The Best No-Logs VPNs for Higher Anonymity

NordVPN is a trustworthy VPN service, based in a safe jurisdiction (Panama). However, it just misses out on being in our top no-logs list because it logs your connection timestamp for 15 minutes after a session ends, before it’s permanently deleted.

NordVPN’s dedicated IP feature is also a cause for concern. It still hasn’t implemented a privacy-friendly token system, and activity is linked directly to your NordVPN account.

Mullvad is another honorable mention. It has a genuine no-logs policy, which was verified in a 2023 server seizure.

During the raid, Mullvad was unable to produce user data for the Swedish authorities, as it doesn’t store any identifying logs.

However, it doesn’t list because it hasn’t completed a third-party audit on its privacy policy or implemented transparency reports.

TorGuard is another great, genuine no-logs VPN service.

Similar to our top picks, it’s zero-logging policy was proven in a copyright court case, in which it was unable to produce identifiable logs, and it has diskless servers that automatically delete any data when unplugged.

However, TorGuard hasn’t implemented a number of other privacy initiatives that are present in our recommendations: transparency reports, logging policy audits, or open-source software.

IVPN doesn’t have diskless servers and the no-logs policy hasn’t been proven in a real-world case, so we can’t be 100% sure it’s truthful. It’s also got a relatively small server network of only 40 countries.

Additionally, IVPN automatically saves device information on mobile for crash logs.

As an example, we’ll go through NordVPN’s website and compare it to the privacy policy. NordVPN markets itself as a “zero-log VPN service” on its website.

NordVPN’s website states that it’s a zero-logs VPN service.

But in reading NordVPN’s privacy policy, we found it does store some sensitive data — as most VPNs will do. Importantly, it’s specified that NordVPN saves your username and a timestamp of the last session status.

This would be worrying if it were stored for a long time. However, NordVPN’s privacy policy clarifies that this data is promptly deleted within 15 minutes of your session ending.

NordVPN’s privacy policy classifies this data as needed to provide its VPN service.

The average VPN user shouldn’t be worried as the chance of this data being leaked within 15 minutes is extremely low.

However, it does show the fine line between what VPNs claim to be no-logs and what they actually do log.

In this case, NordVPN defines itself as no-logs because even though it does collect some data, it is deleted after a session is terminated.

We recommend VPNs keep no activity or connection logs, or VPNs that anonymize and aggregate this data.

The problem with no-logs VPN policies is that they are virtually impossible to prove from the outside. That’s why some VPNs hire external auditors to pick apart their no-logging policies and server infrastructure.

In theory, a third-party checking whether a server keeps logs will prevent bias and manipulation of audit results.

But VPNs can manipulate results in an audit by only showing a specific server that’s been wiped clean while the rest are full of stored data.

Limitations of an audit outlined in IVPN’s No-Log 2019 Audit.

There’s also no guarantee that a server free of sensitive information over the two-week audit period will not start collecting data after the audit is concluded.

Even if a VPN carries out an extensive third-party audit, which provides major vulnerabilities to fix, the VPN can refuse to release it to the public if the results are negative.

In short, an external audit shows a VPN’s strong commitment to transparency and a private logging policy. But it doesn’t guarantee that an entire server network is completely free of sensitive information.

When you connect to a physical VPN server, any data you transmit is stored inside physical hard drives until it’s manually erased.

If the servers are seized by law enforcement or hacked, and the data hadn’t been erased, they could have access to any data kept inside.

To prevent this vulnerability, some VPNs use diskless server that erase data automatically on a regular basis or when a server is being seized.

RAM (or Random Access Memory) is a type of short-term computer memory that needs a constant source of electricity to keep the information.

If the server is shut down or rebooted, it instantly deletes all the information stored inside.

A diskless network is much more private than a hard drive server network.

However, they’re very rare in VPNs. Only a select few have the resources to implement this advanced server infrastructure.

PIA implemented RAMDisk servers in June 2020.

There are also third-party customer service providers (such as Zendesk) and payment companies (e.g. Stripe or PayPal) that might be collecting data.

