Originally published on proxymint.

TL;DR

  • Every proxy provider keeps some logs. Billing per GB, handling abuse reports and answering legal process all need records, so the real question is which records and for how long.
  • Over HTTPS a proxy sees the destination, not the content. A CONNECT tunnel names only the host and port; paths, headers, passwords and page content stay inside TLS.
  • "No logs" claims have failed under court orders. Records from a web proxy service in 2011 and a VPN with a no-logs policy in 2017 both ended up in criminal cases.
  • A good policy names its records. Look for the fields logged, the purpose, the rule that sets retention, the disclosure rule and your rights.

Key takeaways

  • Read the privacy page before buying. Check for named records, stated purpose, a retention rule, a legal-request rule, no data resale and a way to request your data.
  • Send traffic only to HTTPS targets. Plain HTTP requests reach the proxy with the full URL, headers and body readable.
  • Never install a provider root certificate. Leave certificate checks on; a trusted proxy certificate is the only way a proxy can read HTTPS content.
  • Choose where DNS resolves on purpose. socks5h sends host names to the proxy; socks5 resolves them locally where your own resolver sees them.

Read the full guide on proxymint, with the commands, tables and sources.