A No-Logs VPN Policy Is Only as Good as Its Details
- The Headline Hides the Important Nouns
- Activity and Connection Data Tell Different Stories
- Account Data Exists Before the First Packet
- Retention Turns Collection Into Exposure
- An Audit Is a Window, Not a Live Camera
- Strong Evidence Arrives From Different Directions
- Jurisdiction Changes the Rules, Not the Database
- Diagnostics Can Undo a Careful Default
- Five Minutes Can Expose a Hollow Promise
A VPN can say “no logs” and still keep an account, payment record, support email, crash report, and temporary connection state. The slogan isn't the policy. Your job is to find the data that survives after the tunnel closes.
Imagine connecting a work laptop at 8:12, visiting a site, disconnecting at 8:47, and emailing support with a diagnostic file. A useful policy lets you ask four separate questions: was the destination recorded, was the session tied to your source IP, what did the account retain, and what entered the support system?
Read the answers by data type and deletion time. “We don't log browsing activity” may be true while connection metadata lives elsewhere in the same document.
The Headline Hides the Important Nouns
“Logs” isn't one standardized bucket. It can mean browsing destinations, DNS queries, source IP addresses, VPN-assigned addresses, connection timestamps, session duration, bandwidth, account changes, device identifiers, or app diagnostics. A provider may reject one category and retain another.
Start with the verb and object. We don't store websites visited answers an activity question. We delete connection timestamps after 15 minutes answers a retention question. We may process account and payment information describes another system entirely.
The missing noun is often the trap. Search the policy for IP address, timestamp, DNS, bandwidth, device, diagnostic, payment, support, analytics, third party, retention, and delete. If a company defines “no logs” in the banner but not in the policy, you haven't reached the evidence yet.
Activity and Connection Data Tell Different Stories
Activity data can include browsing destinations, DNS queries, application traffic, files accessed, or the contents of unencrypted communications. HTTPS usually keeps page contents encrypted beyond the VPN server, although the provider can still handle destination and connection metadata in its infrastructure. Connection data describes the session around it: the source IP, VPN server, start time, end time, duration, or volume transferred.
That distinction matters because a VPN changes the observer. Without one, the ISP carries the laptop's direct destination connections and the destination sees the household IP. With one, the ISP sees an encrypted connection to the VPN plus timing and volume; the VPN accepts traffic from the source IP and forwards it; the destination sees the VPN server's address.
If the provider stores enough source, time, and exit information, records may help correlate those two sides even without a browsing-history field. If it doesn't retain that mapping, the later evidence is thinner. Cookies, account logins, and browser fingerprinting can still identify the user to the destination either way.
Ask about the link, not just the list: can a stored event be tied to an account, source address, device, or assigned VPN address?
Account Data Exists Before the First Packet
A VPN account may contain an email address, subscription state, payment reference, fraud signal, device registration, and support history. None of that is automatically a traffic log. It still matters to privacy because it can connect a person or payment trail to use of the service.
Mullvad offers a useful concrete example. Its current no-logging policy says signup creates a random account number without a name, username, password, or email. The same page separately explains that some payment methods, emails, and problem reports may involve personal data. Minimal signup narrows one link; it doesn't erase every later disclosure.
- Maps the many ways companies and governments collect data during ordinary online activity
- Makes large-scale surveillance understandable without requiring a technical background
- Helps readers question privacy promises and recognize the tradeoffs behind convenient services
Now return to the 8:47 support email. Did the diagnostic contain an account number, timestamps, app settings, server address, or network information? Is sending it optional? How long does support retain the message and attachment? A carefully limited tunnel can be followed by a very revealing ticket.
Retention Turns Collection Into Exposure
A system may handle data in memory to authenticate an account or enforce a connection limit without writing a durable history. Another system may keep raw events for minutes, aggregate them, then delete the source records. Those are different designs, and both deserve exact language.
Find the clock. “Temporary” without a maximum is soft. “Deleted when the session ends” is more useful, but you still need to know whether copies enter backups, analytics, abuse systems, or support tools. Aggregation can reduce detail, though it isn't synonymous with anonymization unless the remaining fields prevent a person or account from being singled out.
