Seeing and keeping are two different questions
What most people hear in a no-logs claim is that the provider cannot see their traffic. What any honest provider can actually say is narrower: a great deal is visible in the moment, and almost none of it is written down. A packet crossing a border router is visible to that router. Whether the visibility becomes a record is a decision about configuration and retention — and the record is the only part of it that anybody can be ordered to produce.
The two questions are answered by different mechanisms, which is why conflating them is so useful to a marketing page. Seeing is bounded by cryptography: what is encrypted end to end is unreadable in transit regardless of anyone’s goodwill. Keeping is bounded by a timer, and a timer is a thing that can be published, described and held to. A host that talks only about the first is avoiding the second.
The eight places a record of you can exist
Nearly every argument about no-logs hosting is about one of these — the web server’s access log — and it is nowhere near the most revealing. The chain that carries a request to your machine touches at least eight parties, and only some of them are your host.
| Where | What it can record | Held by |
|---|---|---|
| The web server | Address, time, URL, user-agent and referrer, for every request | Your host |
| The hypervisor | The disk and the memory of the guest it runs, at any moment | Your host |
| The border router | Netflow: who talked to whom, for how long, at what volume | Your host |
| DDoS mitigation | Traffic characteristics, inspected in the path continuously and by design | Your host, or a scrubbing vendor |
| The upstream carrier | The same flow data one hop further out, under its own retention law | A transit provider you never chose |
| The recursive resolver | Every domain the machine looks up, and when | Whoever your image points at |
| The account and support desk | What you typed, what you bought, what you paid | Your host |
| The payment rail | A legal name, if the money ever crossed something that asked for one | An exchange or a processor |
Three of those eight sit outside the hosting contract entirely, which is the part a no-logs badge cannot speak to at all. The carrier upstream keeps whatever its own regulator requires. The resolver inherited from a default operating-system image sees every hostname your server asks about. And the payment rail is the link covered in the guide on paying for a server in crypto, because it is the one that most often carries a name.
What each kind of record actually proves
Records are not equally dangerous and the industry conversation treats them as though they were. This is roughly the order in which they hurt.
| Record | What it establishes | Why that matters |
|---|---|---|
| A disk image | Everything: contents, keys left in memory, deleted files not yet overwritten | The only record that needs no corroboration from anywhere else |
| Netflow | Who connected to the machine, when, for how long and how much passed | Places a person at a machine without reading a byte of content |
| An HTTP access log | One address making one request at one second | Damaging in combination with a record somebody else holds |
| A DNS query log | Every name the machine resolved, which is most of what it does | A behavioural profile even where the traffic itself is encrypted |
| Sign-in history | Where the operator of the account was, over months | The record that identifies the human rather than the machine |
| Interface counters | Bits per second on a port | Aggregate: it cannot reconstruct a conversation, which is the point |
The four ways “no logs” is usually not true
None of these is a lie exactly. Each is a true sentence about a smaller thing than the reader believes is being described.
- It means one log. The claim is about traffic logs, while sign-in history, ticket archives, billing records and DNS queries carry on in the ordinary way. It is true about the least revealing of the eight.
- It means deletion, not absence. The records are created and then removed — on a schedule if you are fortunate, on request if you are not. Deletion is a policy, and a policy can be ordered to stop, with everything already written preserved from the moment the order lands.
- It stops at the edge of the company. The scrubbing vendor in front, the ticketing platform to the side, the CDN, the payment processor and the analytics script in the billing area each keep their own, under their own rules, in their own jurisdiction.
- It describes today. A claim with no inventory and no timer is a description of current practice, and current practice is free to change on the day the pressure arrives. Nothing about it can be contradicted, which is why it is written that way.
Retention is a timer, not a promise
The version of the claim that means something is dull to read: every record that exists, what it exists for, and how long it lasts. This estate publishes seven rows, and the column that does the work is the second one.
| Record | Retained | What it would produce |
|---|---|---|
| Email address | Life of the account | An address you chose, never verified against anything but itself |
| Password hash | Life of the account | A hash, which is what a hash is worth |
| Balance and ledger | Life of the account | Amounts and dates, against a chain that was already public |
| Service configuration | Life of the service, then 7 days | Region, specification and image — not the contents of the disk |
| HTTP access logs | 24 hours, then destroyed | Nothing at all for a request older than yesterday |
| Support correspondence | 90 days after the conversation closes | Whatever you chose to type into it |
| Interface counters | 13 months, aggregate only | Bits per second on a port. Deliberately not netflow |
The second list is the one that matters more, and it is the list of what is never created: no identity document, no legal name, no record of the addresses an account signs in from, no IP history, no device fingerprint, no netflow at a resolution that could reconstruct who talked to whom, no query logs on the resolvers we run, and no contents of disks, memory or backups. Deletion can be ordered to stop. Absence is a fact about the schema, and an order cannot reach backwards through it. Both lists are published in full in the privacy and logging policy, where they form part of the agreement rather than part of the brochure.
