Reading a VPN no-logs policy: which fields are actually named?

Open the privacy notice, not the pricing page, and search it for the word "log". What comes back is usually a sentence about not storing browsing history, which answers a narrower question than the one being asked. A useful policy names categories, says how long each is kept and identifies who is making the promise. Walk the document in four passes and write down what it does not say.

Start with the notice, not the slogan

The marketing claim is a summary written by the same team that wrote the notice, so the notice is the primary document. Download it, keep a copy with the date, and read it as a list of data categories rather than as prose. Anything not listed is an open question, not an implicit no.

Look for a table or a section per category: connection metadata, account information, payment records, diagnostics, support correspondence. Providers that separate them are easier to evaluate than providers that describe "logs" as one object.

A short notice is not automatically better. Brevity often means the categories were merged, which makes retention and third-party sharing impossible to check. The most useful notices are dull and repetitive, with one paragraph per category and a date at the top. Dull is a good sign here.

Name the fields one by one

For connection data, the interesting fields are the source address, the assigned tunnel address, timestamps, bytes transferred and the destination. A statement about not recording visited sites says nothing about timestamps or volume, and those are exactly what an investigator would ask for.

Account data is a separate category even when the client never shows an account screen. Subscription status, email address, payment processor references and support tickets can all exist without a visible login.

Diagnostics deserve their own line. Crash reports, optional telemetry and manually submitted support bundles can contain far more than the connection metadata the policy promises not to keep. Read what a bundle includes before you send one. If the notice never mentions diagnostics, ask the operator rather than assuming the category is empty.

grep -n -i -E 'retain|retention|store|log|IP address|session|third part' policy.txt

Saving the notice as text and grepping it is faster than scrolling and harder to skim past. The line numbers also give you something to quote when the answer matters. If the notice is only published as a web page, save the rendered text rather than the HTML, so a later redesign does not erase your evidence.

Find retention and the party who owns it

For each category, the notice should say what happens after processing: immediate disposal, short retention, aggregation, or storage tied to an account. A retention period without a category is uninterpretable, and a category list without a lifecycle is half a policy.

Then identify who is promising. The brand selling the subscription, the developer of the client, the company hosting the servers and the operator of an individual endpoint can be four different parties. Check which one the promise covers and which one your traffic actually reaches.

Encryption at rest is not the same property as not collecting. Stored records that a system can decrypt on request are still records, and tunnel encryption does not stop the endpoint from processing a connection. Collection and protection are separate questions and should be scored separately.

Decide what the evidence covers

An audit is evidence about a scope: named systems, a configuration, a period and an auditor. Read the scope before extending the conclusion to every server or to the future. A report about one region's infrastructure says little about a newly added location.

Open-source clients are useful for checking what the software can send, and they say nothing about how a particular deployment is configured. Both facts matter, and neither substitutes for the other.

Finish with a one-page comparison: operator, connection records, account data, diagnostics, retention, evidence and jurisdiction. Then note the unanswered questions explicitly, because an omission is not proof of misconduct and it is not an assurance either. A decision made on named fields beats one made on the shortest slogan.