VPN logging explained

Updated 21 September 2026 · How we research

"No logs" is a claim about policy, not a property of the software. Reading a privacy policy properly means separating three very different categories of record.

Three kinds of log

Activity logs

Sites visited, DNS queries, contents. A provider keeping these defeats the point of the product. Effectively nobody admits to it.

Connection logs

Timestamps, source IP, server used, bytes transferred. These are the ones that matter, because they can link a session back to a person.

Diagnostic logs

Crash reports and aggregate load data. Often benign, but the detail and retention period are what decide that.

Questions a policy should answer

  1. Is the source IP address stored at all, and for how long?
  2. Are connection timestamps retained, and can they be correlated with a server?
  3. What is the retention period in days, stated as a number rather than "minimal"?
  4. Which jurisdiction governs the company, and what can compel disclosure there?
  5. Has an independent audit examined the infrastructure, who performed it, and when?
  6. Does the service run diskless or RAM-only servers, so that seizure yields nothing?

Wording to be sceptical of

"We do not log your activity" can be true while connection metadata is retained. "Audited" means little without the auditor's name, the scope and the date. "Anonymous" and "military-grade" are marketing terms with no agreed meaning.

Why we do not score this

A logging policy can only be assessed from published documents, corporate structure and any third-party audit. VPN Sherlock does not operate infrastructure inside any provider, so we cannot verify what is written to disk. We summarise what each provider publishes and say plainly when a claim is unverified. See our methodology for what that means in practice.

A practical approach