A VPN encrypts your traffic and hides your IP address from the sites you visit. What it cannot do is protect you from your VPN provider itself — specifically, what that provider writes down and keeps.
If a VPN service stores logs, those records exist somewhere. Records that exist can be subpoenaed, leaked, or sold. Understanding what gets logged and how it can be used helps you choose a provider with clear eyes.
What VPN Providers Can Log
Not every provider logs the same data, but the possibilities fall into a few categories.
Connection metadata includes timestamps showing when you connected and disconnected, which server you used, and how much data you transferred. This does not reveal what you did online, but it can establish that you used a VPN at a specific time.
Real IP address logs record the actual IP address you connected from — which identifies your internet connection. Paired with timestamps, this links your identity, or at least your home network, to a VPN session.
Account and payment records are not VPN logs in the technical sense, but they are held by the same provider. If you registered with an email address or paid by credit card, that information exists alongside any session data.
DNS query logs are possible if the provider runs their own DNS resolvers. DNS queries reveal which domains you looked up while connected, which amounts to a browsing record even without capturing full traffic content.
Traffic content — the actual data you sent and received — is something reputable providers do not collect. Doing so would require significant storage, create serious liability, and undermine the product's purpose.
Most providers that log anything keep the first two: connection times and real IPs. That combination is enough to reconstruct who was connected and when.
How Logs Reach Investigators
When a law enforcement agency or government body wants records from a VPN provider, the most common path is a court order or equivalent legal process. The provider receives a formal request to produce specific records. If those records exist and the request is legally valid in the provider's jurisdiction, the provider typically complies.
The jurisdiction a VPN company is incorporated in matters here. A provider in a country with strong privacy protections and no mandatory data retention requirements is in a different legal position than one in a country that requires user data to be stored for months or longer. A legal request sent to a provider in a non-cooperative jurisdiction may simply go nowhere. That is why providers' countries of incorporation come up when people evaluate VPN services — it is not abstract, it is about what requests they will receive and what they will be legally required to produce.
Connection logs handed over to investigators are rarely used in isolation. They are correlated with other records: ISP logs showing traffic directed toward the VPN's servers at the same time, financial records if a traceable payment method was used, and service logs from whatever platform was accessed. Timestamps are the common thread in this kind of correlation.
Logs and Data Breaches
Legal requests require legal process. Breaches do not.
A VPN provider is an online service with a database. Databases can be compromised. If a provider stores logs, those logs are part of the breach surface. Real IP addresses, connection timestamps, and account details that were collected for operational reasons can end up outside the provider's control entirely.
This threat model is different from law enforcement access. A breach requires no jurisdiction, no warrants, no legal procedures — just a vulnerability and someone willing to exploit it. After a breach, the exposed data can be sold, published, or used in unpredictable ways. The provider may not know about it for some time.
Providers that collect less data have smaller breach surfaces. A service that never stored your real IP has nothing to expose on that front.
Connection Logs vs Traffic Logs
These two categories are sometimes treated as equivalent, but they are not.
Traffic logs capture what you actually sent and received — the content of communications. Storing traffic content at scale is expensive, legally problematic, and not something legitimate VPN providers do. When people worry about a VPN reading their data, they are usually imagining traffic logs.
Connection logs capture metadata about the session: when it happened, from what IP, to which server. These are far more commonly kept, often for operational purposes — troubleshooting connectivity, investigating abuse reports, or enforcing usage limits. They are also more useful for identifying users after the fact than most people realize.
A provider that keeps no traffic logs but retains your real IP address and session timestamps for 30 days is still holding data that can identify you. "We don't log your browsing activity" is not the same as "we don't log anything."
What This Means for You
Read a provider's privacy policy carefully before trusting it. Look for specifics: which fields are stored, for how long, and under what circumstances they are shared. Vague language like "we may collect limited operational data" is less useful than a policy that names exactly what is and is not retained.
No-logs claims that have been independently audited carry more weight than self-reported ones. Audits do not guarantee a provider never logs anything, but they require opening infrastructure to external inspection and put the provider's reputation on the line.
Think about the full picture of identifying information. A VPN provider can have a genuine no-logs policy and still have your name and credit card number on file from registration. Services built around no-account access — such as TaoFlow, where you pay and receive a config without creating an account — have structurally less data to keep: there is no registration record to tie a session to in the first place.
Your threat model matters. If you are using a VPN to protect your traffic on a public network, connection metadata logs are unlikely to affect you. If you need stronger assurances, look for providers whose architecture makes extensive logging impractical, not just ones that promise not to log.
The Bottom Line
A VPN hides your traffic from your ISP and your IP address from the sites you visit. It does not make you invisible to your VPN provider. What that provider logs, how long those logs are kept, and where they are stored are the variables that actually shape your exposure. Logs that do not exist cannot be handed over, breached, or correlated.