VPN No-Logs Policy Explained in 2026: What Providers Really Record

Last Updated on October 23, 2026 by Scottie Brockenshire

What Does a No-Logs VPN Actually Promise?

A true no-logs VPN keeps no activity data and no connection data that can be tied back to you, so a seized server has nothing useful to hand over. Activity data is the content of your session: which pages you opened, which DNS queries your device sent, which apps used the tunnel. Connection data is the metadata around it: when you connected, how long you stayed, which server you used, and the IP address you came from. A provider that keeps the second list can still identify you when it is paired with a timestamp, even if it never saw a single page you visited.

Every provider keeps a little account information, and that is not a contradiction. An email address and billing details are needed to sell a subscription and handle a refund. The line that matters sits between “we know you are a customer” and “we know what you did on Tuesday at 22:14”. NordVPN and Surfshark VPN both say they cross only the first line.

Set Up a Verified No-Logs VPN in Four Steps [Short Steps]

Which Data Counts as a Log?

Providers use the same word for very different records. These are the four groups you will meet in a privacy policy.

Log type	What it can include	Why it matters
Activity logs	Browsing history, DNS requests, URLs, usage metadata	A full record of your session, and the one type a trustworthy VPN should never keep
Connection logs	Timestamps, session length, originating IP, server IP, bandwidth	Metadata that can still name you once it is matched to a time
Aggregated logs	Server load, total bandwidth, crash reports	Usually harmless, unless the anonymisation is weaker than advertised
Account data	Email, payment details, order history	Needed to run the service, and the only data a no-logs provider should hold

The first two rows decide whether the label means anything. A provider that keeps your originating IP next to a connection time has rebuilt the link between you and your session.

Why Do Some VPNs Still Keep Connection Logs?

Connection logs survive because they solve real operational problems: capacity planning, abuse reports, and billing disputes. A network with thousands of servers needs to know how many people sit on each machine and how much bandwidth it moves, otherwise it cannot add capacity before speeds collapse. That is server-level data, and it says nothing about a person.

The trouble starts when the same data is stored per account. Free services have an extra reason to keep it, because advertising and data sales are often the actual product. Hola VPN's privacy policy is a documented example of activity data shared with third parties to pay for a “free” service.

Even a paid provider can be forced to surrender whatever it kept. In January 2019, Finland's National Bureau of Investigation seized connection logs from F-Secure's FREEDOME VPN at the request of German police. A court later ordered the logs destroyed, but the lesson stands: a VPN can only hand over the data it chose to collect.

How Do Independent Audits Prove a No-Logs Claim?

An audit turns the policy into a test: an outside firm inspects the servers, the configuration and the staff answers, then states whether the systems match the promise. The credible format is an assurance report under ISAE 3000. A Type 1 report reviews the design, while a Type 2 report also tests whether the controls worked over a period.

NordVPN completed its sixth independent no-logs engagement at the end of 2025. Deloitte Lithuania carried out the work under ISAE 3000 (Revised) between November 10 and December 12, 2025, and concluded that NordVPN's systems are designed and implemented in line with its no-logs statement. The review covered standard VPN, Double VPN, obfuscated and Onion Over VPN servers, and the full report sits inside your NordVPN account.

Surfshark VPN has taken the same route with Deloitte, with no-logs assurance reports in 2023 and 2025. It adds RAM-only servers that wipe on every reboot and ephemeral session keys that exist only while a session is live. NordVPN also runs RAM-only servers, and its base in Panama sits outside the EU and US data-retention regimes that its Dutch neighbour operates under.

None of this is magic. Every assurance report is a point-in-time assessment, so it proves the configuration at the end of 2025, not forever. NordVPN's own history shows why the caveat matters: a server in Finland was breached in 2018 and disclosed in October 2019. No user credentials or billing details were reported compromised, and NordVPN ended its relationship with that data centre.

What Do NordVPN and Surfshark VPN Actually Record?

Both keep the minimum needed to bill you and run the network, and neither keeps a record of the sites you visit. The details are worth knowing, because “we keep nothing” is never literally true for a paid service.

What Should You Check Before You Pay?

Five checks separate a verifiable no-logs service from a page of confident adjectives, and each one takes under a minute. Run them before you enter card details, then keep the answer in mind when a deal looks unusually cheap.

1. A named auditor and a date. “Independently audited” without a firm and a period tells you nothing.
2. The standard and the report. ISAE 3000 or SOC 2, with the report available to customers, is stronger than a blog post about the result.
3. RAM-only servers. Diskless servers cannot keep a long-term record even if someone asks them to.
4. A jurisdiction that does not force retention. Panama and the Netherlands treat data requests differently, so the company address matters.
5. A policy that lists data categories and retention periods. If the privacy policy never says how long it keeps connection data, assume it keeps it longer than you would like.

Is a No-Logs VPN Legal?

Using a VPN is legal in most countries, but a no-logs design is a privacy feature, not permission to break rules. A handful of states restrict VPN use or require providers to register, so check your local laws and the service's Terms of Service. A no-logs provider protects the record of your session; it does not make copyright infringement or account sharing acceptable. The benefit is narrower and more useful: on public Wi-Fi or a network you do not control, a verified no-logs VPN removes the middleman who would otherwise hold that record.

FAQs

Does a no-logs VPN make me completely anonymous?

Can a no-logs VPN be forced to hand over data?

Is a free VPN ever truly no-logs?

Do I need a no-logs VPN to unblock a streaming service?

In Short: What a No-Logs VPN Really Means

A no-logs VPN keeps no record of the sites you visit and no connection data that can be tied back to you, while still holding the email and billing details needed to run your account. Connection logs, aggregated stats and account data are normal; activity logs are not. The claim becomes credible only when a named firm tests the servers against it, which is what Deloitte did for NordVPN in its sixth engagement and for Surfshark VPN in 2023 and 2025. Check the auditor, the standard, the server design and the jurisdiction before you pay. NordVPN puts the full report in your account, which is the simplest way to see the proof.