The awkward part: a host can read an unencrypted disk
A hypervisor operator can copy the disk of a guest it runs. A provider that tells you otherwise is either misunderstanding its own stack or lying to you, and this is the most important sentence on this page. No policy repairs it, no jurisdiction repairs it, and no promise survives somebody with physical access deciding differently.
What does repair it is a key the host has never held. Full-disk encryption inside the guest, unlocked over an SSH session at boot, moves the question from a legal register to a mathematical one, and the mathematical answer does not vary with the court. The runbook is in the knowledge base, and it is the highest-value hour of work available to anybody who cares about this at all.
The same shape holds one layer out. What crosses the wire in cleartext is readable by every party between the two ends of it; what crosses under TLS is not, whatever a flow record says about the conversation having happened. Encryption decides what can be seen. Retention decides what can be produced. Neither substitutes for the other.
How to test a no-logs claim from outside
You cannot audit a retention timer from a browser. You can, in about twenty minutes, establish whether the claim is the kind of thing that could be audited at all.
- Look for an inventory rather than an adjective. A provider that keeps little is able to list what it keeps; one that will not enumerate has told you something.
- Check for a period against every row. “As long as necessary” is not a retention period. 24 hours is.
- Read the never-created list, if one exists. It is more informative than the retained list, because it is the part no order can reverse.
- Open the developer tools on the billing area and watch for requests leaving the domain. Every third party there is a logger the privacy policy did not mention.
- Read the transparency report for outcomes rather than volume. The number that matters is how many requests produced anything and what it was — here, 164 law-enforcement requests since 2019, 31 of which produced something, and what they produced was an email address and a ledger of amounts.
- Check whether the claim is signed. A warrant canary is the only part of this that carries a cost to falsify: this one cites a recent Bitcoin block so the statement cannot have been signed in advance, and it asserts that no equipment has ever been seized, imaged or physically accessed.
- Then open the signup form. Whatever the policy says, the form is the part that cannot lie about what is collected.
Questions people actually ask
What does no-logs hosting actually mean?
At a minimum it should mean that no record exists which could place a person at a machine after the fact: no IP history, no sign-in locations, no netflow, and access logs on a short timer rather than on a promise. Anything looser is a claim about one log out of eight. The version worth paying for arrives as an inventory with a retention period against every row.
Can my hosting provider see my files?
On an unencrypted disk, yes. A hypervisor operator can copy the disk of a guest it runs, and a provider claiming otherwise is misunderstanding its own stack. Encrypt the volume with a key the host never receives and the answer stops being a policy and becomes a cipher — the one control here that does not depend on trusting anybody.
Do hosting providers keep logs of my traffic?
Most keep netflow, which records who connected to your machine, when, and how much data moved, without recording content. It is kept because it is genuinely useful for capacity planning and abuse handling, and it is the record most often produced under legal process. What exists here instead is a bits-per-second counter per port, aggregated and held for 13 months, which cannot reconstruct a conversation.
Is a no-logs claim legally binding?
The published policy forms part of the agreement here, which makes it a contract term rather than marketing copy. What no claim can do is override a lawful order from a court with jurisdiction — which is exactly why absence beats a promise. An order to stop deleting cannot recover a record that was never written.
Does no-KYC hosting mean no logs?
No, and the two get sold as one thing. No KYC is a statement about what was collected at signup; no logs is a statement about what accumulates every day afterwards. A host can take no document at all and still hold a year of sign-in addresses, which would identify you just as well.
Who sees the DNS queries my server makes?
Whoever the machine points at as a resolver, which on most images is a default nobody chose. Query logs are a behavioural profile even where every connection that follows is encrypted, and they sit with a third party under its own retention rules. Running your own resolver, or picking one that documents its retention, is a ten-minute fix almost nobody makes.
Would a VPN in front of my server help?
It helps with a different link. A VPN or Tor hides where you connect from when you administer the machine, which closes the sign-in-history problem described in the guide on staying anonymous. It does nothing about what the machine itself publishes, what is on the disk, or what the carrier upstream records about traffic arriving at it.
Every price on this estate is published in full, in one place. See the whole catalogue