Definition
Logs, in the VPN context, are any records a provider keeps about its users' sessions. They are commonly classified into connection logs (when a user connected, from which IP, to which server, for how long, how much data) and activity logs (which sites were visited, what was downloaded, what was streamed). Activity logs are the most invasive and are universally claimed not to be kept by reputable providers; connection logs are sometimes kept for billing and abuse-prevention purposes.
What 'No Logs' Means in Practice
There is no universal definition. Some providers retain aggregate, anonymized statistics for capacity planning and call this 'no logs.' Others retain a count of concurrent sessions per account and call that 'no logs.' Others retain truly nothing user-specific, even temporarily. The only way to know which kind a provider is claiming is to read the privacy policy carefully and look for an independent audit that examined the actual server configuration.
Why It Matters
Logs are the difference between a provider that can identify you under legal pressure and one that cannot. The strongest privacy guarantee is structural: RAM-only servers that physically cannot persist data across reboots, combined with a stateless authentication architecture that does not require linking sessions to accounts in real time. Several providers, including NordVPN, ExpressVPN, Surfshark, Proton VPN, Mullvad and IVPN, have commissioned independent audits of their no-logs claims or server setup. Read the audit scope: each one checks different things.