FAQs

How Do I Research a VPN Logging Policy?

When researching a VPN’s privacy policy, look out for these three things:

  1. What types of data does the VPN store?
  2. Is the data stored aggregated and anonymized?
  3. How long is this data stored for?

It’s best to avoid a VPN that has an excessively short privacy policy or ambiguous terms that don’t address these three things.

As an example, we’ll go through NordVPN’s website and compare it to the privacy policy. NordVPN markets itself as a “zero-log VPN service” on its website.

NordVPN's website.

NordVPN’s website states that it’s a zero-logs VPN service.

But in reading NordVPN’s privacy policy, we found it does store some sensitive data — as most VPNs will do. Importantly, it’s specified that NordVPN saves your username and a timestamp of the last session status.

This would be worrying if it were stored for a long time. However, NordVPN’s privacy policy clarifies that this data is promptly deleted within 15 minutes of your session ending.

NordVPN's Privacy Policy that states it stores your username and timestamp of when you logged in for 15 mins after a session finishes

NordVPN’s privacy policy classifies this data as needed to provide its VPN service.

The average VPN user shouldn’t be worried as the chance of this data being leaked within 15 minutes is extremely low.

However, it does show the fine line between what VPNs claim to be no-logs and what they actually do log.

In this case, NordVPN defines itself as no-logs because even though it does collect some data, it is deleted after a session is terminated.

Are Independent Logging Audits Important?

The problem with no-logs VPN policies is that they are virtually impossible to prove from the outside. That’s why some VPNs hire external auditors to pick apart their no-logging policies and server infrastructure.

In theory, a third-party checking whether a server keeps logs will prevent bias and manipulation of audit results.

But VPNs can manipulate results in an audit by only showing a specific server that’s been wiped clean while the rest are full of stored data.

There’s also no guarantee that a server free of sensitive information over the two-week audit period will not start collecting data after the audit is concluded.

Even if a VPN carries out an extensive third-party audit, which provides major vulnerabilities to fix, the VPN can refuse to release it to the public if the results are negative.

In short, an external audit shows a VPN’s strong commitment to transparency and a private logging policy. But it doesn’t guarantee that an entire server network is completely free of sensitive information.

What Are Diskless VPN Servers?

When you connect to a physical VPN server, any data you transmit is stored inside physical hard drives until it’s manually erased.

If the servers are seized by law enforcement or hacked, and the data hadn’t been erased, they could have access to any data kept inside.

To prevent this vulnerability, some VPNs use diskless server that erase data automatically on a regular basis or when a server is being seized.

RAM (or Random Access Memory) is a type of short-term computer memory that needs a constant source of electricity to keep the information.

If the server is shut down or rebooted, it instantly deletes all the information stored inside.

A diskless network is much more private than a hard drive server network.

However, they’re very rare in VPNs. Only a select few have the resources to implement this advanced server infrastructure.

Do Live Chat Services & Payment Processors Collect Data?

VPN services may use third-party customer service providers (such as Zendesk) and payment processing companies (like Stripe or PayPal) that may collect your data.

Live chat services in particular can log your IP address, email address, and device information during a conversation.

Respectable VPN services will address this in their privacy policy, but it isn’t always easy to find.

A payment company that handles online subscription payments may also have access to your full name, address, and other billing information.

This isn’t necessarily bad, as many financial institutions that process these transactions are regulated by national financial authorities.

It’s also necessary for these companies to take this information in case you want to request a refund at the end of a money-back guarantee period.

Follow these steps to stay anonymous with VPN third parties:

  1. Register with a fake name and throwaway email address.
  2. Use an anonymous payment method, such as a gift card, virtual credit card, cryptocurrencies, or cash.
  3. Only contact customer service using a PGP key or throwaway email if you have any questions.