No Log VPN Meaning: What a No-Logs Policy Really Covers

A no-logs VPN is one whose provider says it keeps no record of what you do online or of when and from where you connected. The phrase covers four different kinds of data, and providers draw the line in different places. Audits by outside firms, court cases and police searches show whether a policy held when it was tested.

Four things no logs can mean

Activity logs are the record of what you did. They include the sites and services you connected to, your DNS queries and the content of unencrypted traffic. DNS queries are the lookups your device makes to turn website names into addresses. All twelve providers in our data say they keep no activity logs. This is the most basic meaning of the phrase. It tells you the least, because every provider makes this claim.

Connection logs, also called metadata, record the fact of a session. They can include:

• Your real IP address, which is the number that identifies your connection.
• The VPN address you were assigned.
• When you connected and disconnected.
• How much data you moved.

A provider can keep these and still say, truthfully, that it does not log your activity. But this is the data that identifies a person. The 2016 IPVanish case below turned on connection timestamps, the recorded times of each session, not on browsing history. Surfshark says connection details held for a short time on a server are deleted within 15 minutes of the session ending. Windscribe keeps the date, but not the time, of your last activity. It says the time of connection is kept only in server memory until you disconnect.

Aggregate metrics are counts that are not tied to a session. ExpressVPN says it never collects activity or connection logs. It does collect aggregated usage statistics, which are combined totals:

• Which apps and app versions were activated.
• Whether a VPN connection succeeded on a given day.
• The location chosen.
• The total data transferred.

hide.me counts monthly traffic volume for billing and quality of service. PrivadoVPN keeps data counters on each account to enforce its plan limits. Windscribe stores the total amount of data you transferred in the last 30 days. Mullvad and IVPN say the only account activity they check is the number of connections in use at the same time. They hold that number in memory and delete it when the session ends.

Account data is what the business needs to bill you and let you log in.

• NordVPN keeps encrypted login details, an email address for password recovery and a username. It also keeps the transaction or order ID needed for refunds.
• IPVanish keeps the account email and billing data. Its payment processors hold payment data for at least seven years.
• Mullvad issues numbered accounts with no email. It deletes payment transaction IDs after 20 days and keeps accounting records for seven years, because Swedish law requires it. Support emails are erased after 70 days.
• IVPN accounts are random IDs with no email or name. Payment records are kept for accounting, without a link to the account after it is deleted.

A court order can reach account data even at a provider that keeps no logs at all. That is why the NordVPN and Proton cases below matter.

What an audit verifies, and what it cannot

A no-logs audit is a snapshot of one moment. An outside firm examines server settings, how the servers are set up and the company’s procedures. It interviews staff and sometimes runs test traffic. Then it states whether what it saw matched the policy on the days it looked.

The most common form is an ISAE 3000 assurance engagement. ISAE 3000 is an international standard for this kind of independent check. These are the audits in our data:

• NordVPN: six engagements since 2018. The first two were by PwC and the rest by Deloitte. For the latest, the auditors did their checks from 10 November to 12 December 2025.
• Surfshark: Deloitte, in January 2023 and June 2025.
• Private Internet Access: Deloitte, in June 2022, April 2024 and December 2025.
• CyberGhost: Deloitte, in September 2022, March 2024 and December 2025.
• ExpressVPN: KPMG audited its privacy commitments three times, in September 2022, December 2023 and June 2025. PwC audited it before that, in 2019.
• Proton VPN: Securitum audits it every year. Its fifth report came out in 2026. It found no evidence that the examined servers log browsing activity, DNS queries, the services you reach or connection data that could identify you.
• hide.me: Securitum audited it between 19 March and 6 June 2024. It reviewed configuration files, a snapshot of the packaged VPN software that runs on live servers and the process for setting servers up.
• IPVanish: Leviathan Security audited it in 2022 and Schellman in February 2025.
• IVPN: Cure53 verified its no-logging claims in March 2019, with three auditors over seven days.
• Mullvad: Assured’s May 2022 audit of three Mullvad servers found no information leakage or logging of customer data.

None of these prove anything about the whole fleet of servers at all times, or about the days after the auditor left. An audit also cannot check whether a company could be forced to start logging a specific user in future. That is a question of law, not of server settings.

And the report is often not yours to read. NordVPN’s reports are available only to logged-in customers. CyberGhost’s 2022 report is available only on request from Deloitte, and IPVanish’s is in its customer portal. Proton, Mullvad, IVPN and hide.me publish theirs.

Our data also shows gaps:

• Windscribe’s audits in 2021, 2022 and 2024 cover its apps and server software, not its logging policy.
• PrivadoVPN has published no audit and no transparency report. A transparency report lists the legal requests a company received.
• IVPN says it will not commission further no-logs audits after 2019.
• Mullvad’s newest audit focused on logging is from 2022.

Our methodology gives more points the newer the audit is, and none once it is more than three years old.

RAM-only servers and encrypted disks

RAM is a computer’s working memory, which is wiped when the power goes off. A server that runs entirely from RAM keeps nothing when it is powered off or restarted. So a seized machine holds no stored data. NordVPN, Surfshark, PIA, CyberGhost, Mullvad and ExpressVPN all say their servers run from RAM.

