No-Log Policy
Most "no-log" pages are marketing. This one is engineering. We describe exactly what we
log, exactly what we don't, and where in the system the line is drawn — so a reviewer
can verify the claim.
What we promise
22VPN does not log, store, or transmit any of the following:
- The websites, domains, or URLs you visit.
- Your DNS queries or their answers.
- The source IP addresses originating tunnelled traffic, beyond the in-memory routing window required to deliver packets.
- Destination IP addresses of traffic carried inside the tunnel.
- The contents of any encrypted traffic — we cannot read it and we do not try to.
- Browsing history, app usage, or behavioural fingerprints of any kind.
What we do log, and why
To run a paid VPN we keep the smallest possible set of operational records:
- Aggregate bytes per session — total in / total out, per device. Used for fair-use enforcement and capacity planning.
- Session start and end timestamps — kept for 30 days for billing reconciliation, then discarded. We retain only daily aggregates beyond that.
- The endpoint label you connected to (e.g. "fra-1", "sgp-2") — never the user-side IP that connected to it.
- Authentication tokens — short-lived, rotated, hashed at rest, scoped to a device and a subscription.
How the line is drawn
The split is enforced by architecture, not policy:
- The control plane (account, billing, token issuance) and the data plane (VPN endpoints) run in separate processes with separate storage and no shared schema for traffic data.
- VPN endpoints have no persistent disk for traffic. They only hold connection state in memory, which is wiped on disconnect.
- Endpoint logs that exist for crash diagnostics are rate-limited to error events and never include traffic content, source IPs, or destination addresses.
- Operational metrics flow out to an aggregation service that strips per-user identifiers before persistence.
What this means in practice
If a court hands us a valid order asking what websites you visited, the honest answer is that we do not have that data and we cannot produce it. What we can produce is:
- The email address on a registered account, if any.
- The Apple or Google receipt that proves payment.
- Aggregate byte totals for the period requested.
That is the entire surface area.
Independent verification
We intend to publish a third-party audit of this policy and a reproducible build of the endpoint binary. Until that audit is live, this page is a statement of intent backed by the architecture above — not a certified attestation.
For the broader data picture see the Privacy Policy, and for the contract terms see the Terms of Service.