RAM-Only Servers: Why Diskless VPN Infrastructure Matters

A VPN provider's "no-logs" statement is a policy claim about which data it processes and for how long. On servers with local disks, misconfiguration, temporary files, or later-added logging can leave persistent traces. RAM-only architecture reduces these local persistence paths, but it does not technically prevent in-memory logging, live monitoring, transmission to central systems, or control-plane telemetry.

What Is a RAM-Only Server?

A RAM-only or "diskless" server is designed to run the operating system and applications in volatile memory instead of local disk. On boot, the OS image is typically loaded from central configuration infrastructure. This limits writes to local storage; central logging, monitoring, and management systems outside that architecture still need separate evaluation.

In classic architecture, a server has an SSD or HDD; the OS, log files, temporary files, and application state can be written to disk. In RAM-only architecture, there is either no local disk or it is not used. Restarting normally clears volatile local state, but it does not by itself prove that session data was never collected or sent elsewhere.

What's the Risk of Disk-Based Servers?

No matter how strict a VPN provider's no-logs policy is, if its servers have disks the following risks exist:

System logs: Most Linux distributions write syslog, auth.log, and kernel messages under /var/log by default. These files don't contain VPN traffic but may contain connection timestamps, IPs used, and session metadata.

Temporary files: Application caches and temporary state files accumulate under /tmp and /var/tmp. These don't get cleared on reboot.

Swap file: When RAM fills, the OS uses swap — and swap is persistent on disk. Sensitive session info can land in swap.

Physical access to the server: Beyond the provider's control, the data center operator or a legal action could pull the disk image.

Configuration files: The VPN service's own configs, certificates, and customer list files are kept on disk.

Incident logs: Cloudflare, fail2ban, and similar defense tools can generate records for attack detection; storage location and retention depend on configuration.

Each of these vectors can theoretically undermine a no-logs policy. A server without local disk reduces post-event disk recovery and persistent-malware paths; it does not eliminate central logging, live-memory, or management-system risks.

How Does RAM-Only Architecture Work?

The typical boot process of a diskless VPN server:

1. PXE boot or similar: When power is applied, the server loads a bootloader from the network
2. Connects to a config server: The provider's central orchestration sends a signed, verified OS image
3. Loaded into RAM: All OS and VPN service is loaded into memory
4. Certificates and keys distributed: The server receives its private keys with short lifetimes
5. Reboot: A reboot clears volatile local state and reloads the image; remote records are unaffected

With no local data disk to examine, physical seizure offers less value for conventional disk forensics. Memory on a running system, network observation points, and data in central services remain separate risk areas.

Some providers harden this architecture further: enforce signed kernel modules, prevent bootloader manipulation with secure boot, verify server identity through cryptographic attestation.

Major Providers' Approaches

ExpressVPN TrustedServer

The first major provider to popularize RAM-only architecture. In 2019, it migrated its entire server fleet to TrustedServer infrastructure. Each server loads a signed OS image on every restart and has been audited by independent third parties (PwC, KPMG, Cure53) multiple times.

TrustedServer's signed-image chain is intended to make local changes harder to persist across a reboot and to restore a known image. It does not eliminate attacks against a running server or compromise of the boot, signing, or central-management chain.

NordVPN Colocated Servers

After the 2020 Latvia datacenter incident, NordVPN significantly hardened its infrastructure. It moved to RAM-only servers and shifted to a "colocation" model — meaning instead of renting servers, it began placing its own hardware in data centers.

This distinction is critical: in rented servers, the data center operator could theoretically tamper with hardware. In a colocation model, the hardware is the provider's property and physical access controls are tighter.

ProtonVPN

ProtonVPN uses RAM-only architecture in its "Secure Core" servers. The critical first-hop servers are located in its own data centers in Switzerland, Iceland, and Sweden, away from external control. These servers run fully diskless and are backed by physical security layers (former military bunkers, biometric access).

ProtonVPN's entire fleet isn't yet RAM-only — some main exit servers are still disk-based. The roadmap is to migrate the entire fleet to diskless.

Surfshark, CyberGhost, and Others

Surfshark has been on RAM-only architecture since 2020. CyberGhost adopted the same approach. Most Mullvad servers are RAM-only, but Mullvad's main differentiator is keeping the hardware in its own ownership and a zero-knowledge architecture.

When choosing a provider, look beyond the "we use RAM-only servers" marketing message and check third-party audit reports. Our how to choose a VPN article details this audit process.

