Every provider in our 20-service sample made some form of no-logs or activity-logging claim. But the scope, recency, public accessibility, and independent support behind those claims varied substantially.
Direct Answer
Some VPNs say they do not retain browsing activity, DNS requests, traffic content, or source IP addresses. That does not mean they process no data at all. Across the 20 providers we reviewed, all made some form of no-logs or activity-logging claim, while all also disclosed processing at least some account, payment, device, diagnostic, bandwidth, connection, anti-abuse, or support data. Fourteen had some form of independent no-logs, privacy-practice, or technical-privacy verification, but only seven entered our strongest public-evidence group.
This report compares publicly available evidence as of October 30, 2026. It does not independently test the providers’ live servers or guarantee their future behavior.
Publisher disclosure: This report was produced by BearVPN, a VPN provider. BearVPN was excluded from the 20-provider sample and all percentages. We reviewed public policies, assurance reports, transparency materials, and documented events; we did not inspect the providers’ internal systems or reproduce their audits.
Key Findings at a Glance
- 20 of 20 made a claim. Every sampled provider made some form of no-logs or activity-logging promise, although the wording and exclusions were not equivalent.
- 14 of 20 had independent evidence. We located some independent no-logs, privacy-practice, or technical-privacy verification for 14 providers.
- 7 of 20 entered the strongest public-evidence group. These providers had sufficiently recent evidence whose scope and conclusions were publicly reviewable.
- 11 of 20 had confirmed recurring transparency reporting. IPVanish stated that it publishes quarterly Trust Center materials, but we could not directly confirm access during collection, so it was not counted in the 11.
- All 20 disclosed some data processing. “No logs” did not mean that no account, operational, diagnostic, or connection-related data was ever processed.
These figures describe a purposive sample of 20 consumer VPN providers, not the entire VPN market. The groups describe the public evidence available for review; they are not security scores or guarantees of current server behavior.
Quick Comparison: The Evidence Behind 20 VPN No-Logs Claims
The table compares independent verification, report accessibility, recurring transparency reporting, and examples of data the provider says it still processes. Claim wording and scope are explained in the provider notes below. “Not found” means we did not locate qualifying public evidence in the sources reviewed; it does not prove that the evidence or practice does not exist.
Evidence checked: October 30, 2026
The detailed workbook is available here: https://cms.bearvpn.com/wp-content/uploads/2026/11/vpn-no-logs-public-evidence-20-providers-2026-10-30.csv.
What Does “No Logs” Actually Mean?
“Logs” can refer to several different categories of information, and a policy may exclude one category while allowing another.
- Traffic or activity logs can include browsing destinations, DNS requests, traffic content, downloaded files, or the services a user accesses.
- Connection logs can include a source IP address, assigned VPN IP address, VPN server location, connection time, or session duration.
- Temporary connection processing can include information held in memory to maintain an active session, enforce connection limits, or prevent abuse.
- Account and payment data can include an email address, subscription status, transaction identifier, or refund record.
- Device and diagnostic data can include an app version, operating system, crash report, error code, or performance event.
- Support and abuse-prevention data can include messages a user sends to support, fraud signals, or records related to a security incident.
A provider may accurately state that it does not retain browsing activity while still processing account details, subscription records, crash reports, bandwidth totals, or temporary connection state. The more useful questions are: Which data is involved? Why is it processed? How long is it retained? Can it be linked to a user or a particular VPN session?
That distinction also matters when reading policies. Our separate review of how VPN privacy policies disclose retention periods examines whether policies give a numerical period, an account-deletion trigger, or only general wording.
How We Reviewed the 20 Providers
Sample selection
We selected 20 consumer VPN services that represented a mix of widely known free and paid products, company sizes, disclosure styles, and evidence depth: Proton VPN, NordVPN, ExpressVPN, Mullvad, IVPN, Surfshark, Private Internet Access, CyberGhost VPN, IPVanish, Windscribe, TunnelBear, hide.me, Hotspot Shield, VyprVPN, PureVPN, Mozilla VPN, Astrill VPN, Norton VPN, Avast SecureLine VPN, and Bitdefender VPN.
This was a purposive sample, not a random sample of the worldwide VPN market. BearVPN was excluded because it publishes this report.
Sources reviewed
For each provider, we looked for official privacy policies, terms, no-logs explanations, support pages, independent assurance or audit reports, transparency reports, legal-request statistics, and documented court, server-seizure, or law-enforcement events. Where report access was restricted, we recorded the restriction rather than treating the report as fully public.
