Red Flags: How to Spot a VPN That Doesn’t Really Keep Its No-Log Promise
After reviewing dozens of VPN providers and reading through audit reports, court filings, and transparency documents, a clear pattern has emerged in our research at Tedony: the providers whose no-log claims eventually fall apart almost always show warning signs well before the failure becomes public. You don’t need a security background to spot most of these. You just need to know where to look and what kind of vague language should make you pause.
Red Flag One: Policy Language That’s Technically True But Practically Meaningless
The most common evasion isn’t lying outright — it’s precision engineering of language. Phrases like “we do not log your browsing activity” or “we do not monitor what you do online” sound comprehensive but are actually narrow. They say nothing about connection timestamps, session duration, bandwidth totals, device identifiers, or the originating IP address at time of connection — all of which can be logged while that specific sentence remains word-for-word accurate.
A trustworthy policy is specific and exhaustive: it lists the categories of data explicitly, states clearly whether each is collected, and if any data is retained (even account email or payment information), it explains exactly how long and why. If a policy reads like it was written by a lawyer to survive scrutiny of specific sentences rather than to inform you clearly, treat that as a signal to dig deeper, not a reason to trust it more because it sounds official.
Red Flag Two: Jurisdiction Shopping Without Explanation
Where a VPN company is legally incorporated matters, because it determines what legal requests the company can be compelled to comply with and whether it can be forced to log data going forward under a secret order. Providers based in jurisdictions with strong privacy protections and no mandatory data retention laws have a genuine structural advantage. That said, a company that has quietly relocated its legal headquarters multiple times, or that structures itself through a maze of shell entities across several countries with no clear public explanation, is behaving in a way that makes independent verification much harder — even if the underlying motive is legitimate tax or regulatory optimization rather than something more concerning. Transparency about corporate structure is itself part of a credible no-log story.
Red Flag Three: No Named Auditor, or an Auditor With No Public Report
We covered this in depth elsewhere, but it’s worth repeating as a standalone red flag: “audited by a leading firm” with no name attached, or a named firm with no locatable public report, should immediately lower your confidence. This is one of the easiest things to check and one of the most commonly skipped by casual buyers — a two-minute search either confirms the claim or reveals there’s nothing to find.
Red Flag Four: History of Logging Despite Claims
Search specifically for the company name alongside terms like “logs,” “court,” or “data request” before subscribing. Some providers have a documented history — sometimes years old — of a court case or law enforcement request revealing that logs existed despite a no-log marketing claim at the time. A company that had this happen once, acknowledged it, and rebuilt its infrastructure with independent verification afterward deserves credit for the correction. A company that has never addressed a documented past incident, or that quietly scrubbed old blog posts and news coverage referencing it, deserves more scrutiny, not less.
Red Flag Five: Free VPN Apps With No Clear Business Model
This one deserves special attention because it’s so common and so rarely questioned. Running global VPN server infrastructure is expensive — bandwidth, server costs, and engineering talent all cost real money. If a VPN app is free, and the company has no visible premium tier, no clear enterprise product, and no obvious other revenue source, the uncomfortable question is simple: how is this being funded? In a meaningful share of documented cases, the answer has turned out to be data monetization — selling aggregated or even individually identifiable browsing data to advertising networks or data brokers, which is the exact opposite of what a no-log promise is supposed to prevent. A “free forever” VPN with a vague or absent explanation of its business model is one of the strongest red flags in this entire list.
Red Flag Six: Excessive Account Data Collection at Signup
A no-log claim about VPN connections doesn’t mean much if the account creation process itself collects your full name, phone number, home address, and government ID — data that, if later subpoenaed or breached, can be cross-referenced against payment records and, in some cases, connection timestamps from ancillary systems (support tickets, billing servers) that fall outside the “no-log” claim’s narrow technical scope. Providers serious about privacy typically support anonymous signup, cryptocurrency payment options, and collect the absolute minimum required to operate an account.
Red Flag Seven: Marketing That Outpaces the Evidence
Be wary of superlative language — “military-grade,” “unbreakable,” “100% anonymous, guaranteed” — used in place of specific, checkable claims. This kind of language is a marketing substitute for evidence, and providers confident in their actual technical and audit record tend to talk in specifics (server counts, audit dates, named firms) rather than superlatives. When the marketing gets louder and vaguer at the same time, that’s usually not a coincidence.
Putting It All Together
None of these red flags is individually disqualifying — plenty of legitimate companies have imperfect policy language or an older audit that needs refreshing. What matters is the pattern. A provider with vague policy language, an unnamed auditor, an unexplained corporate structure, and a “free forever” business model is showing you several independent signals pointing in the same direction. Our approach at Tedony is to treat no-log verification as a layered case built from multiple independent pieces of evidence — audits, legal history, architecture, and business model — rather than trusting any single claim in isolation. The providers that hold up best across all of these dimensions are, unsurprisingly, the ones we end up recommending most consistently in our reviews.
Red Flag Eight: Aggressive Data Sharing With “Affiliated” Companies
Some VPN providers are one product among several owned by the same parent company, sitting alongside browser extensions, ad-blocking tools, or antivirus software under a shared corporate umbrella. This isn’t inherently a problem, but it becomes one when the privacy policy includes broad language permitting data sharing “with affiliated companies” for vague purposes like “improving our products” or “providing a better user experience.” A no-log claim about the VPN connection itself means very little if account data, device identifiers, or usage patterns collected through a sibling product can be linked back to the same underlying user profile. Read the policy specifically for how it defines the corporate family the data might flow to, and whether that list is fixed and disclosed or open-ended and vague.
Red Flag Nine: Sudden Changes in Ownership With No Updated Audit
VPN companies get acquired, merge, or change ownership structure more often than most subscribers realize, and a change in ownership is exactly the kind of event that should trigger a fresh audit, since the people and incentives controlling the infrastructure have changed even if the technical architecture hasn’t yet. A provider that went through an ownership change two years ago and hasn’t published any audit since — despite previously having a strong audit cadence — is showing a gap worth asking about directly. New ownership sometimes brings new business priorities, and “does the no-log commitment survive a change in who’s actually running the company” is a legitimate question that a responsible provider should be able to answer with fresh evidence, not just a reassuring statement.
Red Flag Ten: Refusal to Answer Direct Technical Questions
One of the more revealing tests we use in our own review process at Tedony is simply asking a provider’s support team a specific technical question — for example, “does your DNS resolution happen on the same RAM-only servers as the VPN tunnel, or through a separate system?” A confident, technically literate provider will either answer directly or route the question to someone who can. A provider whose support team responds only with generic marketing language, repeats the phrase “we have a strict no-log policy” without engaging with the specific question, or seems unable to escalate to anyone with real technical knowledge, is telling you something about how deeply the privacy commitment actually runs through the organization versus how well it’s been packaged for the homepage.
Building Your Own Verification Habit
The single most useful habit we’d recommend adopting, beyond memorizing any specific list of red flags, is treating every no-log claim as a hypothesis to test rather than a fact to accept. Before subscribing to any VPN, spend fifteen minutes doing exactly what we do for every review: search the company name alongside “audit,” “court,” and “data breach”; locate the actual privacy policy and read the specific data categories listed rather than the summary paragraph; and check whether the claimed audit has a real, dated, named, and locatable report behind it. This habit takes less time than reading a single detailed review, and it will catch the large majority of the red flags described here well before you’ve handed over a subscription payment and years of connection metadata to a company that hasn’t earned that trust.