RAM-Only VPN Servers: What the Design Does and Does Not Prove

RAM-only (diskless) VPN servers run their operating system and service state in volatile memory rather than writing it to a local data disk. This can reduce local persistence after shutdown. It does not by itself prove that a VPN keeps no logs or that no information is held by central systems.

What the design can and cannot tell you

A local disk can retain operating-system or application data, depending on configuration. A RAM-only design reduces this particular storage path. It cannot prevent an operator from observing a running server, sending telemetry elsewhere, or retaining records in a control plane or another service. Nor does the label tell you how keys, boot images, monitoring, or administrator access are controlled.

There is no single universal RAM-only boot process. Some environments load an image over a network; other implementations use different provisioning and verification systems. Ask which systems an audit examined rather than assuming signed images or short-lived certificates are present.

Provider examples and scope

• ExpressVPN describes its TrustedServer architecture as RAM-only. Its public material explains that servers load a fresh software stack during startup. Review the provider's current TrustedServer description and the scope and date of any linked audit.
• NordVPN publicly describes RAM-based infrastructure. Its historical breach concerned a rented server in Finland in 2018 and was disclosed in 2019; read the company's incident response alongside independent reporting. The incident does not establish that a diskless design existed at that time.
• Proton VPN documents full-disk encryption for its servers and describes Secure Core as a routing and physical-security feature. Its RAM-only article and Secure Core documentation describe distinct controls; Secure Core should not be described as proof that the entire fleet is diskless.
• Mullvad announced completion of its migration to RAM-only VPN infrastructure in September 2023 in this provider update. This is a dated provider statement; check later disclosures for changes.

These examples describe different controls and statements. They are not a ranking or a guarantee of current security.

Read audits carefully

An audit is evidence about the systems, period, and scope the auditor examined. Look for the auditor, publication date, service or fleet coverage, testing method, exclusions, and whether important findings were resolved. A RAM-only statement and a no-logs audit answer different questions. Neither removes the need to understand accounts, payment records, support systems, telemetry, and legal requests.

A historical server seizure can also be informative, but it should not be retroactively credited to an architecture introduced later. For example, the 2017 Turkey seizure of an ExpressVPN server predates the provider's later TrustedServer rollout; the event is not proof that RAM-only design caused the outcome.

Questions worth asking

1. Does “RAM-only” cover every production VPN server or only a subset?
2. What data can the running service send to central monitoring, and how long is that data retained?
3. What did the most recent independent audit cover, and what did it exclude?
4. How are server images, management access, and signing keys protected?
5. What account and payment data is retained outside the VPN server?

Treat diskless architecture as one layer in a wider evidence review. See our VPN security checklist and methodology.