildly different practices. One provider keeps zero records of your traffic. Another quietly stores connection timestamps and bandwidth counts for weeks. Both call themselves no-logs.
So how do you tell the difference? You learn the categories of logs, you read the privacy policy line by line, and you weigh the evidence behind the marketing. This guide breaks down what counts as a log, why some logging persists even at privacy-first companies, and the concrete signals, like independent audits and RAM-only servers, that separate a real no-logs policy from a slogan. If you want the bigger picture first, see our roundup of VPN privacy myths debunked.
Key Takeaways
- "No-logs" is not one thing. There are connection/metadata logs, activity logs, and aggregate diagnostics, and providers treat each differently.
- Activity logs (the sites and content you access) are the highest risk. A genuine no-logs VPN keeps none of these.
- Verify, don't trust. Independent audits, court-case track records, transparency reports, and clear policy wording matter far more than a homepage badge.
- Architecture beats promises. RAM-only servers wipe data on reboot, and single-tenant dedicated servers remove the shared logging infrastructure entirely.
What Actually Counts as a "Log"?
A log is any record a VPN keeps about your session, and the term spans everything from harmless billing data to a complete history of your browsing. That range is exactly why "no-logs" claims confuse buyers. The honest question isn't whether a provider stores any data at all, because every business stores something. The real question is which data, for how long, and whether it can be tied back to you.
Think of logs on a spectrum of sensitivity. At one end sits account information: your email and payment method, which any service needs to operate. In the middle sit connection records, the metadata about when you connected and how much you transferred. At the far end sit activity logs, the actual contents and destinations of your traffic. A provider can truthfully say "no-logs" while keeping data from the first two buckets, which is why the wording deserves scrutiny.
The term "no-logs" describes a spectrum, not a single standard. Every VPN stores account and billing data to operate, but a genuine no-logs provider retains zero activity logs (the destinations and contents of your traffic) and discards connection metadata rather than building a profile that could be tied back to an individual user.
What Are the Three Types of VPN Logs?
VPN logs fall into three categories, and the distinction decides how much privacy you actually get. Connection metadata records when and how much you used the service. Activity logs record what you did. Aggregate diagnostics record server health with no link to individuals. Mixing these up is the single most common reason buyers misread a privacy policy.
Here's the breakdown most marketing pages skip:
| Log type | What it can contain | Privacy risk |
|---|---|---|
| Connection / metadata logs | Connection and disconnection timestamps, session duration, bandwidth used, your originating IP address, the VPN IP assigned | Medium to high. On its own it doesn't reveal sites, but timestamps and source IPs can deanonymize you when correlated with other records. |
| Activity / traffic logs | Websites and services visited, DNS queries, file contents, the data inside your tunnel | Severe. This is a full record of your online behavior and the category a real no-logs VPN must never keep. |
| Aggregate / diagnostic logs | Total server load, anonymized crash reports, combined bandwidth across all users, uptime stats | Low. When properly anonymized and not tied to any account, this poses little risk and helps keep servers running. |
In our experience reviewing privacy policies, the giveaway is how each category gets described. Vague providers lump all three together under "we may collect technical data." Trustworthy ones name what they keep and, more tellingly, what they delete.
VPN logging splits into three types. Connection metadata captures timestamps, bandwidth, and source IP addresses. Activity logs capture the sites and contents of your traffic, the highest-risk category. Aggregate diagnostics capture anonymized server health with no link to any individual. A no-logs provider keeps zero activity logs.
Why Do Some "No-Logs" Providers Still Log Anything?
Even privacy-first VPNs retain some data, and that's not necessarily a red flag. Every provider needs account and billing records to run a business and process payments. The difference between an honest no-logs service and a misleading one comes down to scope: keeping an email address is reasonable, while keeping a timestamped record of every connection is not.
There are a few legitimate reasons logging creeps in. Some providers log connection counts temporarily to prevent abuse or enforce simultaneous-device limits. Others keep short-lived diagnostic data to debug outages. The trouble starts when "temporary" has no defined retention window, or when metadata that should be discarded gets stored "just in case." A provider that limits your account to a fixed number of devices almost certainly tracks active sessions in some form; the meaningful question is whether that tracking is ephemeral and unlinkable, or persistent and tied to your identity.
Jurisdiction adds another layer. In some countries, data-retention laws can compel providers to log specific information regardless of their marketing. That's why where a company is based matters as much as what it promises, a point we cover in depth in our guide to VPN laws and legal considerations.
How Do You Verify a No-Logs Claim?
You verify a no-logs claim with evidence, not with the homepage banner. A claim is only as strong as what backs it up, and the strongest proof comes from outside the company itself. Treat the marketing as a hypothesis, then look for these signals before you trust it with your traffic. The more boxes a provider checks, the more weight the promise carries.
