Frequently asked questions

No. VPSDEN has never asked a customer for a name, an address, a phone number, or a government document, and the ordering system has no field to store one. An account is created as a 20-character access key generated in your browser at checkout. That key is the entire identity. We keep a salted hash of it so we can recognise it at login, and nothing else.

No. Email is an optional field used only if you want deploy notifications or password-style recovery, and even then we store only a hash unless you explicitly ask to be contacted.

Cryptocurrency only. Monero (XMR) is our recommended method and the one we use for our own infrastructure. We also accept Bitcoin on-chain and over Lightning, Litecoin including MWEB, USDT and USDC across four networks, Ethereum, TON, TRON, Solana, Dash and the rest of a list that runs to 46 assets in total (the count is published at vpsden.com/payments). Settlement runs through OxaPay, which means no card networks, no bank, and no name attached to a payment.

Yes. Top up a prepaid balance with any supported cryptocurrency — €10 minimum — and instances bill per hour against it. Destroy the instance and the billing stops that hour. There is no auto-renew, no stored payment method, and no invoice tied to an identity.

Yes, in full, for 72 hours, no reason required and no questions asked. Refunds are paid in the currency you sent to an address you supply. After 72 hours, unused prepaid balance stays available as credit indefinitely but is not returned to chain.

Yes, at the same specification. A 2 vCPU / 4 GB / 60 GB NVMe instance is €7.90 per month at VPSDEN against roughly €11 to €25 across the comparable privacy-focused offshore providers we surveyed. We own our hardware in six of our nine regions and sell no managed services, which is where the difference comes from. The methodology and the raw comparison table are published at vpsden.com/compare.

Cryptocurrency only. Monero (XMR) is our recommended method and the one we use for our own infrastructure. We also accept Bitcoin on-chain and over Lightning, Litecoin including MWEB, USDT and USDC across four networks, Ethereum, TON, TRON, Solana, Dash and the rest of a list that runs to 46 assets in total (the count is published at vpsden.com/payments). Settlement runs through OxaPay, which means no card networks, no bank, and no name attached to a payment.

No. VPSDEN has never asked a customer for a name, an address, a phone number, or a government document, and the ordering system has no field to store one. An account is created as a 20-character access key generated in your browser at checkout. That key is the entire identity. We keep a salted hash of it so we can recognise it at login, and nothing else.

No. Email is an optional field used only if you want deploy notifications or password-style recovery, and even then we store only a hash unless you explicitly ask to be contacted.

A RAM-only (GHOST) instance has no persistent disk at all. It PXE-boots a signed image straight into volatile memory and its entire filesystem lives in tmpfs. Because DRAM loses its contents when power is removed, a seized, unplugged or rebooted GHOST node contains nothing to recover — there is no platter to image and no SSD controller holding remapped blocks. It is the only architecture where "we deleted your data" is a statement about physics rather than a promise.

Not if you enable zero-knowledge LUKS, which is on by default on every disk-backed plan. The volume is encrypted with LUKS2 using argon2id and a passphrase that is generated and held by you. Each boot halts in an initramfs dropbear shell until you SSH in and unlock it. We never receive, escrow, or transmit that passphrase, so a compelled disclosure produces ciphertext. On GHOST RAM-only instances the question does not arise: there is no disk.

At the platform level: the salted hash of your access key, the specification and region of each instance, the amount and status of each payment, and a 15-minute-resolution aggregate of total per-region bandwidth for capacity planning. We do not log customer IP addresses, panel session IPs, user agents, per-instance traffic samples, DNS queries, console sessions, or the contents of any volume. Metadata-free mode, enabled by default, disables per-instance graphing at the hypervisor layer so those samples are never generated in the first place.

An optional service that destroys your data if you stop checking in. You pick an interval — 24 hours to 90 days — and a grace period. Check in from the panel, the API, the onion service, or with a signed heartbeat from the instance itself. Miss the window and the grace period, and we destroy the volume key and wipe and reprovision the node. It is irreversible by design, including for us, and costs €2.00 per month.

A second panel PIN that logs in normally, shows a plausible panel for a few seconds, and silently triggers immediate key destruction and wipe across every instance on the account. It exists for the situation where someone is compelling you to log in while watching. It is a €2.00 per month add-on.

No. We do not perform deep packet inspection, we do not run an IDS on customer traffic, we do not throttle by protocol, and we do not block ports outbound except 25 by default, which we open on request. Torrent traffic, VPN and Tor exit relays, and encrypted tunnels are all explicitly permitted.

Not if you enable zero-knowledge LUKS, which is on by default on every disk-backed plan. The volume is encrypted with LUKS2 using argon2id and a passphrase that is generated and held by you. Each boot halts in an initramfs dropbear shell until you SSH in and unlock it. We never receive, escrow, or transmit that passphrase, so a compelled disclosure produces ciphertext. On GHOST RAM-only instances the question does not arise: there is no disk.

With zero-knowledge LUKS enabled, the seizing party obtains encrypted blocks and a LUKS2 header hardened with argon2id. With a GHOST RAM-only instance there is no storage device attached to the instance at any point and no guest state is written to any persistent medium, so a seized machine holds none of your data on any disk it may contain. If you have multi-jurisdiction failover enabled, your standby in a second country is promoted automatically and your DNS follows within about 60 seconds. VPSDEN has had one seizure event; the transparency report at vpsden.com/transparency sets out what happened and what changed afterwards.

