“No-logs” is one of the most repeated phrases in VPN marketing, and also one of the most misunderstood. It doesn’t mean a VPN provider stores literally nothing about you, it means something more specific, and the details matter.
What a no-logs policy actually covers
A genuine no-logs policy means the provider doesn’t record what you do while connected: which websites you visit, what you download, what apps you use, or your browsing history. This is the category of logging that would let someone reconstruct your online activity.
What “no-logs” usually doesn’t mean
Most legitimate VPN providers still collect some operational data to run their service, this is normal and not a red flag by itself:
- Account information — the email address and payment method used to sign up
- Connection timestamps — when you connected and disconnected (without logging what you did during that session)
- Aggregate bandwidth data — how much data was used, for capacity planning, not tied to your specific activity
- Server selection — which server location you connected to, though not what you did there
The difference between a trustworthy provider and a misleading one is usually in exactly how these edges are drawn, and whether they’re disclosed clearly rather than buried in a privacy policy’s fine print.
Why “trust us” isn’t enough
Anyone can put “we don’t log” on a website. What actually gives the claim weight is independent verification, specifically, third-party security audits where an outside firm reviews the provider’s server configuration and code to confirm the no-logs claim matches reality. Providers that have undergone recent, published audits from a reputable firm have made their claim externally checkable rather than just asserted.
A second, rarer form of verification is a real-world test: a case where law enforcement or a court demanded user activity logs from a provider, and the provider was unable to produce any because none existed. A handful of VPN providers have this kind of documented history, and it’s about as strong a proof point as exists for a no-logs claim.
Jurisdiction matters too
Where a VPN company is legally based affects what it can be compelled to do, even with a genuine no-logs policy. Companies based in countries that are part of international intelligence-sharing agreements, or that have data retention laws, may face different legal pressure than ones based elsewhere. This is why our reviews call out a provider’s jurisdiction as its own factor rather than just taking the no-logs claim at face value.
How to evaluate a specific provider’s claim
- Read the actual privacy policy, not just the marketing page, specifically what data is collected under “Information We Collect”
- Check whether the no-logs policy has been independently audited, and how recently
- Check whether there’s a documented real-world case where the provider was asked to produce logs and couldn’t
- Check the company’s jurisdiction and any relevant data retention laws that apply there
Bottom line
“No-logs” is a real, meaningful claim when it’s backed by a specific, published policy and independent audits, not just a marketing slogan. See our Best VPN for Privacy & Security picks for providers whose no-logs claims we’ve weighed against audit history and jurisdiction, not just their own marketing copy.