What we coded
We recorded the provider’s stated exclusions, connection metadata treatment, data still processed or retained, independent assessor, assessment year and scope, report accessibility, recurring transparency reporting, documented real-world evidence, and important conflicts or limitations.
Public-evidence groups
- Recent and publicly reviewable: relatively recent independent no-logs or privacy-practice evidence with scope and conclusions that the public could review.
- Verification with limitations: independent evidence existed, but access, age, detail, or scope was limited.
- Policy or supporting evidence only: policies, transparency materials, real-world events, infrastructure reviews, or security audits were available, but we did not locate a qualifying dedicated no-logs verification.
These groups describe public evidence, not a provider’s overall security, speed, ownership, or product quality. A security audit was not reclassified as a no-logs audit unless its documented scope covered the relevant logging controls.
“Not found” means that we did not locate qualifying evidence in the sources reviewed. It does not prove that no such document or practice exists. Likewise, an assessment is evidence about a defined scope and period, not a permanent guarantee.
Finding 1: Every Provider Made a Claim, but the Claims Were Not Equivalent
All 20 providers made some form of no-logs or activity-logging claim. The similarity ended there.
Some policies explicitly excluded browsing history, DNS requests, traffic content, source IP addresses, assigned VPN addresses, exact timestamps, and session duration. Others used narrower wording. Hotspot Shield, for example, stated that browsing activity was not stored in a way associated with a unique user, while also disclosing session, bandwidth, device, approximate-location, and advertising-related data. That is an association-based promise, not a statement that nothing is collected.
Temporary processing also mattered. Surfshark disclosed that a server connection user ID and timestamp could be retained for up to 15 minutes after a session. Windscribe and hide.me described connection state or IP processing in memory during an active session. Astrill disclosed that it retains the last 20 connection records, including fields such as time, duration, country, device, and app version.
These practices are not interchangeable. Temporary in-memory state should not be described as long-term storage, but it should not be omitted from a report about what “no logs” means. A homepage badge alone cannot answer the question.
Finding 2: 14 Had Independent Evidence, but Only Seven Entered the Strongest Public-Evidence Group
We located some form of independent no-logs, privacy-practice, or technical-privacy verification for 14 of the 20 providers. Seven had evidence that was recent and publicly reviewable enough to enter the strongest group: Proton VPN, ExpressVPN, Surfshark, Private Internet Access, CyberGhost VPN, hide.me, and Norton VPN.
Seven more had verification with a meaningful limitation: NordVPN, IVPN, IPVanish, Hotspot Shield, VyprVPN, PureVPN, and Bitdefender VPN. The limitation was not the same in every case. It could be an old assessment, an account requirement, a public summary rather than a detailed report, an unnamed assessor, a narrow scope, or restricted access to the full document.
The remaining six—Mullvad, Windscribe, TunnelBear, Mozilla VPN, Astrill VPN, and Avast SecureLine VPN—had policies or supporting evidence, but we did not locate a qualifying dedicated no-logs verification. Some had valuable security or infrastructure audits. Those reports can support security transparency without answering the same question as a review of server-side logging controls.
Placement in the second or third group does not establish that a provider logs browsing activity. It means the public evidence did not meet the stronger group’s combination of recency, scope, and reviewability.
Finding 3: Recency and Public Access Changed What Readers Could Verify
Ten providers had independent verification or an official verification claim dated from 2024 through 2026. A recent date was useful, but it was not enough by itself. Readers also needed to know what was examined and whether they could inspect the supporting material.
NordVPN’s sixth Deloitte assessment was completed in 2025, but the full report required a Nord Account. ExpressVPN made a substantive KPMG report available after the reader accepted access terms. CyberGhost’s 2025 Deloitte report was available after a disclaimer page. IPVanish publicly announced a 2025 Schellman assessment, while access to the full report appeared restricted.
Bitdefender stated that its infrastructure, systems, configuration, and processes were independently verified in 2025, but the public page did not name the assessor or provide the detailed report. At the other end of the timeline, IVPN’s dedicated no-logs audit was from 2019 and VyprVPN’s from 2018. Those assessments remain relevant historical evidence, but they should not be presented as equivalent to a recent review of current systems.
Public access is therefore a separate transparency question. “Audited” tells a reader less than the combination of assessor, date, scope, assurance type, findings, remediation, and report access.
Finding 4: Independent Verification and Transparency Reporting Answered Different Questions
An independent assessment examines defined systems, controls, statements, or samples at a particular time. A transparency report records how a provider says it handled legal requests, government demands, copyright notices, or similar events over a reporting period.
