What a No-Logs VPN Claim Covers, and What Exists Anyway
A no-logs VPN is a service whose operator states that it does not retain records of the connections it carries. That is a claim about retention, not about visibility. For a packet to leave your device, reach a site, and come back to you rather than to somebody else, the machine at the far end of the tunnel has to know your address and the address you asked for at the same moment — so “no logs” can mean nothing was written down and kept, and it can never mean the operator was not in a position to know.
The mapping the tunnel cannot function without
When you connect, your device gains a second address on a virtual adapter, and the traffic leaving the exit server carries a third: the server’s own public address, shared with everyone else on it. That arrangement is described in why a VPN gives you two IP addresses, and it has a consequence people rarely follow through.
The exit server is performing a translation. Requests arrive from you over the tunnel, go out under its address, and the replies come back to it. To hand each reply to the right tunnel, it maintains a table associating your session with the destinations you opened. That table exists in memory for as long as the connection does. There is no design in which it does not, because without it the server has no way to tell your traffic from the traffic of everyone else sharing that address.
So the operator is structurally the one party that sees both ends. Everything a no-logs claim can offer is about what happens to that state afterwards: whether it is written to disk, whether it survives the session, whether it survives a reboot, and whether anything ties it back to your account.
Visibility and retention answer different questions
It is worth separating what the exit machine is placed to observe from what a policy commits to about keeping it.
Content is largely handled elsewhere. Traffic to modern sites is already encrypted end to end, so the operator sees ciphertext rather than pages, exactly as your access network would.
Destination names are a different matter. If name lookups go through the tunnel to the provider’s own resolver, which is normally the default, then the provider is the party that sees every hostname you request. Even without that, the hostname is often announced in the clear at the start of a connection, which is the whole point of SNI. Moving your traffic into a tunnel does not delete that field; it changes who is standing next to it.
And then there is the tunnel’s own bookkeeping — the entries the exit machine keeps in order to route replies to you rather than to the next customer. That is not content and it is not really observation either; it is working state, and it is the thing a retention policy is actually about.
What would actually have to be reconstructed
A service obviously holds business records — you have an account with it and you paid it something — and no serious version of the claim pretends otherwise. The interesting question is narrower and comes straight out of the translation described above: what would somebody need in order to connect a subscriber to an outbound connection after the fact?
Three fields, and they are unglamorous. The shared public address the connection left from. The port number the exit machine assigned to it, which is what distinguishes your session from everyone else’s on that address. And a timestamp, because the same port is handed to somebody else minutes later. Given those three plus a record on the provider’s side associating them with an account, the link is arithmetic. Missing any one of them, it is guesswork.
This is why the only number in a retention policy that means anything is a duration. The mapping exists while you are connected either way; the whole question is whether it survives the session, and for how long. A policy that says nothing about duration has not answered the question that its heading implies it has.
The one property you cannot test from your own machine
Most privacy properties of a tunnel are observable from where you are sitting. You can confirm the exit address is not yours. You can confirm lookups are not escaping to your access network’s resolver. You can watch what happens when the connection drops. You can compare a route before and after connecting.
Retention has no equivalent. A record that was never created and a record sitting on a disk you cannot reach look identical from your side. That asymmetry is why the phrase carries so much marketing weight: it is the one claim in the category a customer cannot falsify, so there is no cost to making it loudly.
Where the claim genuinely changes your exposure
Two practical points follow, and both are more concrete than the slogan.
The first is that a shared exit address does part of the work. When many people leave through one address, singling out a single session usually requires records connecting that address and that moment to an account. A provider holding none makes that link hard to produce. This is also why paying extra for an exit address nobody else uses quietly undoes some of the benefit: an address only you use is a durable identifier that no retention policy offsets.
The second is that the claim is about the operator alone. It says nothing about the site you signed into, the account you used, or anything your device volunteers on its own. Retention at the tunnel is one link in a chain, and the strongest possible link there does not make the chain shorter.
Holding the claim at the right size
Read it as a statement about record-keeping by one company, made by that company. Check whether the document distinguishes what is seen from what is stored, and whether it says anything about how long. Assume account and payment data exist regardless. Assume the operator can see destination names unless you have deliberately moved resolution elsewhere. Treat an emphatic phrase on a landing page as advertising, then go looking for the language in the policy that would actually constrain the company — the subject of which words do the work in a VPN logging policy — and for the scope of any outside examination, in what gets examined when a VPN says it was audited.