No-log VPN for India: every record we keep

"No logs" appears on almost every VPN website, so on its own it tells you very little. A list tells you more, and this page is that list.

What we keep, and why we cannot drop it

• The identifier of your key and the date it expires.
• The Telegram id that received the key.
• A running total of traffic per key, cleared every month and checked only for abuse.
• Proof that a payment went through, held for the term set by accounting rules.

What is never written down

• The sites, apps and services you open.
• DNS lookups that go through the tunnel.
• Your source IP address together with a time.
• When an individual user's session starts or ends.
• Your identity, since no one ever asks for it.

If someone comes asking

We cannot hand over a browsing history that was never recorded. Under a lawful request, the reply would contain two facts: a key was handed out, and on which day it stops working.

Why it matters that our servers are abroad

Five years: that is how long the CERT-In directive makes any provider operating inside India hold on to customer records. Any provider with servers in the country can comply or pull the servers out, and most services built around privacy pulled out. We have no servers in India, and that is the reason a list this short is possible. A provider still running Indian servers could not publish it truthfully.

Four questions for any no-logs claim, ours too

• Is an email required? Then an identity can be linked to what you do.
• Is there a password reset? Whatever can be reset is an account, and accounts can be seized.
• In which country are the servers? That decides what the provider can be forced to keep.
• Are retention periods spelled out in days and months, or is no logs the whole policy?