Our threat model, stated explicitly
Any security claim is meaningless without saying who the adversary is. Here is ours, in descending order of how well we handle it.
1. Physical seizure of hardware — handled well
LUKS with a key we never hold means a seized drive yields ciphertext. GHOST means a seized chassis yields nothing at all. Failover means the workload keeps running elsewhere. This is the scenario we are engineered for and the one that actually occurs.
2. Compelled disclosure by a court — handled well
We comply with binding orders from courts in the jurisdiction where the hardware sits, and we produce exactly what is compelled and nothing more. That is a salted hash, a payment amount, an instance specification, and encrypted blocks. In 12 years we have received 412 requests, of which 23 were valid local court orders and 23 were complied with. Those disclosures produced 0 customer records — not because the orders were resisted or were unenforceable, but because a customer record in the sense of a name, an address, a payment instrument or an identity document has never existed in our systems to hand over.
3. Our own insolvency or acquisition — handled structurally
The most under-discussed risk in this industry. A customer database is an asset in a bankruptcy and it gets sold. Our answer is that the database does not contain anything worth buying: no names, no addresses, no payment instruments, no IP addresses. An acquirer gets a list of hashes.
4. A hostile insider — partially handled
Hypervisor access is limited to four people, every privileged action is logged to an append-only store in a separate jurisdiction, and console access requires two-person authorisation. But an operator with hypervisor access can read guest memory, and no hosting provider can honestly claim otherwise. If your threat model includes us, you want genuinely dedicated hardware with your own disk encryption, treating the host as a landlord — and we do not sell that. VOID is bare-metal-class but still virtualised. Buy physical isolation from a provider that actually offers it.
5. A state-level adversary specifically targeting you — not handled
We will say this plainly because the rest of the industry will not: if a well-resourced state actor is specifically interested in you, a €7.90 VPS is not your answer. Traffic correlation, endpoint compromise, and legal process against every intermediary are all available to them. What we can offer is that the hosting layer is not the weak link, and that we will not be the ones who hand you over. That is the honest boundary of what a hosting company can do.
What we ask of you
Almost every real-world deanonymisation we have seen came from the customer's side, not ours. In descending order of how often it happens:
- Administering an anonymous server from a home IP address with no tunnel.
- Registering the domain with real WHOIS data.
- Paying with cryptocurrency withdrawn directly from a KYC exchange to the invoice.
- Reusing an SSH key, a PGP key, or a username that appears elsewhere under a real name.
- Running an application that leaks an identifier — an analytics tag, a support widget, a default error page with a hostname in it.
We have written up the boring layers in the hardening checklist and the Monero payment guide. Get those right before you spend money on the exotic ones.