In our sample, 10 providers had both independent verification and confirmed recurring transparency reporting. Four had independent verification but no current recurring transparency report we could confirm. Windscribe had confirmed recurring transparency reporting but no qualifying formal no-logs assurance. Five had neither category confirmed as current.
IPVanish stated that its Trust Center publishes quarterly materials, but direct access could not be confirmed during this review, so it remained in the “not confirmed as current” column. Older reports whose continuity we could not establish were treated the same way.
Neither category is a permanent guarantee. Together, however, they answer different and complementary questions: what an assessor reviewed, and what a provider reports happening when outside parties ask for information.
Finding 5: “No Logs” Did Not Mean “No Data Processing”
All 20 providers disclosed processing at least some account, payment, device, diagnostic, bandwidth, concurrent-connection, anti-abuse, or support information. That finding does not mean all of the data creates the same privacy risk. An email address, a crash report, an aggregate server load metric, and a browsing history are different data types with different uses and retention periods.
At least four providers explicitly disclosed retaining some connection events or session metadata. Astrill described the last 20 connection records. Norton described connection events by day and VPN location retained for 12 months, alongside other app and volume metrics. Avast disclosed connection and disconnection time, duration, and bandwidth, although the current material we located did not state a current retention period. Hotspot Shield disclosed session duration and bandwidth while framing its promise around not associating browsing activity with a unique user.
PureVPN said it retained the connection date but not the exact connection time. Mozilla distinguished VPN network activity from IP addresses that could appear in Mozilla service or server logs for 90 days. Surfshark, hide.me, and Windscribe described forms of temporary connection processing rather than permanent browsing-history storage.
The finding is not that “no-logs VPNs secretly log everything.” It is that the phrase is too broad to evaluate without reading the fields, purpose, retention, and linkability described in the policy.
App-store privacy labels answer another, narrower question. Our study of what free VPN apps disclose in their iOS privacy labels should not be treated as a substitute for server-side logging policies or infrastructure verification.
What Each Provider’s Public Evidence Shows
The notes below summarize the most important public evidence and limitation for each provider. They are not product recommendations.
More Recent and Publicly Reviewable Evidence
CyberGhost VPN
According to CyberGhost’s privacy policy, it does not retain browsing history, traffic destinations, content, search preferences, IP addresses, or DNS queries. Deloitte Audit SRL issued a limited-assurance report covering defined infrastructure and processes as of October 31, 2025. The report was publicly downloadable after a disclaimer page and did not provide assurance for other periods.
ExpressVPN
According to ExpressVPN’s privacy policy, it does not retain activity logs or specific connection fields such as source IP, outgoing VPN IP, exact timestamps, or session duration. KPMG’s 2025 ISAE 3000 work covered privacy-policy and TrustedServer controls. The report access page required acceptance of KPMG’s terms.
hide.me
According to hide.me’s no-logs explanation, the service does not retain identifying VPN activity. It says a real IP address is processed in memory during an active session but not retained. Securitum’s 2024 infrastructure review examined VPN containers, logging behavior, and user-to-server association controls; the public document summarized the methodology and conclusions.
Norton VPN
According to Norton’s product privacy notice, it excludes browsing history, traffic destinations, device IP, session duration, and DNS queries from the VPN logs described. VerSprite’s 2025 executive summary covered backend infrastructure and confirmed remediation of initial issues, but excluded Windows, macOS, iOS, and Android clients.
Private Internet Access
According to PIA’s privacy policy, the service excludes browsing history, traffic content, source and destination IPs, DNS queries, and VPN servers used. Deloitte Audit SRL’s 2024 limited-assurance report covered VPN and distribution servers, deployment, operational controls, and the Dedicated IP token design at a point in time.
Proton VPN
According to Proton VPN’s no-logs policy, the service does not retain browsing activity, DNS requests, traffic content, session length, location, or user-to-server association. Securitum’s 2026 assessment covered production VPN servers and logging-related controls across regions and tiers. Proton also maintains an official transparency report.
Surfshark
According to Surfshark’s privacy policy, the service excludes IP addresses, browsing history, traffic, bandwidth, and DNS activity from long-term logging. It also discloses that a server connection user ID and timestamp can be retained for up to 15 minutes after a session. Deloitte Lithuania’s 2025 ISAE 3000 report covered several server modes, configuration, deployment, and privacy procedures.
