How to Check if a VPN Keeps Logs: 7 Tests

Almost every VPN says "no logs". The phrase has no legal definition, and nobody outside the company can see its servers. So how do you know? You can't be certain, but you can gather evidence. Here are seven tests, from the five-minute check to the strongest proof.

What "logs" actually means

VPN logs fall into three groups:

• Activity logs: sites visited, DNS queries, traffic content. A privacy VPN should never keep these.
• Connection logs: when you connected, from which IP address, to which server, how much data. Many "no-logs" VPNs keep some of this, at least briefly.
• Account data: email, payment records, device count. Needed to run a subscription. The less, the better.

A "no logs" claim that only covers activity logs can still let a VPN link a session back to you through connection logs.

Test 1: Read the policy for specifics

Open the VPN's privacy policy and search for: "log", "IP address", "timestamp", "retain", "aggregate", "third party", "law enforcement".

Good signs:

• A list of what's not collected: browsing history, DNS queries, traffic, source IP, connection timestamps.
• A short retention period for anything that is kept, with the reason.
• A plain statement of what's handed over if a court asks: "we have nothing to give".

Red flags:

• "We may collect information to improve our services" with no detail.
• Sharing with "partners" or "affiliates".
• Different claims on the marketing page and in the policy. The policy wins.

Test 2: Find the legal entity and jurisdiction

The terms of service name the company that runs the VPN. Search that name in the national company registry or OpenCorporates, and look for a parent company. The jurisdiction decides which courts can order data. The parent decides whose incentives you're trusting. (See: who owns VPN review sites.)

Test 3: Look for an independent audit

An audit means an outside security firm checked the servers, code or processes against the policy. Look for:

• The auditor's name and a link to the report, not just a badge.
• What was in scope: the whole infrastructure, or one server?
• The date. An audit from four years ago says little about today's setup.

No audit doesn't prove logging, but a published, recent, full-scope audit is strong evidence.

Test 4: Check court records and police requests

The best proof is when the claim was tested by someone with a warrant.

• Private Internet Access said in a 2016 FBI case that it had no logs to give, and the court documents backed that up (TorrentFreak). It happened again in 2018 (TorrentFreak).
• PureVPN advertised no logs, yet in 2017 its records helped the FBI link a suspect to his home and work IP addresses (TorrentFreak).

Search "[VPN name] subpoena", "[VPN name] court", and "[VPN name] logs FBI".

Test 5: Look for raids and seizures

When police seize a VPN's servers or visit its office, the outcome is public evidence. In 2023, Swedish police came to Mullvad's office with a search warrant. Mullvad says they left without customer data because none existed (Mullvad). Check whether the VPN publishes these events or a transparency report.

Test 6: Check the app itself

• App Store privacy label: on iPhone, scroll to "App Privacy" on the app's page. "Data Linked to You" or "Data Used to Track You" on a VPN deserves a question.
• Permissions: a VPN needs network access. It doesn't need contacts, photos or precise location.
• Trackers: the 2016 CSIRO study found 75% of 283 Android VPN apps carried third-party tracking libraries (CSIRO). Tools like Exodus Privacy list trackers in Android apps.

Test 7: Run leak tests

Leaks aren't logs, but they show whether your data is going where the VPN says.

1. Connect the VPN.
2. Visit an IP check site. It should show the VPN's IP, not yours.
3. Run a DNS leak test. The resolvers shown should belong to the VPN, not your ISP.
4. Check IPv6. If your network has IPv6, make sure it's also tunneled or blocked. The CSIRO study found 84% of apps leaked IPv6 traffic.
5. Disconnect Wi-Fi briefly and reconnect. Watch whether traffic goes out before the VPN comes back.

Score it

How Buycat VPN measures up

We'll hold ourselves to the same test. Buycat VPN's privacy policy states that we don't store browsing history, DNS queries or traffic content. The legal entity is Boycat with no parent conglomerate. We haven't published a third-party audit yet, and we'll link the report here when we do. Until then, judge us on the policy wording and run the leak tests yourself, inside our 30-day money-back window.