No-logs VPNs explained: audits, courtrooms, and marketing
Every VPN claims to keep no logs; only audits, architecture, and court records reveal which ones mean it.
What no-logs actually means
A genuine no-logs policy means the provider keeps no records that could connect you to your online activity: no browsing history, no record of which sites you visited through which server, no stored linkage between your account and your traffic. It does not mean the company knows nothing at all; billing information and aggregate operational data typically exist. The test is simple: if compelled to hand over everything, could they identify what you did online? A real no-logs provider cannot.
The logs that matter versus the ones that do not
Two categories are dangerous: activity logs, recording what you actually did, and connection logs that pair your real IP address with timestamps and assigned VPN addresses, which allow after-the-fact identification. By contrast, anonymized diagnostics, crash reports, and server-load statistics are generally harmless housekeeping. Reading a privacy policy through this lens takes five minutes: search for what is retained about IPs and timestamps, and ignore the reassuring adjectives around it.
Audits: the baseline of credibility
An independent audit means an outside firm examined the provider's systems and verified the policy matches reality. It is the minimum bar a no-logs claim should clear in 2026, and repetition matters more than any single pass, because an audit describes a moment in time. ExpressVPN is the reference point here, with 12+ independent audits across its apps, servers, and policies, a cadence that turns a snapshot into a track record.
Court records: the strongest evidence there is
An audit is an expert's verification; a subpoena is a live-fire test. Private Internet Access has passed it twice: US courts demanded user data in 2016 and again in 2018, and both times the company had nothing to produce. No marketing budget can buy that evidence, and it carries extra weight precisely because PIA operates under US jurisdiction, where the legal pressure is real. Court-tested absence of data is the gold standard of no-logs proof.
Architecture that makes logging hard
The best policies are backed by systems that make retention physically difficult. ExpressVPN runs its fleet on RAM-only servers: nothing writes to disk, and every reboot wipes the machine completely, so there is no accumulating archive to seize. Open-source software adds another layer of verifiability, and Private Internet Access publishes its app code for exactly that reason. Policy says we will not; architecture says we cannot. You want providers offering both sentences.
How to judge a claim in five minutes
Run any provider through four questions. Recent, repeated audits by named firms? ExpressVPN's 12+ set the pace. Ever tested against real legal demands? PIA's 2016 and 2018 court record answers it. Jurisdiction: the British Virgin Islands, where ExpressVPN lives, sits outside major intelligence-sharing alliances, while US-based PIA compensates with courtroom evidence. And architecture: RAM-only servers, open-source code. Any provider failing all four is asking for faith, not offering proof.
Frequently asked questions
Can a no-logs VPN still see my traffic in real time?
Does jurisdiction matter if there are truly no logs?
Are VPN audits actually trustworthy?
Related reading
VPNsBest VPN for travel in 2026
Hotel wifi, foreign card machines, and banking apps abroad all get safer with the right VPN installed before departure.
VPNsBest VPN Deals in 2026: How VPN Pricing Really Works
VPN pricing is theater: sticker prices, countdown timers, and renewal jumps all follow a script you can use to your advantage.
VPNsIs Public Wi-Fi Safe in 2026? Real Risks and a Practical Checklist
HTTPS fixed the worst of public Wi-Fi, but fake hotspots and sloppy networks still catch people out; here is what actually helps.