No-log VPN: what it really means and how to verify it.
State of things on 18 October 2026: Pevnost is in private beta. The first server, in Hluboká nad Vltavou, is live with our DNS resolver inside the tunnel at 10.8.0.1. Accounts are paid by bank transfer; Bitcoin on-chain is the preferred way to pay; card and bank transfer also work; Lightning opens once our channel is funded, Monero and cash by post later. Windows app 0.3.1 beta and Android app 0.1.0 beta (APK) are on the Apps page; iOS and macOS use the official WireGuard app. Last reviewed 18 October 2026.
Almost every VPN provider puts “no logs” on its front page, and because everyone says it, it has stopped meaning anything. We use the phrase too and the whole service rests on it, so we owe you a precise definition: what “no logs” means technically, what even a no-log VPN cannot avoid holding, and above all how you can check it without taking anybody’s marketing on faith. Ours included.
What counts as a log
A log is anything that is written down and outlives the moment it describes. On a VPN server four kinds matter. Connection records: which device connected when, from which address, and which tunnel address it got. Traffic records: where packets went, how many, through which ports. DNS records: which site names a device resolved. And application records: web server access logs, API logs, error messages that quietly include a client IP. A provider that says “no logs” should be able to say it writes none of the four. Most mean only the second.
The gap between “we do not log traffic” and “we do not log connections” is the whole game. A connection record (this address, at this time, this account) is exactly what authorities usually want: they bring a timestamp and a VPN exit address from a website and ask who was behind it. A provider with connection records can answer, even if it never wrote down a single destination.
What a server must hold, and where
No VPN server can know nothing. To send packets back to you it must know your current IP address while you are connected, and WireGuard additionally remembers the time of the last handshake. That is not a log as long as it stays in memory and disappears with the connection. It becomes a log the moment it is written to disk, shipped to a central collector, or aggregated with identifiers attached. So the honest definition reads: the state needed to operate exists only in RAM, only for as long as needed, and never leaves the machine.
This is why our nodes run from memory only. The disk holds the public, published boot image; the system is loaded into RAM at start and the disk is never written to again. The journal is volatile, the DNS resolver inside the tunnel logs nothing, and WireGuard itself keeps no history. Power off and nothing of any session remains. What a seized server yields goes through this in detail.
What the person who carries the server away gets
A good test of the definition. Someone who walks into the data centre and takes a no-log provider’s machine switched off should find a disk with public software and nothing else. Someone who takes it running could in principle reach what is in memory at that moment: who is connected right now. Not history; that moment. We say this out loud because a provider who claims that even a running server reveals nothing is either encrypting memory on its own hardware or exaggerating. Our rented hardware does not encrypt memory yet; we plan it for our own machines.
What exists even at a no-log VPN
Honesty means listing the other column. Even a fully log-free provider holds something: a list of accounts (for us a random ID and an expiry date), device public keys (without them the server could not tell whom to let in), a payment record (which carries the payer’s name for bank transfers and cards, and which tax law says to keep for years) and aggregate node load. None of it says what you did, but it is fair to name it. Then there are things outside any provider’s reach: the hosting company sees which addresses connect to the server and when; a wiretap on the data-centre uplink sees encrypted traffic on one side and plain traffic to websites on the other. No VPN makes anyone anonymous and we wrote down why.
How to check
A “no logs” claim cannot be fully proven from outside. It can be tested from several directions, and a provider that passes none of them has not earned your trust.
1. Transparency report
How many requests from authorities arrived, how many were complied with, and what was handed over. A no-log provider should always have the same thing in the third column: account ID, expiry, keys, payment, nothing about activity. A missing report does not prove logging, but it proves nobody is talking to you. Ours is on the transparency page, quarterly and signed.
2. Warrant canary
A dated, signed statement that the provider has received no order it is forbidden to talk about. If it fails to appear once, you know something changed, even though nobody may tell you. Beware of a canary published once three years ago; only a regular one is worth anything. Ours is here, monthly.
3. Published image and its hash
A provider that says the server runs from RAM and writes nothing should be able to show what is running: the boot image, its hash, and a status page showing which hash the node booted with. Then the configuration can be read, the journal checked to be volatile, the resolver checked to log nothing, and the hash compared with what the node reports. Our node receives its keys only after a manual approval against the published hash, after every boot; the hash is on the status page. It is not perfect until remote attestation through a TPM arrives, which we plan for our own hardware, but it is incomparably more than a paragraph in the terms.
4. Leak test
The easiest check and the only one you do yourself in a minute. If DNS queries or IPv6 bypass the tunnel, the provider’s logs are beside the point: the history is being created at your ISP. The leak test guide says exactly what to check on each platform.
5. The law the provider sits under
Finally, ask whether anyone can force the provider to log. A Czech VPN like ours has no duty to retain traffic data, the Constitutional Court annulled blanket retention in 2011, and Czech law has no general power to order a service to build in surveillance. What exists is an order to preserve data already held, and that data does not include your activity. More in the post on data retention in the Czech Republic.
In short
“No-log VPN” means: the state needed to operate only in memory and only while connected; nothing written about connections, traffic, DNS or in application logs; and a provider who shows you how to check. Ask for the transparency report, the canary, the published image, and what a seized machine would yield. And run the leak test, because the prettiest policy does not help when DNS flows outside the tunnel.