What a VPN server is, and what it can see

A VPN server is the computer at the far end of your tunnel. It receives your encrypted packets, decrypts them, sends them to the internet with its own address as the source, and passes the replies back down the tunnel to your phone. It is usually a rented machine in a commercial data centre, running the provider's software, and its public address is the exit IP websites see while you are connected. Because it decrypts your traffic, it is also the one place on the path that can see where that traffic is going, which makes what it keeps the most important question about it.

What a server physically is

Providers rent servers, or virtual machines on shared hardware, from hosting companies in the cities they want to offer. Each has a fixed public address, a fast connection to the internet, and software for each VPN protocol the provider supports. A city with several servers is what an app calls a location; the servers behind it are interchangeable from your point of view, and a good app picks among them for you. How a good VPN app picks a server covers what it should weigh.

Servers are also, deliberately, disposable. A provider that can take a server out of service, replace its address or upgrade its operating system without anyone noticing is running a healthier fleet than one where users have favourites. This is the reason many apps do not let you pick a specific server: a pinned server turns every routine maintenance into a visible outage.

What the server does, in order

1. Completes the handshake with your app, proving it is the real server and agreeing session keys.
2. Receives your encrypted packets and decrypts them.
3. Rewrites the source address on each packet from your phone's to its own, and sends it on.
4. Answers your DNS lookups with its own resolver, so they never leave the tunnel unencrypted.
5. Matches replies to your session, encrypts them, and sends them back.

Steps 3 and 4 are why the server can see what it sees. It cannot forward a packet without reading its destination, and it cannot answer a lookup without reading the name.

What the server necessarily sees

The last row is smaller than it sounds, because almost all web traffic is inside HTTPS, which the server cannot read; it sees which site, not which page or what you typed. But the first four rows are unavoidable for any VPN, and they are exactly what your ISP or the café Wi-Fi could have seen without one. A VPN moves that view from the network you happened to be on to the provider you chose. The value of the move depends on what the provider does with it.

What the server should not know

The list above is what a server sees in the moment. It is a separate question what it keeps, and a separate question again what it knows about you.

A server does not need your name, your email or your account to do its job. It needs to know that a given tunnel is authorised and which keys to use. A well-designed provider keeps accounts in a separate system and hands the server only an opaque identifier for each session, so the machine handling your traffic never holds anything that names you. If that machine were copied or seized, the copy would show sessions with meaningless ids, not people. What a seized VPN server can reveal follows that scenario through.

Whether the server writes down the destinations it forwarded is the provider's choice, and it is the choice that the word "logs" refers to. Culvert VPN's servers do not log the sites you visit, your DNS queries or the contents of your traffic, and they see only an opaque connection id rather than an account; the provider does keep the client's IP address for up to 30 days, in its account system rather than on the servers, so that abuse complaints can be handled. The privacy policy states this in full.

Server, location, city, country

Apps use these words loosely, so here is the strict version. A country is the top level of the picker. A city is a place within it where the provider has servers, and is what "location" usually means. A server is one machine in that city. When you tap a country, a sensible app connects you to the city with the lowest measured latency from your phone; when you tap a city, it connects you to the healthiest server there. You never need the server's name, and most apps never show it.

Load: why a server can be near and still slow

Every server has a ceiling on how much traffic it can carry, set by its network link and, for the more expensive protocols, its processor. A server near you at ninety percent of capacity will feel slower than one two countries away at twenty. Distance is the thing you can see on a map; load is the thing that usually explains a slow afternoon. What server load is explains how a good app measures and shows it, and why a three-bar glyph is not that.

Culvert VPN's servers hold no account for you, only an opaque connection id, and the app shows real measured latency and load per city before you connect, free on Google Play.