Blog
Why 'no logs' actually matters — and how to tell if a VPN means it
Every VPN on Earth advertises “no logs”. It’s the cheapest possible thing to claim and the hardest to disprove. So when you’re shopping for a VPN, the question isn’t does this provider claim no logs — it’s can they prove it.
What “logs” can actually mean
When a VPN provider says “we don’t log”, they could mean:
- No traffic logs. They don’t record what websites you visit or what data you send.
- No connection logs. They don’t record your real IP, the time you connected, or the server you connected to.
- No metadata at all. Truly nothing — not even diagnostic counters at the per-user level.
These are very different things. Most “no-logs” providers mean (1). Some mean (1) and (2). Very few mean (3). The marketing page rarely tells you which.
How to verify the claim
Three signals matter more than the copy on the homepage:
- Independent audits. Has a real third party (Deloitte, PwC, KPMG, Cure53) inspected the infrastructure end-to-end and published a report? An unredacted report, with the methodology described in detail, is the only thing that should move the needle.
- Court records. Has the provider been subpoenaed? If yes, what happened? A VPN that has been compelled to produce logs and produced nothing useful has stress-tested the claim in the most expensive way possible.
- RAM-only servers. Volatile-memory boots mean every reboot wipes the server clean. There is literally no persistent storage for logs to live on.
What to ignore
- “100% audited!” without naming the auditor or linking the report.
- “No-logs policy” as a phrase, with no further detail.
- “We comply with all government requests.” (Translation: we keep what we need to keep.)
Where PhoenixVPN stands
We’ve been audited by Deloitte twice — in 2021 and 2024. Both reports are public, both unredacted. We run RAM-only across the fleet. Our jurisdiction is outside the 14-Eyes alliance. And we’ve published a warrant canary since day one.
If you’re shopping for a VPN, ask any provider to point you at their audit report. If they can’t, it’s not because they have nothing to hide — it’s because nobody has actually checked.