When comparing no-logs VPNs, check the evidence and its limits before looking at features. A no-logging policy describes how data is handled; a successful connection cannot prove it. Check what the service does not collect, what it still processes, how long data is kept, and what evidence supports its claims.
You cannot fully inspect a provider’s server infrastructure from the outside, but you can spot vague claims, reduce account linkability, and check whether your traffic is routed as expected. This guide walks through policies, evidence, accounts, and devices without treating a privacy label as a promise of anonymity.
Logging categories: What does “no logs” actually mean?
“No logs” has no single meaning outside its context. Some providers mean they do not store browsing content; others also exclude destinations, source IP addresses, and connection times. If a page only says “no activity logs” without defining activity, read the full privacy policy.
Also distinguish real-time processing from long-term storage. Forwarding traffic generally requires processing source and destination information while a connection is active. Using that information briefly to deliver traffic does not necessarily mean it is written to long-term logs. Conversely, a claim that browsing content is not stored does not prove that connection metadata is not retained.
| Data category | What it may include | What to verify |
|---|---|---|
| Browsing and access records | Destination domains, DNS queries, destination IP addresses, and unencrypted traffic content | Whether these are explicitly listed as data not collected, and whether exceptions apply |
| Connection metadata | Source IP address, connection start and end times, exit node, and session identifier | Whether it can be linked to a specific account or browsing activity, and how long it is kept |
| Billing and usage | Remaining account data, total usage, and order status | How aggregated the data is, what it is used for, and whether it includes destination records |
| Diagnostics and analytics | Crash reports, error messages, and client analytics data | Whether uploads are enabled by default and whether reports may contain sensitive fields |
| Account and payment information | Username, order ID, payment processor confirmation, and support ticket content | Who stores it, what happens after account deletion, and what must be retained by law |
Data-based plans need usage calculations, but usage statistics are not the same as full browsing logs. A remaining data balance does not by itself prove that a service records browsing history; likewise, aggregated statistics do not mean every linkability risk has disappeared. What matters is whether the fields, level of detail, and retention rules are clearly explained.
Privacy policies: Follow the data lifecycle
Start with the official policy, not a badge on the homepage. Check that it applies to the product, website, and client you use, and review its effective date, operating entity, and contact details. Different products may follow different data practices, and an old screenshot or secondhand summary is no substitute for the current policy.
- Check what data is collected. Search for terms such as “logs,” “IP address,” “connection,” “diagnostics,” and “analytics.” Separate data the policy explicitly says is not collected from data it may collect. Silence is not an explicit exclusion.
- Check why data is processed. See what data is needed for billing, abuse prevention, and troubleshooting. “Improving your experience” is too vague to establish the scope of collection without details about the data involved.
- Check retention and deletion. Look for separate explanations of connection data, account details, support tickets, and backups. A statement that data is kept “as necessary,” without a time limit or clear deletion criteria, is not very transparent.
- Check recipients and exceptions. Review how payment processors, hosting providers, analytics tools, and legal requests are handled. A provider’s promise not to log a particular type of data does not mean its payment processor also avoids storing transaction records.
- Check how policy changes are handled. Find out how users are notified of updates and how to request access to or deletion of their data. Deleting an account does not necessarily remove orders and backups at the same time.
Evidence: What audits, open source code, and local tests can show
An independent audit can add credibility, but read the original report to understand its scope. Check whether it covers production servers, backend configuration, and data-handling processes, or only client code. Reports may also be limited to a particular time period or sample, so they cannot automatically verify all operations that followed.
This article does not claim that any brand has undergone a third-party audit. If a provider displays an audit badge but offers no report to inspect, no named auditor, or no clear findings, treat the claim as unverified—not as established fact. Limitations and remediation items in the report matter too.
Open-source clients can help you inspect connection logic and upload behavior, but they cannot prove on their own that servers do not keep logs. Running servers in memory can reduce disk-based retention, but does not rule out forwarding logs remotely. Protocol names are not privacy policies either: Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC use different transport mechanisms, but whether logs persist depends on their implementation and operational configuration.
How to weigh the evidence: A clear policy explains the scope of a commitment, an accessible report provides external evidence within defined limits, and local tests check device-side behavior. These sources can complement one another, but none replaces the others. If the evidence is incomplete, keep the conclusion as “uncertain” rather than filling the gaps with marketing claims.