Verification Exists, but Access, Age, or Detail Is Limited
Bitdefender VPN
According to Bitdefender’s 2025 statement, an independent review covered infrastructure, systems, configuration, and processes and supported its no-logs conclusion. The public page did not name the assessor or provide a detailed report. An older Pango-platform summary does not automatically establish the practices of Bitdefender’s own client and account systems.
Hotspot Shield
According to Hotspot Shield’s VPN privacy policy, VPN browsing activity is not stored in a way associated with a unique user. The policy also describes IP processing at connection, session duration, bandwidth, anonymized domains, device, diagnostic, approximate-location, and advertising data. Aon’s public material was a summary, and we did not confirm a current recurring transparency series.
IPVanish
According to IPVanish’s 2025 corporate announcement, Schellman assessed its no-logs practices, including traffic, activity metadata, DNS, user IP, accessed services, servers, regions, and subscription tiers. The assessment was confirmed, but the full report and current Trust Center materials were not directly accessible during our review. Historical law-enforcement evidence relates to prior ownership and should not be merged with the current assessment.
IVPN
According to IVPN’s privacy policy, it does not retain traffic, DNS, customer IP, connection timestamps, session duration, or bandwidth logs. Cure53 completed a dedicated no-logging audit in 2019. IVPN says later annual work is security auditing, not a newer no-logs verification, so the 2019 date remains the relevant one here.
NordVPN
According to NordVPN’s published materials, the service says it does not retain online activity or connection logs. Its sixth Deloitte Lithuania assessment was completed in 2025 under ISAE 3000 (Revised), covering standard VPN, Double VPN, Onion Over VPN, obfuscated servers, and related controls. The official announcement was public, but the full report required a Nord Account.
PureVPN
According to PureVPN’s privacy policy, it excludes browsing, traffic content, DNS, origin IP, assigned VPN IP, and exact connection time, while retaining the connection date and some account or operational data. KPMG’s 2023 public letter described sampling across seven servers and related infrastructure. A 2017 event predates the current policy framework and should be dated as historical context.
VyprVPN
According to VyprVPN’s no-log page, the current service says it excludes websites, communications, activity, source IP, assigned VPN IP, and server-connection information. Leviathan Security Group’s 2018 assessment was publicly available and examined VPN, authentication, API, code, configuration, and exceptional logging paths. We did not locate a newer independent dedicated no-logs assessment.
Policy or Supporting Evidence, but No Qualifying Dedicated Verification Located
Astrill VPN
According to Astrill’s privacy policy, it excludes websites and online activity but processes IP, time, device, and app information during an active session. Its materials also describe total traffic and the last 20 connection records. We did not locate an independent no-logs assessment, so the evidence group reflects the detailed policy rather than a conclusion that Astrill records browsing activity.
Avast SecureLine VPN
According to Avast’s SecureLine VPN support documentation, the service does not retain websites visited, transferred content, or accessed IP addresses. It does retain connection and disconnection time, duration, bandwidth, and app or operating-system events. An older policy gave a 30-day period, but the current material we located did not, so we did not present the old period as current.
Mozilla VPN
According to Mozilla’s subscription-services privacy notice, Mozilla VPN excludes network activity and browsing data but processes account, subscription, device, and optional diagnostic information. Mozilla service or server IP logs may be retained for 90 days. Cure53’s public work was a client security assessment, not a dedicated server-side no-logs assurance.
Mullvad
According to Mullvad’s no-logging policy, the service excludes activity, DNS, connection timestamps, duration, IP addresses, and bandwidth logs. It still uses numbered accounts, WireGuard keys and addresses, temporary in-memory connection state, aggregate metrics, and support data. A 2023 infrastructure penetration test and a disclosed police search warrant are supporting evidence, not a dedicated no-logs assurance.
TunnelBear
According to TunnelBear’s privacy policy, it excludes connection IP, DNS, and the apps, services, or websites a user accesses, while processing account, subscription, device-version, and monthly bandwidth data. TunnelBear publishes recurring security audits, but those audits should not automatically be relabeled as dedicated no-logs verification. We located a 2023 transparency report but did not confirm a current recurring series.
Windscribe
According to Windscribe’s privacy policy, it excludes historical sessions, source IP, sites, DNS, and traffic logs. It describes a 30-day bandwidth counter, last-activity date, activated app versions, parallel-connection count, and active-session state held in memory. Its PacketLabs and Cure53 work supported infrastructure and security transparency but was not a formal no-logs assurance.
How to Evaluate a VPN No-Logs Claim
Use the claim as a starting point, not the conclusion.