RAM-Only Isn't Enough: No-Logs Audits

Diskless architecture is a significant technical safeguard but not enough on its own. The server can still produce logs in RAM and send records to a central system. RAM-only architecture does not automatically mean no-logs.

Independent third-party audits can provide additional evidence. Reports from firms such as PwC, Deloitte, KPMG, and Cure53 examine the systems they can access at a defined date and scope; check whether the work covered the full fleet and whether the findings remain current.

Key audit examples:

• NordVPN: Full audits by PwC in 2018, 2020, and 2022
• ExpressVPN: TrustedServer architecture audits by PwC and KPMG
• ProtonVPN: No-logs audit by Securitum
• Surfshark: No-logs audit by Deloitte
• CyberGhost: Audit by Deloitte

Two things to note in audit reports: scope (a single data center or the full fleet) and frequency (one-time or recurring). An annual audit is far more valuable than a one-shot review.

Historical example: when Turkish authorities seized an ExpressVPN server in 2017, public reports said no customer information came from it. The event shows why RAM-only infrastructure and a no-logs policy should be considered together; it is not a standalone current guarantee.

Resilience Against Court Compulsion

The provider's jurisdiction matters as much as RAM-only infrastructure. In 5/9/14-Eyes countries like the US or UK, privacy can be compelled by court order.

RAM-only architecture reduces the risk that genuinely unretained local historical data can later be recovered from disk. The outcome still depends on whether the no-logs policy is actually implemented, what central systems retain, and the request's scope; RAM alone does not guarantee that historical data exists nowhere.

"Live monitoring" orders or technical surveillance can still target future traffic. Double VPN and multi-hop can limit what one server observes, but it does not automatically defeat provider-level monitoring or legal compulsion when one provider controls the chain.

Jurisdictions differ in data-retention, notice, and legal-request procedures. Rather than treating headquarters location as a guarantee, review current local law together with the provider's transparency reports and request-handling policy.

Is It Safe to Use a VPN Without RAM-Only?

Providers using disk-based servers are not automatically unsafe. Evaluate how persistent storage is configured, which data is collected, the audit scope, and the provider's published incident history together.

When choosing a VPN, treat RAM-only architecture as a positive local data-minimization signal. Instead of assuming why a provider uses disks, review its technical documentation, retention settings, and independent audits. Our free vs paid VPN discussion covers the other criteria.

User-Side Verification

There's no easy way for the user to directly verify a provider's "RAM-only" claim. So:

1. Read independent audit reports — should be published on the provider's website
2. Check the jurisdiction — prefer privacy-friendly countries
3. Look at transparency reports — more credible if published annually
4. Follow community review platforms — PrivacyTools, r/PrivacyGuides, etc.
5. Check whether they hold certifications like PCI-DSS, ISO 27001

Frequently Asked Questions

Does a RAM-only server affect VPN speed? RAM-only design is not the deciding factor by itself. VPN speed depends more on network capacity, server load, CPU, protocol, and distance; verify it on your own connection across several servers and times.

Should every VPN provider use RAM-only? It is a strong design option for reducing local data persistence, but it adds cost and operational complexity. Do not judge a provider's privacy from price or a RAM-only label alone.

Will a restarted server drop my connection? Yes, an active connection can drop; reconnection time varies by app, protocol, and network. A kill switch is designed to block the normal route during that window, but its behavior should be tested on your device.

Do RAM-only servers require certificate changes? Depends on configuration. Some providers issue new certificates on every boot, others use persistent certificates.

Are diskless servers more secure against cyberattacks? Against some risks. Reloading a verified image on each boot can make local persistent malware harder to carry across restarts. The running server, boot chain, and central-management infrastructure can still be attacked.

Conclusion

RAM-only servers are a concrete infrastructure safeguard for reducing local data persistence. The absence of local disk makes historical disk recovery and persistent local changes harder; it does not turn a no-logs claim into a technical guarantee by itself.

RAM-only alone is not enough. Current audits with a clear scope, a data-minimization policy, transparent infrastructure information, and legal context should be assessed together. ExpressVPN's TrustedServer, NordVPN's colocation model, and ProtonVPN's Secure Core servers take different approaches; check provider documentation and audit scope for each.

When picking a VPN, use these architectural features as one part of the evaluation. RAM-only infrastructure, scoped audits, and data minimization together provide stronger evidence, but the result still depends on the provider's implementation. Compare the options on our VPN comparison page, then verify them against current provider documentation.