What a "No-Logs VPS" Can Actually Promise — and What We Keep

Three different things get called "logs"

Most arguments about logging are people talking past each other, because the word covers three unrelated things.

• What runs inside your server. Your application logs, your shell history, your database. We do not read, copy or monitor any of it. Your disk is yours; we can destroy it, we do not browse it.
• What the platform records about you. Your account row, your payments, the servers you created. This is the part every host has, and the part marketing usually means when it says "none".
• What the network underneath records. The datacenter, the upstream provider, the transit carriers. Nobody reselling infrastructure controls this, and anyone claiming otherwise is selling you a feeling.

What we keep, exactly

The whole account record is an email address and a password hash — or, if you signed in with Google, the account identifier Google returns instead of a password. No name, no postal address, no phone number, no document.

Beyond that:

• Payments: the amount, the coin, the processor's payment reference, and the country your connection resolved to when you created the payment. Card numbers and wallet credentials never reach us — the processor handles them. The country comes from a header our CDN adds, and we keep it because an invoice has to state it and EU VAT on digital services depends on it.
• Servers: the label you chose, the region, the plan, the operating system, and the IPv4 address assigned.
• Support: your messages and attachments, kept with the account so the conversation has history.
• Request logs: yes, with IP addresses. These are the ones people mean when they ask. We will come back to why they exist.
• Analytics: our own, cookieless, no third-party trackers. A random browser identifier, the page path, the referring site, and desktop-or-mobile. It is not tied to your account.

How long each of those lives

This is the question that separates a real answer from a slogan, and it is the one most policies skip.

• Request logs: 14 days, then the log store deletes them on its own.
• Analytics events: 90 days, deleted automatically.
• Snapshots of a server archived at zero balance: 7 days, then gone with the server.
• Account data: as long as the account exists. Ask us to delete it and we do.
• Invoices and accounting records: as long as Estonian accounting law requires, which is longer than everything above and not our decision to make.

Why request logs exist at all

Because abuse reports arrive as an IP address and a timestamp, and nothing else.

When a provider forwards a complaint saying that 203.0.113.9 was scanning somebody's network at 04:12 UTC, a host with no logs cannot tell whether that was a customer, a compromised box, or an attack passing through. It cannot answer the report, and a host that cannot answer abuse reports loses its upstream accounts — which ends the service for everyone on it.

The same records power rate limiting, which is the only thing standing between a login form and a credential-stuffing run.

A host that genuinely kept nothing would not survive its first month. The honest version is not "we keep nothing", it is "we keep the minimum, we say what it is, and it expires quickly".

Where "no logs" cannot be true

Three places, and they apply to every reseller in this market including us.

1. The infrastructure underneath. We run on Vultr, DigitalOcean, Hetzner and Linode. Their side sees the server, its address and its traffic. What they do not see is you: the account is ours, so their records point at NoctHost, not at your email. That is a real privacy property, and it is also the whole of it.
2. Your own server. A fresh Linux box logs SSH authentications, systemd services and your web server's requests by default. If nobody turns that off, "no logs" ends about sixty seconds after deployment — on your side, not ours.
3. The payment rail. We do not see your card or wallet, but the processor does its own compliance. Paying in crypto changes who holds that record; it does not delete it.

What to ask a host instead

"Do you keep logs?" gets a marketing answer from everyone. These do not:

• How long are request logs kept, in days?
• What is in the account record, field by field?
• What do you hand over when an abuse report arrives, and what do you refuse?
• Who owns the account at the underlying provider?
• What happens to my disk when I destroy the server, and when does the snapshot expire?

If a host cannot answer those in specific numbers, the shield icon on their front page is decoration.