Accounts and payments: Limit unnecessary links
Start by checking what the signup form actually asks for. If a service explicitly lets you use it without an email address, that removes one account detail that could be used to link activity. It does not mean the service cannot identify an account through orders, access records, or support tickets. Avoid reusing a username associated with your public social accounts.
Use a unique password and store it in a reputable password manager. If you do not add an account recovery method, learn the recovery process in advance and securely keep any necessary recovery details. Giving up the ability to recover an account to share less information has trade-offs.
For payments, first check what information the provider and payment processor each handle. The provider may receive only an order ID and payment status, while the payment institution still keeps legally required transaction records. A payment method does not automatically make a transaction unlinkable; billing, refunds, and support may all create business records.
Subscription links are sensitive credentials too. They often contain an authorization token that may let someone retrieve server configurations or use your account’s data. Do not post a full link in a public forum or submit it to an untrusted online conversion tool. If it is exposed, use the dashboard’s reset option first, then update the configurations on your devices.
After connecting: Check your exit IP, DNS, and routing rules
Local checks can confirm whether the client behaves as expected; they cannot prove how the server retains data. Get a compatible client from official instructions or the dashboard, and make sure it supports the protocols and configuration format in your subscription. A successful import only means the configuration can be read—you still need to check the connection and routing rules.
- ✅ Compare your external IP address before and after connecting. Confirm that traffic you intend to proxy uses the expected exit IP; a changed address does not mean every app is covered.
- ✅ Check the DNS resolution path. If queries that should go through the tunnel still reach your local network’s resolver, review the client’s DNS settings, encrypted DNS in your browser, and routing rules.
- ✅ Review which rules are matched. Rule-based modes may intentionally send local services direct; distinguish an intended direct connection from an unexpected route outside the tunnel.
- ✅ Check how IPv6 is handled. If your device has IPv6 connectivity, confirm that the client and system settings cover it as expected.
- ✅ In a controlled setting, disconnect and switch networks, then check whether the apps in question continue to connect directly. If you need protection against dropped connections, verify exactly what your system and client support.
- ❌ Do not treat a successful speed test, low latency, or a page loading as evidence that no logs are kept.
DNS test results need context. Seeing a public DNS provider may be due to encrypted DNS in your browser or to the tunnel exit. The resolver’s name alone cannot show whether there is a leak; compare the expected route with client logs and system settings. The test site can also see your test requests, so avoid submitting sensitive URLs.
Settings do not transfer directly between platforms. A desktop client’s system proxy may cover only apps that follow proxy settings; TUN mode usually covers more traffic but is still affected by routing and exclusion rules. Mobile VPN extensions, per-app routing, and background policies vary by operating system. Follow the documentation for your specific system and client.
Public Wi-Fi: The limits of a secure tunnel
On public Wi-Fi, an encrypted tunnel can reduce the risk of the local network observing traffic inside it, but it cannot hide everything. The local network may still see that your device connects to a particular service address, along with the timing and volume of traffic. Once traffic reaches the exit, the provider and destination websites each have their own vantage points.
HTTPS still matters. A VPN does not replace website certificate checks, so do not ignore a certificate warning just to get connected. Captive portals usually require you to connect to the network before starting the tunnel. If you are not sure the network is secure, do not rush to enter sensitive account details.
After you sign in to a website, it can still associate your activity with your account, cookies, and browser fingerprint. Changing your exit IP does not clear an existing login session. Malicious extensions, remote management tools, and untrusted root certificates on your device are not problems that switching servers can fix.
Make a decision: Turn promises into questions you can verify
A privacy-first choice does not have to start with finding a louder promise. First decide what you want to protect against: snooping on public networks, unnecessary data retention, or links between your account and activity. Then compare services using the same checklist. Whether a route uses IEPL, a relay, or a direct connection mainly describes the path traffic takes; it does not independently prove a logging policy.
A practical order for comparing providers: First check which data fields are logged and how long they are kept. Then review the evidence and account requirements. Finally, test the client’s exit IP, DNS, routing, and behavior when the connection drops. If the policy and support replies conflict, data handling is unclear, or exceptions are unexplained, pause before choosing.
Apply the same questions when reading VPNGZ’s no-logging policy; do not lower your standards because of a brand label. The value of comparing no-logs VPNs is knowing what has been confirmed, where uncertainty remains, and which risks you can still reduce through your settings and by sharing less data.