Why 'no logs' is the most abused phrase in tech
There is no certification body that polices the words 'no logs'. There is no fine for putting them on a homepage and then handing twelve months of connection metadata to a court. The phrase is pure marketing — until a real audit, a real jurisdiction, and a real architecture prove otherwise. The good news: the gap between providers who actually mean it and the ones who don't is enormous, and visible from the outside in about a minute.
What a real no-logs VPN actually stores
A privacy-focused provider has to keep some data — otherwise you could not log in. The question is what. The list below is the absolute maximum a true no-logs provider keeps. Anything beyond this is a log.
- Account email (often a throwaway one — that is fine).
- A hashed password.
- Subscription expiry date.
- Payment reference (a crypto transaction hash, not a card number).
- Configuration metadata needed for your client (e.g. server keys you generated).
That is the entire list. No source IPs. No connection timestamps. No bytes-per-session. No DNS queries. No 'last seen' field. If a dashboard shows you any of these, those numbers had to be recorded — and what is recorded can be subpoenaed, leaked, sold, or stolen.
The 7-test no-logs audit
Run these seven tests on any provider before paying. Each takes seconds. Most providers fail at least three.
1. The privacy-policy test
Open the privacy policy in a new tab and search for: 'retain', 'IP address', 'connection', 'timestamp', 'metadata', 'aggregated'. The word 'aggregated' is the giveaway — it means logs exist but the provider claims they are anonymised. Anonymised logs are still logs and have been de-anonymised in court before.
2. The jurisdiction test
Find the operating company's country. Cross-reference it against the 5/9/14-Eyes intelligence alliance and local data-retention laws. Switzerland, Panama, BVI, and Iceland are structurally privacy-friendly. The US, UK, Australia, Germany, France, the Netherlands and Sweden can compel cooperation under gag orders.
3. The RAM-only test
Search the website for 'RAM-only', 'diskless' or 'volatile storage'. Confirm it covers the entire fleet, not just marquee locations. RAM-only servers cannot keep persistent logs — a reboot literally wipes everything.
4. The audit test
An audit badge is meaningless without the actual report. Download the PDF. Verify it was performed by a recognised firm (Cure53, Deloitte, PwC, KPMG, Securitum). Check the date — anything older than 18 months is stale. Check the scope — apps-only audits prove nothing about server logging.
5. The signup test
Try to register without giving a phone number, a real name, or a credit card. If the form refuses, anonymity is impossible from the first second. A true no-logs provider needs only a throwaway email and a crypto payment.
6. The dashboard test
Log in to the user dashboard. Look for: 'last login', 'last IP', 'bandwidth this month', 'devices online', 'connection history'. Each of these is a confession. There is no way to display that data without recording it.
7. The court-record test
Search '[provider] subpoena' and '[provider] data request transparency report'. A trusted no-logs provider has at least one publicly documented case where law enforcement asked for data and got nothing. No public record at all is neutral — but absence of evidence is not evidence of absence.
Side-by-side: real vs marketing no-logs
| Signal | Marketing 'no-logs' | Real no-logs |
|---|---|---|
| Dashboard shows last connection | Yes | Impossible — no data exists |
| Bandwidth graph per user | Yes | Not recorded |
| Requires phone or credit card | Often | Never |
| Servers run on physical disks | Common | RAM-only across the fleet |
| Operates from 14-Eyes country | Common | Avoided |
| Audit covers infrastructure, not just apps | Rare | Standard |
| Accepts anonymous crypto | Sometimes | Always — Monero, BTC, Lightning |
| Public record of subpoena producing nothing | Rare | Documented |
Why architecture beats promises
A no-logs promise is only as strong as the system that backs it. A provider that promises 'no logs' but runs on disk-based servers in Frankfurt is one warrant away from being forced to log silently — and a gag order means you will never know it happened. A provider on RAM-only nodes in Switzerland with audited infrastructure cannot start logging without rebooting every server, breaking continuity, and getting caught the next time the audit runs.
Architecture is the only thing that survives subpoenas, gag orders, and ownership changes. Promises do not.
How Cryon scores on the 7-test audit
We do not ask you to take our word for it — that would defeat the entire point of this article. So here is exactly how Cryon performs on the same checklist:
- Privacy policy: zero IP, zero timestamps, zero session data — verifiable in plain English on our privacy page.
- Jurisdiction: EU operations outside the 14-Eyes data-sharing scope, optimised for GDPR-grade privacy.
- RAM-only: every Cryon node runs from volatile storage. A reboot wipes all state by design.
- Architecture: VLESS over Reality on TCP 443. The traffic is indistinguishable from normal HTTPS — there is nothing on the wire to log even if we wanted to.
- Signup: throwaway email, no phone, no name. Done in 30 seconds.
- Payment: anonymous crypto (BTC, Monero via Lightning-compatible processors), no card data, no KYC.
- Dashboard: shows your subscription expiry and your config. That is all. No 'last IP', no bandwidth meter, no session list — because none of it is recorded.
The bottom line
'No logs' on a homepage is worth almost nothing. 'No logs' backed by RAM-only servers in a privacy-friendly jurisdiction, anonymous crypto signup, an audited stack, and a dashboard that physically cannot show your session history — that is worth everything.
Run the 7-test audit on any provider you are considering. If they pass all seven, you have found something rare. If they fail three or more, walk away — there are providers built correctly, and they cost the same.
If you want to skip the comparison and start from a service that was designed against this exact checklist, that is what Cryon is. Anonymous signup, crypto payment, EU-only RAM-only nodes, and a dashboard that shows you nothing — because we record nothing.
