In 2019 I built a small privacy company called Log Zero. We made a VPN for people who wanted to be private online but had no interest in learning how a VPN works. One plan, one price, every device. You signed in, turned it on, and that was it.
Our biggest promise was in the name. We kept no logs. No browsing history, no traffic records, nothing we could hand over or lose in a breach.
Log Zero didn’t last. We launched near the end of 2019, and when COVID arrived a few months later our investor pulled back. We shut it down on 1 April 2020, stopped all billing that day, and wrote to our customers to say goodbye.
It was a small company and a short run. But it taught me something I still use as a CISO, usually when a vendor is sitting across the table from me.
Making the promise is easy
Writing “we keep no logs” on a website takes ten seconds. Keeping it is a different job. Software wants to log things. Servers do it by default. Your payment provider keeps its own records. Your support desk keeps every ticket a customer sends. And someone on the team will always want a little more data to fix a bug or understand why people cancel.
We had to decide, again and again, what we would not collect, and then check that we really weren’t collecting it. The check was the hard part. The promise was the easy part.
So when a vendor tells me they keep nothing, I don’t argue. I ask how they know.
What I ask now
These are the four questions I ask any company that says it doesn’t keep my data. They work for a VPN, a software service or an AI tool.
- What do you collect, even if you don’t call it a log? Email addresses, payment records, support tickets, crash reports. Everything is a record of something. A good vendor can list it without hesitating.
- Who else touches it? Payment providers, cloud hosts, ticketing systems, and with AI, the model provider behind the product. The promise is only as strong as the weakest company in that chain.
- How would I find out if you broke the promise? An independent audit, a published report, a contract clause with real consequences. “Trust us” is not an answer.
- What happens to my data if you shut down? Almost nobody asks this. We had to answer it for real. When a company closes, the data doesn’t disappear by itself. Someone has to delete it, and someone has to make sure it’s gone.
The same promise, now from AI vendors
Today I hear the same promise in new words. “We don’t train on your data.” “Your prompts aren’t stored.” I ask the same four questions, and the answers are often less clear than the marketing.
Simple is part of security
Log Zero also taught me that people don’t use protection they don’t understand. We built the whole product around that: no settings to choose, no countries to pick, nothing to get wrong. I still think about security programs the same way. If the safe option is harder than the risky one, people will take the risky one, and they won’t tell you.
Knowing when to stop
Closing Log Zero was not the ending we wanted. But we had told ourselves that if we couldn’t fully support what we were building, we would close it properly instead of letting it fade. So we did. No surprise charges, no service quietly breaking down month after month.
That’s the part I’m proudest of, and it’s what I look for in the companies I work with now. Anyone can keep a promise when things are going well. What matters is what they do when they can’t keep going.