Every request is reviewed by counsel in the jurisdiction where the relevant hardware sits. We respond only to a valid, binding order issued by a court of that jurisdiction — never to an email, a foreign subpoena, an informal police request, or a rights-holder demand letter. When an order is binding we produce exactly what it compels and not one field more, which in practice is a hashed identifier, a payment amount, and encrypted blocks. Our transparency report is published at vpsden.com/transparency. Our warrant canary has not been issued yet, and the canary page says so rather than showing an unsigned one.

The DMCA is United States law and does not apply to any of our regions — we operate no infrastructure in the United States and hold no US corporate presence. We forward copyright complaints to the customer for information and, in eight of our nine regions, take no action on them absent a binding order from a court in the country where the server physically sits. That is the correct legal position, not a favour: a Panamanian or Icelandic server is not subject to a US notice-and-takedown regime. Malaysia is the exception and we say so plainly — sections 43B to 43I of its Copyright Act 1987 create a statutory notice route under which a rights holder notifies us directly and we must remove or disable access within 48 hours, with a counter-notification route for the customer. Choose Kuala Lumpur for regional latency, not for copyright distance.

Four things: child sexual abuse material, malware command-and-control and ransomware infrastructure, bulk unsolicited email, and attacks launched from our network against third parties such as DDoS, port scanning, or credential stuffing. These are the categories that get upstream transit revoked and hardware seized, which would end the service for every other customer. Everything outside that list — including content that is merely controversial, commercially inconvenient, or illegal in a country you are not hosted in — is between you and the law of the jurisdiction you selected.

With zero-knowledge LUKS enabled, the seizing party obtains encrypted blocks and a LUKS2 header hardened with argon2id. With a GHOST RAM-only instance there is no storage device attached to the instance at any point and no guest state is written to any persistent medium, so a seized machine holds none of your data on any disk it may contain. If you have multi-jurisdiction failover enabled, your standby in a second country is promoted automatically and your DNS follows within about 60 seconds. VPSDEN has had one seizure event; the transparency report at vpsden.com/transparency sets out what happened and what changed afterwards.

A RAM-only (GHOST) instance has no persistent disk at all. It PXE-boots a signed image straight into volatile memory and its entire filesystem lives in tmpfs. Because DRAM loses its contents when power is removed, a seized, unplugged or rebooted GHOST node contains nothing to recover — there is no platter to image and no SSD controller holding remapped blocks. It is the only architecture where "we deleted your data" is a statement about physics rather than a promise.

Provisioning itself is built to complete in under a minute — our internal target is 48 seconds from confirmed payment to a reachable SSH prompt, and we do not publish a measured median because we do not yet publish monitoring data. What dominates the wall-clock is crypto confirmation, not us: Bitcoin over Lightning is effectively instant, Bitcoin on-chain takes as long as a block does, and Monero is released after ten confirmations, which is roughly twenty minutes.

An optional service that destroys your data if you stop checking in. You pick an interval — 24 hours to 90 days — and a grace period. Check in from the panel, the API, the onion service, or with a signed heartbeat from the instance itself. Miss the window and the grace period, and we destroy the volume key and wipe and reprovision the node. It is irreversible by design, including for us, and costs €2.00 per month.

A second panel PIN that logs in normally, shows a plausible panel for a few seconds, and silently triggers immediate key destruction and wipe across every instance on the account. It exists for the situation where someone is compelling you to log in while watching. It is a €2.00 per month add-on.

Yes — a REST API authenticated with a scoped token derived from your access key, plus a Terraform provider and a single-binary CLI. Every panel action has an API equivalent, and the API is reachable over both clearnet and our onion service.

Debian, Ubuntu, Alpine, Rocky, Arch and NixOS on the Linux side, FreeBSD and OpenBSD on the BSD side, plus hardened images including a Whonix gateway and an amnesiac Debian profile. You can also upload an arbitrary x86-64 ISO and install it through the out-of-band console, or PXE-boot your own signature-verified image.

Choose Reykjavík for the strongest overall balance of speed and legal protection: no retention mandate reaching hosting providers, no Fourteen Eyes membership, no DMCA, and an estimated ~21 ms from London. Choose Amsterdam if raw performance matters more than jurisdiction. Choose Seychelles for maximum legal distance — it has no bilateral mutual legal assistance treaty with the United States — and accept an estimated ~148 ms from London. Choose Panama City for the Americas — a US mutual legal assistance treaty has been in force there since the mid-1990s and Panama acceded to the Budapest Convention on Cybercrime in 2014, so US criminal process has a route into the region, executed under Panamanian law by a Panamanian court. The Jurisdiction Matrix at vpsden.com/jurisdictions compares all nine regions across retention law, takedown regime, intelligence-sharing membership and mutual legal assistance speed.

No. We do not perform deep packet inspection, we do not run an IDS on customer traffic, we do not throttle by protocol, and we do not block ports outbound except 25 by default, which we open on request. Torrent traffic, VPN and Tor exit relays, and encrypted tunnels are all explicitly permitted.