“No logs” is the most repeated promise in the VPN market and the least standardised. Two providers can print the same two words and mean very different things. The claim is only worth as much as what sits behind it.
A VPN sees every connection you make through it. A logging policy is the provider’s statement about which parts of that it writes down, for how long, and why. The useful question is never “do they log?” but which fields, and can anyone check?
The fields that actually matter
When we read a privacy policy, we do not score the phrase “no logs.” We record what the policy says, field by field, and cite the exact sentence. The ones that decide whether a log can identify you are:
- Originating IP address, the address you connected from. This is the single field that ties activity back to a person.
- Browsing / DNS activity, the sites and domains you reached. A “no-logs” claim that quietly retains DNS queries is not no-logs in the sense that matters.
- Connection timestamps, when you connected and disconnected. On their own these can correlate a user with an action through timing alone.
- Bandwidth and session data, less identifying, but a policy that keeps per-session records is keeping more than none.
Three things that turn a claim into evidence
A no-logs claim is a promise until something makes it checkable. In rising order of strength:
- A specific, dated privacy policy. Vague is a choice. A policy that enumerates each field and when it is deleted is a stronger commitment than one that waves at “we respect your privacy.”
- An independent audit, with a published report. “Independently audited” on a homepage, with no firm named and no report to read, is a slogan, not an audit. The report is the evidence; the badge is not.
- A test the claim has survived. A subpoena that produced nothing, or a seized server that held no user data, is the strongest signal there is, because it is the claim meeting reality instead of a lawyer’s pen.
How we score it
On this site a logging claim read from a provider’s own policy is marked vendor-claimed and its score is capped accordingly, we have read what they wrote, not verified that they do it. An audited claim with a published report can score higher because someone independent looked. A claim tested in the real world higher still. The number you see is not whether the words “no logs” appear; it is how far the claim has been carried past its own marketing.