No-logs hosting explained

What a hosting provider can log

A hosting provider sits between your server and the internet, and runs the systems you use to manage it. That gives it several possible sources of data:

• Account and billing records: your email, invoices, payment method, and order history.
• Control panel access logs: the IP addresses and times you logged in to the website or client area.
• Support tickets: everything you have written to the provider.
• Network flow data: summaries of traffic to and from your server (which IPs, which ports, how much data), often collected for billing and attack mitigation.
• Abuse reports: complaints received about your server and the provider's responses.

What a provider generally cannot see, if you set your server up well, is the content of encrypted traffic or data you encrypt yourself.

What a no-logs policy usually covers

No-logs policies vary widely. Some only cover the control panel (for example, not storing login IP addresses). Others extend to network data, promising not to keep traffic metadata beyond what is needed to stop an ongoing attack.

Almost no provider can avoid keeping billing records. Tax and accounting rules in most jurisdictions require invoices to be retained for years. That is why a no-logs policy works best alongside a no-KYC signup and private payment: the billing records exist, but contain nothing that identifies you.

How to evaluate a no-logs claim

1. Specificity. Does the policy name the data it does not collect, or just make a general promise?
2. Retention periods. For data it does keep, does it say for how long?
3. Legal context. Is the provider in a jurisdiction with mandatory data retention rules that would override its policy? See our jurisdiction guide.
4. Consistency. Does the signup process match the promise? A "no-logs" provider that demands your phone number and ID is collecting plenty.
5. Transparency. Some providers publish transparency reports or warrant canaries showing whether they have received legal demands.

Hosting providers' no-logs claims are rarely audited by independent firms. On nokyc.host, the no-logs flag reflects published policies; it does not certify them.

Warrant canaries and transparency reports

Because no-logs claims are hard to verify, some providers publish additional signals of good faith:

• Transparency reports list how many legal requests the provider received in a period and how it responded.
• Warrant canaries are regularly updated statements that the provider has not received certain kinds of secret orders. If the statement stops being updated or disappears, users can draw their own conclusions.

Neither is a guarantee. A warrant canary's legal effectiveness is debated, and a transparency report only covers what the provider chooses to disclose. But a provider that publishes them consistently is at least taking the question seriously.

Red flags in a no-logs policy

• The policy is only on the marketing page, not in the privacy policy or terms of service.
• It promises "no logs" but the privacy policy lists IP addresses, device information, or analytics among collected data.
• It gives no retention periods for the data it does keep.
• Signup requires a phone number, ID, or card in your name, which makes the no-logs promise much less meaningful.
• The site loads third-party trackers and analytics on the client area pages.

Don't forget your own server's logs

A no-logs provider does not stop your own server from logging. By default, most Linux distributions record SSH logins with source IP addresses, and web servers record every visitor's IP address and requested page.

• Limit how long system logs are kept (for example with journald's retention settings).
• Configure web server access logs to omit or anonymize IP addresses if you do not need them.
• Avoid installing analytics or monitoring tools that ship data to third parties.

The VPS privacy hardening checklist covers these settings in more detail.