RAM-only or diskless servers can limit what remains on that server after a reboot or redeployment. They don't prove that no data is exported to a control plane, monitoring service, billing system, or backup. Architecture supports a policy; it doesn't replace one.
An Audit Is a Window, Not a Live Camera
An independent assessment can test configurations, interview staff, inspect code or systems, and compare observed controls with a written claim. Its value depends on who performed it, what was in scope, which locations and server types were sampled, the dates tested, the level of assurance, and whether readers can inspect the report.
NordVPN says its no-logs practices have undergone six independent assessments. Its current no-log page identifies PwC for the first two and Deloitte for later work. NordVPN's summary of the sixth says Deloitte Lithuania examined standard and specialty server configurations between November 10 and December 12, 2025 under ISAE 3000 (Revised); the complete report is available to signed-in Nord Account users rather than published as an open excerpt.
That is evidence with a date and boundary. The IAASB standard defines a framework for assurance engagements; it doesn't turn a point-in-time examination into continuous surveillance of the provider. Check whether the audited claim matches the policy sentence you care about.
Strong Evidence Arrives From Different Directions
No single artifact settles trust. A useful stack combines a precise policy, minimal collection by design, technical audits with visible scopes, public security work, and real events that tested what the company could produce.
Mullvad's audit archive lists app, infrastructure, web, Android, and account-system assessments rather than one timeless badge. In April 2023, the company said Swedish police visited with a search warrant and left without equipment or customer information after the provider demonstrated that the requested data didn't exist.
- Connects everyday data collection to real choices about freedom, power, and control
- Explains why privacy matters even when you have nothing to hide
- Turns a broad social issue into practical questions you can apply to your digital life
Treat that event as corroboration, not prophecy. A different legal demand, product version, account system, or data category could produce a different record. Transparency reports and warrant stories are strongest when they include dates, documents, scope, and limits—and weakest when they become mythology repeated without the underlying facts.
Open-source apps add another angle: outsiders can inspect client code, but they can't see private server operations merely because the app repository is public. A transparency report describes requests the company says it received and how it responded; unless independently verified, that report still depends on the provider's completeness.
Jurisdiction Changes the Rules, Not the Database
Where a company operates can affect legal process, retention duties, and how demands are handled. It can't tell you, by itself, what the service technically collects today. A favorable jurisdiction doesn't delete a timestamp; an unfavorable-sounding one doesn't prove a timestamp exists.
Read jurisdiction after the data map. Identify the contracting entity, governing terms, company ownership, server operations, and where account or support systems may process data. Then ask how those facts interact with the law that actually applies.
Beware the easy country ranking. Privacy depends on collection, architecture, policy, legal obligations, and operational behavior together. A flag icon answers only one part.
Diagnostics Can Undo a Careful Default
Crash reports and telemetry may help developers fix unstable apps. The relevant questions are whether reporting is opt-in, which fields leave the device, whether identifiers are persistent, where the report goes, and how long it stays.
Open the app's diagnostic screen before trouble arrives. Look for a preview or documented field list. Remove account numbers, file paths, public IPs, and unrelated logs where the tool permits. Send the smallest report that reproduces the issue, then ask support about deletion if the policy doesn't say.
The device is one observer here, the provider's diagnostic endpoint is another, and any outside analytics or crash vendor may be a third. A no-traffic-logs claim doesn't automatically cover all three.
Five Minutes Can Expose a Hollow Promise
Open the policy and run this short test:
- Find the exact list of activity and connection fields the provider says it doesn't store.
- Find every field it does handle, including account, payment, abuse, device, support, analytics, third-party sharing, and diagnostic data.
- Match each retained field to a deletion time and any backup or aggregation language.
- Open the latest audit and compare its dates and scope with the current policy.
- Check the legal entity and current terms, then look for a documented real-world request or transparency report.
If the policy can't answer those questions, “no logs” hasn't earned much trust. If it can, you still haven't eliminated the VPN as a middleman—you've learned what evidence supports its promise not to keep a history of that position.