- Read the exact wording. Check whether the service excludes browsing content, DNS, source IP, connection timestamps, and session duration—or only says that activity is not associated with an identity.
- Separate activity from operational data. Account records, payment information, crash reports, server load, and temporary session state are not the same as browsing history.
- Check the assessment date. A report can accurately describe an older system without proving that every current component is unchanged.
- Check the scope. Look for the servers, clients, authentication systems, logging controls, regions, and subscription tiers included or excluded.
- Check public access. A full report, a summary, an account-gated document, and an unsupported “audited” badge provide different levels of reviewability.
- Look for continuing evidence. Transparency reports, policy history, and documented events can complement a time-bound assessment.
Corporate structure is another separate question. Our ownership research explains who owns the VPN and which legal entity provides the service.
What This Study Cannot Prove
This was a public-document review. We did not inspect live production servers, source code, internal databases, employee access, or current network traffic. Independent reports were also limited by their stated date, scope, sampling, exclusions, and assurance level.
Providers can change policies, infrastructure, ownership, apps, and vendors after an assessment. A court or server-seizure event describes a particular request, time, company, and technical environment; it is not proof for every future request or server. Conversely, not finding a report does not prove that a provider records browsing activity.
The sample was not the whole VPN market, and its percentages should not be generalized to every VPN. The public-evidence groups are not rankings of security, privacy, speed, customer service, or overall quality. Public evidence can make a claim more reviewable, but it cannot turn a time-bound assessment into a permanent guarantee.
For a broader discussion of product risk, see what independent research says about free VPN risks.
Publisher Self-Disclosure: BearVPN
BearVPN was excluded from the sample and all percentages because it publishes this report. As of the review date, BearVPN had not completed a third-party no-logs audit. BearVPN publishes a privacy policy and transparency report, but these materials were not placed in a public-evidence group or used in the comparison.
Conclusion
“No logs” is not a universal, all-or-nothing standard. Every provider in our 20-service sample made some form of no-logs or activity-logging claim, but the scope of those claims and the evidence supporting them differed.
The most useful distinctions were not simply “audited” and “not audited.” Readers also needed the date, assessor, scope, access conditions, and data fields a policy still allowed. Independent verification and transparency reporting added different kinds of evidence, and neither offered a permanent guarantee.
For users, the practical lesson is to move beyond the homepage label. Check what the provider says it excludes, what it still processes, how long the data remains, whether it can be linked to a session, and whether an outside party has reviewed the relevant controls recently enough for the result to remain informative.
Frequently Asked Questions
VPN practices differ. Some providers say they do not retain browsing activity, DNS requests, traffic content, source IP addresses, or detailed connection records. Many still process account, payment, device, diagnostic, support, bandwidth, or temporary connection data. The policy’s specific fields and retention periods matter more than the label alone.
It usually means that a provider says it does not retain defined categories of activity or identifying connection data. It does not necessarily mean that no information is ever processed. The exact meaning depends on the policy’s wording, systems, purposes, and exceptions.
No single document offers permanent proof. Independent assessments, public reports, transparency statistics, and documented legal events can make a claim more reviewable. Each remains limited to a particular time, scope, method, and technical environment.
No. An audit or assurance engagement can provide useful evidence about the systems, controls, statements, or samples included in its scope. It does not guarantee that every server, app, employee, vendor, or future version behaves identically forever.
Not necessarily. A security audit may examine code, apps, infrastructure, vulnerabilities, or configuration without testing whether server-side activity and connection data are retained. The report’s documented objectives and scope determine what it can support.
Depending on the provider, the data can include account email, subscription and payment status, device or app version, crash reports, support messages, anti-abuse records, bandwidth totals, aggregate server metrics, or temporary connection state. Check the current policy for the exact fields and retention rules.
Sources and Reproducibility
The evidence was checked on October 30, 2026. The downloadable dataset records each provider’s claim, excluded data categories, retained or temporarily processed data, independent assessor, assessment date and scope, report access, transparency reporting, real-world evidence, confidence, and limitations.
Data download: https://cms.bearvpn.com/wp-content/uploads/2026/11/vpn-no-logs-public-evidence-20-providers-2026-10-30.csv
The principal official sources are linked in the comparison notes above. The full research workbook retains additional policy, report, transparency, and event URLs for each provider. If a source changes after publication, the page should preserve the review date and record the updated evidence separately rather than silently rewriting the historical dataset.
For corrections, contact: https://bearvpn.com/contact-us/.