In June 2021, two of Windscribe’s OpenVPN servers were seized in Ukraine. OpenVPN is one of the protocols VPNs use to build their connections. The servers’ unencrypted disks turned out to hold a server certificate and private key. These are files a server uses to prove its identity. After that, Windscribe moved its whole network to RAM-only servers.

Proton chose not to use RAM-only servers and has published its reasons. All of its servers use full-disk encryption instead, which scrambles everything stored on the disk. IVPN runs a small number of diskless test servers and calls the network-wide rollout an ongoing project. IPVanish describes its servers as a mix of disk and RAM-only, with a goal of 100 percent RAM-only by 2027. hide.me and PrivadoVPN do not say either way.

RAM-only is about what is left behind, not what happens while the server runs. A provider can log in memory and send the data elsewhere. That is why server design and the audit of the policy are separate questions.

What police, courts and warrants actually found

The strongest evidence is what happened when someone with legal power asked. Every event below is recorded, with its source, in our provider data.

• March 2016, Private Internet Access. An FBI subpoena in a Florida bomb-threat case asked for user logs. A subpoena is a legal order to hand over information. PIA could say only that the addresses belonged to its US East Coast cluster of servers, because it had no activity logs.
• June 2016, IPVanish. IPVanish was then owned by Highwinds. It received a Department of Homeland Security summons, a legal demand for information. It answered with a subscriber’s name, email address, real IP address and VPN connection timestamps. At the time, it advertised a no-logs policy. Court documents came to light in 2018. StackPath, which bought IPVanish in 2017, said no logs or logging systems existed when it took over. This case shows that a no-logs claim no one has checked can be false.
• July 2016, Private Internet Access. Russian authorities seized several PIA servers. PIA removed all of its servers from Russia.
• January 2017, ExpressVPN. Turkish authorities seized a server while investigating the assassination of the Russian ambassador. ExpressVPN said the server gave them no useful information. It stopped using physical servers in Turkey.
• March 2018, NordVPN. Someone accessed a rented server in Finland through a remote-management account, which lets a person control a server from elsewhere. The data center had added that account. An expired TLS key was taken. A TLS key is a file used to secure connections. NordVPN says no activity logs existed on the machine. The breach was disclosed in October 2019.
• June 2018, Private Internet Access. In a San Jose federal trial, PIA’s general counsel testified that the company keeps no activity logs. The general counsel also testified that PIA could not link the defendant to the addresses used.
• January 2019, Proton VPN. A Swiss court approved a request for Proton VPN user data. Proton reported that it could not comply, because it holds no customer IP information.
• September 2021, Proton Mail. A binding Swiss order in a French case required Proton to log and disclose the IP address of a climate activist’s Proton Mail account. Proton says that under Swiss law, unlike its email service, Proton VPN cannot be forced to log. In May 2024, Proton also gave Spanish police the recovery email address of a Proton Mail account, through Swiss authorities.
• April 2023, Mullvad. Swedish police searched Mullvad’s Gothenburg office with a warrant to seize customer data. They left with nothing, because none existed.
• October 2024, NordVPN. A binding warrant from the Panamanian prosecutor required NordVPN to provide the user data it held in a criminal case. Its transparency report records one order that resulted in disclosure. What it held was account data, not activity.
• April 2025 and February 2026, Windscribe. A Greek court dismissed criminal charges against Windscribe’s founder over activity traced to a server in Finland. Windscribe says it had no user data to hand over. Dutch authorities then seized one of its servers in the Netherlands. Windscribe says that server held a standard operating system and no logs.

The record shows two things. First, no provider in our data has produced activity logs in a legal case since the 2016 IPVanish disclosure. Second, the two companies that did produce data handed over account information. They were NordVPN in 2024 and Proton in 2021 and 2024. A no-logs policy limits what data exists. It does not stop a court from reaching the company.

How to read a privacy policy

Use these checks when you read a VPN’s privacy policy:

• Start with the list of what is collected, not the headline. Look for the four categories above by name.
• Find the retention periods, which say how long data is kept. Mullvad’s 20 days for transaction IDs and 70 days for support emails are the kind of detail a serious policy contains.
• Check whether a free tier is covered. Proton and PrivadoVPN say their no-logging commitments apply equally to free users.
• Find the governing law and the operating company. A court order goes to the company, not the brand. Our Five, Nine and Fourteen Eyes page explains what jurisdiction does and does not change. Jurisdiction is the country whose laws apply. The laws hub tracks national rules.
• Look for how legal requests are reported. NordVPN publishes transparency reports and has retired its warrant canary. IVPN and Windscribe publish both a canary and a transparency report. Mullvad publishes neither. A warrant canary is a regular statement that the company has received no secret legal orders.
• Note the date. ExpressVPN’s policy was last updated on 2 October 2026 and Surfshark’s on 12 October 2026. hide.me’s has been in effect since 10 January 2023.
• Consider the payment trail. A card ties the account to you, whatever the policy says. Mullvad and IVPN take cash and Monero, a digital currency built for privacy.

Our best VPNs for privacy page applies all of this to the providers we track. The public data record behind it lists every field and source.

Related

• Best VPNs for privacy
• How we score privacy
• Five, Nine and Fourteen Eyes explained
• Double VPN explained
• What is a VPN?
• Mullvad review
• Proton VPN review
• Private Internet Access review