Live chat customer support services in particular can log your IP address, email address, and device information during a conversation.

This will likely be addressed in a VPN’s privacy policy if it’s a high-quality service — but isn’t always easy to find.

A payment company that handles online subscription payments may also have access to your full name, address, and other billing information.

This isn’t necessarily bad, as many financial institutions that process these transactions are regulated by national financial authorities.

It’s also necessary for these companies to take this information in case you want to request a refund at the end of a money-back guarantee period.

A VPN might collect anonymous aggregated data or server load data in order to prevent product abuse and maintain fast speeds.

A VPN might also collect information to create an account or collect a subscription payment if you don’t use an anonymous payment method.

Lastly, most VPNs collect some sort of device information data to limit the amount of device per subscription. In these cases, collecting data in a way that means it can’t be traced back to a single user can be acceptable.

In 2013, an encrypted email service, Lavabit, shut down its service to avoid having to “be complicit with crimes against the American people.” Alongside Lavabit, Silent Mail shutdown its service before it could receive any warrants or subpoenas from the US government.

In 2018, the Australian government passed an anti-encryption law, enabling it to silently perform mass-surveillance on its citizens. Additionally, any tools companies have to develop to allow the government access to user data could be a gold mine for sophisticated hackers.

Recently in 2022, India attempted to instate a new data privacy law that would force VPN providers to log user data for up to five years. Following backlash from VPN providers, in which ExpressVPN and Surfshark removed its Indian servers, the data law has been postponed indefinitely.

Some free VPNs will collect user data and sell it to advertisers instead of charging a subscription fee. This is extremely dishonest and unethical, especially if the VPN claims to be a zero-log VPN or privacy-first service.

That’s why it’s so important to use free VPNs that have been verified as safe.

However, it goes beyond just collecting a user’s browsing activity and IP address when connected to a VPN. Only three out of the top 20 free VPNs on iOS we tested respected a users’ decision to block advertisers from tracking user activity outside of the VPN app.

A VPN with a poor technical infrastructure is vulnerable to attacks and can unknowingly leak your data.

As an example, in June 2021, Ukrainian authorities seized two of Windscribe’s OpenVPN servers as part of an ongoing investigation. It turned out that the servers were running an outdated configuration, with unencrypted OpenVPN server configuration and key.

• Test Conducted: Research the VPN’s company history and record whether there have been any server seizures, hacks, leaks, or legal data requests.
• Why It’s Important: It’s the most reliable way to tell whether a VPN is truthful in its logging policy, and the security of its servers and apps.
• Optimal Result: Examples where the VPN has been unable to provide data to third parties due to its no-logs policy.

• Test Conducted: Analyzed the privacy policies of each VPN to identify what data points are being stored, for how long, and whether they’re aggregated or anonymized.
• Why It’s Important: Privacy policies reveal whether a VPN actually adheres to its no-logs claim or secretly collects identifying user data.
• Optimal Result: The VPN stores no identifying activity or connection logs and protects user privacy.

• Test Conducted: Researched VPNs to find out whether they had diskless VPN servers.
• Why It’s Important: Diskless servers do not store data persistently, meaning if they are unplugged from the power source, all data on the server is permanently deleted. This makes it almost impossible for law enforcement to seize information like they can with physical servers.
• Optimal Result: A full diskless VPN server network.
  

• Test Conducted: Researched VPNs to find out whether any logging policy audits by third parties like Cure53 or Deloitte have been conducted and analyze them thoroughly.
• Why It’s Important: Audits from external parties can prove whether a VPN is actually sticking to its logging policy.
• Optimal Result: The VPN conducts yearly audits to prove it is not logging activity or connection logs over time.

• Test Conducted: Researched each VPN’s jurisdiction and data privacy laws of each region.
• Why It’s Important: Where a VPN is incorporated will affect its legal obligation to log and store data, or even share it with governmental authorities.
• Optimal Result: A privacy-friendly jurisdiction like the British Virgin Islands or a watertight no-logs policy that’s been independently audited and verified in a real-world case.