What a VPN no-logs policy really means

Why logging is the question that matters

A VPN moves trust from your internet provider to the VPN company. The company's servers see your real IP address and where your traffic goes. If it records those things, the records can be demanded by courts, stolen by attackers, or sold. A no-logs policy is the company's promise not to keep them. The promise is only as good as the evidence behind it.

The kinds of logs a VPN can keep

Many policies that say “no logs” mean no activity logs, while still keeping some connection data briefly to manage servers or limit simultaneous connections. Read the policy's details, not its headline: how long anything is kept, whether your real IP address is ever stored, and whether data is tied to your account.

Claims versus evidence

There are three kinds of evidence, in rough order of strength:

• The written policy. It shows what the company is willing to say publicly. It proves nothing on its own.
• Independent audits. An outside firm examines servers, code or procedures and reports whether they match the policy. Scope matters: an audit of a configuration on a set date isn't a guarantee for every server forever. Look for who did it, what it covered, when, and whether the report is public. Our VPN audits tracker lists them.
• Real-world tests. Court cases, subpoenas, raids and server seizures show what a provider could hand over when it had to. They're rare, and each covers one moment in time.

Court cases and raids that tested no-logs claims

Private Internet Access, 2016 and 2018

In a 2016 FBI case about bomb threats, the criminal complaint showed that a subpoena to London Trust Media, then PIA's owner, produced only the information that the IP addresses belonged to its servers on the US East Coast, TorrentFreak reported. In a separate 2018 federal trial, PIA's general counsel testified that the company didn't keep logs that could identify users. In both cases investigators relied on other evidence. PIA has changed owners since; see our PIA review and who owns your VPN.

IPVanish, 2016 case reported in 2018

In 2018 TorrentFreak reported court papers from a 2016 Homeland Security child-exploitation investigation showing that IPVanish, which advertised a strict no-logging policy, had provided information that led investigators to a suspect's real Comcast IP address. IPVanish was then owned by Highwinds. Its later owner StackPath, which bought IPVanish in 2017, said the case predated its ownership and that the current team had no further details. IPVanish has since changed hands again; see our IPVanish review for its current owner and audits.

PureVPN, 2017

In the 2017 cyberstalking case against Ryan Lin, an FBI affidavit described PureVPN confirming that Lin's home IP address had connected to the VPN server addresses used in the harassment, TorrentFreak reported. PureVPN had described itself as keeping no logs, and it later published its own explanation of its role. Some commentators, such as the Emptywheel blog, argued the affidavit alone didn't prove historic logs existed. See our PureVPN review.

ExpressVPN, Turkey, 2017

After the assassination of Russian ambassador Andrei Karlov in Ankara in December 2016, Turkish authorities seized an ExpressVPN server. ExpressVPN said in December 2017 that investigators couldn't find logs identifying which customer had used the server, because it didn't keep them. That account comes mainly from the company and Turkish media. See our ExpressVPN review.

Mullvad, Sweden, 2023

On 18 April 2023, at least six officers from the Swedish police's National Operations Department visited Mullvad's office in Gothenburg with a search warrant to seize computers holding customer data, Mullvad said. According to Mullvad, after it explained how its service works and the officers consulted a prosecutor, they left without taking anything, because there was no such data. This too is the company's own account. See our Mullvad review.

Windscribe, Greece, 2025

Greek authorities charged Windscribe's chief executive, Yegor Sak, over an alleged offense committed in June 2023 by an unknown user of a Windscribe server in Finland. On 11 April 2025 an Athens court dismissed the case for lack of evidence, TechRadar reported. Windscribe said it had no user data to provide. See our Windscribe review.

Design choices that back up a no-logs claim

• RAM-only servers, which don't store data on disk, so a seized or rebooted server holds nothing.
• Minimal account data, such as account numbers instead of email addresses, and anonymous payment options.
• WireGuard handled carefully, since a basic WireGuard server ties each user's key to an internal IP. See WireGuard vs OpenVPN.
• Regular transparency reports listing legal requests and what was handed over.
• Jurisdiction, which matters less than practice. A company can only hand over what it has.

How to check a provider's no-logs claim

1. Read the policy's details Look for what is collected, for how long, and whether your real IP is ever stored.
2. Find the audit Check who did it, the date, the scope and whether the full report or a summary is public. See our audits tracker.
3. Look for real-world tests Search for court cases, subpoenas or seizures involving the provider, and read primary sources where you can.
4. Check ownership Ownership changes can change practices. See who owns your VPN.
5. Be wary of free apps Several free VPNs that claimed no logs were found keeping them. See are free VPNs safe.