We used the accounting system built into FreeRADIUS ourselves (until February of 2018), except we modified our instance not to store the source IP addresses of the sessions, which may also be done by other “no-logging” VPN services, but we can never know for sure. PureVPN and IPVanish definitely didn’t do this, and that’s how they were able to cooperate with law enforcement.

The records in this connection table persist forever, so they must be cleaned up. We had a script that pruned this table every minute and removed records from stale connections. Is it possible to prove the existence of this script, or that it ran? No, it is not.

Nice to have logs

Outside of the mandatory basic information mentioned above, Windscribe stores the following pieces of data:

Bandwidth used since your reset date

What servers you’re connected to right now

Timestamp of your last activity (accurate to a 12 hour window)

I’ll discuss each one in more detail.

Bandwidth usage

Each and every Windscribe VPN server runs an instance of OpenVPN (technically 2 instances) and StrongSwan. This facilitates connections via OpenVPN and IKEv2 respectively. Both applications have a command line interface which allow an external application to query the status of the server process. The status of the process also returns a list of active sessions that are currently connected and the byte counts of what was transferred during the session. This data resides in server’s memory (as mentioned previously), so it’s not very useful if it remains there, at the same time we don’t much care for most of this information, all we care about is how much data you used.

This data is fetched every minute, and the byte counts for each connected users are sent over to our central locations, where the API resides. It’s then stored in a Redis database, which exists entirely in server memory. This allows for super high speed lookups which are the basis of our abuse mitigation system as will be discussed later.

Parallel connections

Every time you connect to a Windscribe server, we have to verify your credentials to make sure you’re allowed access. Once that’s done, we need to be able to apply your R.O.B.E.R.T. settings, as everyone’s are different. In order to do this, we contact our API at the moment of connection, fetch this data, and configure R.O.B.E.R.T. in real time. The request to the API includes 3 pieces of information:

Your username

Server hostname

RFC1918 IP address that was allocated for your connection, not to be confused with your actual WAN IP address, which we don’t care about

We store the last 2 parts in a Redis database, in a hash key that’s unique to every user. Once you disconnect from a server, a subsequent API call is made at that exact moment which notifies our API that you disconnected, and this record is immediately discarded from Redis. R.O.B.E.R.T. is also notified that you disconnected, which clears your custom configuration from its memory.

While you’re connected, we can count how many active connections you have, as well as which servers you’re connected to, by looking at your hash key. This data allows us to do some neat things which we’ll get into in a little bit.

Last activity

All our apps use the Windscribe API in order to login, fetch the server list, VPN configs and credentials. If your account is actively making API calls, that means you’re probably still using Windscribe, or at least have it installed and running. We store the timestamp of your last API call within a 12 hour window, as doing it for every request would introduce a heavy write load on our database — something we’d prefer avoiding.