Independent audits
An independent security audit means an outside firm inspected the servers, code, and configuration to confirm the logging practices match the policy. Audits aren't perfect, they're a snapshot in time, but a recent, published audit is far stronger than self-certification. Look for who performed it, when, and whether the full report (not just a summary) is available.
Court-case track record
The hardest evidence is a real legal demand the provider couldn't satisfy. When a company has been served a subpoena or court order and genuinely had no user data to hand over, that's the no-logs policy proven under pressure. A documented case like this outweighs any number of marketing claims.
Transparency reports
A transparency report lists how many data requests a provider received from governments and courts, and what it produced in response. Regular, detailed reports signal a company that expects scrutiny and has nothing to hide. Their absence isn't proof of wrongdoing, but their presence is a meaningful positive signal.
Reading the privacy policy wording
Read the actual policy, not the summary. Watch for soft language like "we may collect" or "from time to time," which leaves the door open to logging. Strong policies are specific: they name each data type, state the retention period, and say plainly what is never recorded. If the document is vague about activity logs, assume the worst.
RAM-only servers
RAM-only (diskless) servers store all operating data in volatile memory, so everything is wiped on every reboot. Nothing is written to a permanent disk that could later be seized or copied. This architecture makes long-term logging technically difficult, which is why it has become a benchmark for serious privacy infrastructure.
We've found that no single signal is decisive. A provider might lack a public audit but have a strong court record, or vice versa. Stack the evidence and look at the whole picture rather than fixating on one badge.
To verify a no-logs claim, weigh independent third-party audits, a documented court-case track record where no data could be produced, regular transparency reports, and precise privacy-policy wording. RAM-only diskless servers, which wipe all data on reboot, add architectural proof that long-term logging is technically impractical.
How Does Single-Tenant Architecture Change the Logging Picture?
Single-tenant architecture changes the logging picture by removing the shared infrastructure where logs usually accumulate. On a typical commercial VPN, thousands of users share the same servers, so the provider needs systems to manage, separate, and sometimes track that combined activity. A dedicated IP VPN on a single-tenant server flips that model: the server is yours alone.
When you're the only user on a machine, there's no multi-user logging layer to begin with. The provider isn't juggling shared bandwidth or separating one customer's sessions from another's, because there's nothing to separate. This is a structural advantage that shared "no-logs" services can't fully match: on a crowded server, the absence of logs is a policy choice that has to be continuously enforced; on a single-tenant server, the absence of shared logging is closer to a property of the design.
This is the model behind DediPN. Each customer gets a single-tenant dedicated server, so there's no shared logging infrastructure. Connection metadata is discarded by default, the zero-traffic-logs policy means no activity records are kept, and only account and billing data is stored. Traffic is protected with OpenVPN using AES-256-GCM encryption, with plans starting from $8/month. The point isn't a louder promise, it's an architecture where there's simply less to log in the first place.
Single-tenant architecture removes the shared logging infrastructure that multi-user VPNs rely on. When one customer occupies a dedicated server, there's no multi-user layer separating or tracking combined sessions, so the absence of operational logs becomes closer to a property of the design rather than a policy that must be continuously enforced.
Frequently Asked Questions
Does a no-logs VPN keep any data about me at all?
Yes, almost always. A genuine no-logs VPN still stores account and billing data, like your email and payment details, because it needs them to operate. What it doesn't keep are activity logs of your traffic, and ideally it discards connection metadata too. "No-logs" refers to those sensitive categories, not literally zero records.
Is an independent audit proof that a VPN keeps no logs?
An audit is strong evidence but not absolute proof. It captures the provider's practices at one moment in time, so configurations could change afterward. A recent, fully published audit from a reputable firm carries real weight, especially combined with a court-case track record and transparency reports. Treat it as one signal among several, not a guarantee.
Why does a VPN provider's jurisdiction matter for logging?
Jurisdiction matters because data-retention laws differ by country. In some places, a provider can be legally compelled to log specific information regardless of its marketing claims. A no-logs policy is only as reliable as the laws that govern it, so where a company is based directly affects what it can promise and keep.
Do RAM-only servers guarantee no logging?
RAM-only servers make long-term logging far harder, but they don't guarantee it alone. Because data lives in volatile memory and is wiped on every reboot, nothing persists to a seizable disk. A provider could still write logs to memory during a session. RAM-only is a strong architectural signal, best confirmed alongside policy wording and audits.
The Bottom Line
A no-logs label tells you almost nothing on its own. What protects your privacy is understanding the three log types, knowing that activity logs are the ones that truly matter, and demanding evidence: independent audits, a court-tested track record, transparency reports, and a privacy policy that names what it keeps and deletes. Architecture matters too, because RAM-only and single-tenant servers make logging technically impractical rather than merely discouraged.
Before you commit, read the policy closely and weigh the proof against the promise. If you want logging removed at the design level rather than by policy alone, a single-tenant dedicated server is the cleaner answer. Ready to take control of your own infrastructure? Deploy a zero-logs dedicated VPN server and stop sharing logging infrastructure with strangers.