1. Write down exactly what “no logs” covers

• Find the current privacy policy and any separate logging or transparency statement on the provider’s own site. Note the date and version you reviewed.
• Look for explicit categories: browsing or destination activity, DNS requests, source and assigned IP addresses, connection timestamps or duration, bandwidth, device identifiers, crash diagnostics, and account or payment records.
• For each category, record whether the provider says it is not collected, processed only in memory, retained temporarily, or retained for a stated operational or legal purpose. “No activity logs” may not answer questions about account, diagnostic, or connection metadata.
• Check definitions. Words like “activity,” “session,” “diagnostic,” and “aggregated” can have narrower meanings in the policy than a reader expects.

The FTC’s business data-security guide recommends taking stock of what information an organization has and how it moves through the organization. Applying that as a reading prompt can help you identify unanswered data-flow questions; it does not establish what a VPN actually does.

2. Check retention and deletion details

• For records the provider does collect, look for a stated purpose, retention period or deletion trigger, and whether a copy may remain in backups or support systems.
• Check whether closing an account deletes account data, only disables access, or follows a separate request process. Note any stated exceptions rather than assuming account deletion removes every record.
• Ask what “temporary” or “aggregated” means if the policy does not explain it. If there is no duration or deletion explanation, mark retention as unclear.

The FTC guide advises businesses to keep personal information only as long as there is a business need and to document retention and disposal practices. This is a general data-handling principle, not a VPN-specific rule or proof that a provider follows it.

3. Identify other organizations and access

• Review disclosures about hosting, customer support, payment processing, analytics, diagnostics, and other service providers. Record what categories may be shared and for what purpose.
• Look for whether vendors act only on the provider’s instructions or may use information for their own purposes. If the policy does not explain this, ask the provider.
• Check whether the provider says it requires security terms from contractors and verifies compliance. A written promise, vendor list, or privacy policy is evidence to examine, not independent confirmation of implementation.

4. Read an audit as a scoped document

• Find the actual report, not only a badge, headline, or marketing summary. Record the auditor, publication date, review period, and whether the report is publicly available.
• Read the stated objective, systems and locations in scope, evidence examined, and exclusions. Ask whether the review addresses logging and deletion specifically or a different control area.
• Check the conclusion and any qualifications, remediation notes, or limitations. A review of a defined scope and period does not establish every system’s behavior at all later times.
• Look for whether the provider explains follow-up work and whether later reports cover material changes. If scope, date, or limitations are unavailable, do not treat the audit mention alone as proof of “no logs.”

5. Consider legal process and jurisdiction carefully

Record the legal entity named in the terms, its stated location, and any explanation of how it handles valid legal demands. These details can help frame questions, but jurisdiction by itself does not show what data exists, what a provider can access, or what a particular demand would require. Do not infer an absolute inability to disclose data from a “no-logs” slogan.

Use a simple evidence table

Keep notes linked to the original documents and revisit them when the provider changes its policy or publishes a new report. If a material question has no specific answer, ask support and retain the response with its date. Treat a missing answer as uncertainty, not proof of misconduct.

What this checklist cannot establish

A policy describes the provider’s stated practices. An audit is limited to its stated scope, evidence, and review period. Neither this checklist nor a browser IP/DNS check can independently inspect a provider’s servers or certify that no data is collected. The checklist does not rank services or endorse a provider.

For related questions, read the VPN app privacy checklist, compare published VPN plan terms, or review what a VPN can and cannot hide. For a concrete, case-limited example of alleged privacy claims and data practices, see the FTC Avast privacy claims explainer; that antivirus case does not establish whether a VPN provider keeps logs.