Server hosting & domains

• The host knows your email address, how you paid and which IP addresses you used to sign up and log in. Even hosts that advertise "no logs" keep billing records, and most log access to their client area for security.
• The payment trail. A card, PayPal or bank transfer ties the server to your legal name. Bitcoin payments sit on a public ledger and can often be traced back to an exchange account. Monero hides sender, receiver and amount by default; see the crypto guide.
• The registrar and the registry behind your domain hold its registration data, and either can suspend the domain, on its own initiative or under a court order in its country.
• The law where the hardware sits. A host registered in one country often runs its servers in another. Mynymbox, for example, notes that local law at the data centre, the upstream network or the domain registry can still apply.
• Everyone else. Server software, TLS certificates, DNS records and email headers can reveal a server's real IP address, its other domain names and sometimes who runs it.

The host can see everything on a VPS

A VPS runs on the host's hardware. The host can read its memory and disk, take snapshots and watch its network traffic. Disk encryption inside a VPS protects the disk image while the machine is off and drives that are thrown away, but not against a host that can read the key from memory while the machine runs. Keep nothing on a rented server that would hurt you if the host, or someone with a court order, copied it, and encrypt sensitive files on your own device before they reach the server (see Encryption).

Unless noted, these hosts accept Monero and need only an email address to sign up. Prices are per month and change often. Njalla, listed under domain registrars, also rents VPSes in Sweden from €15 a month.

Mainstream cloud providers

Large providers are reliable and often cheap, but they usually want to know who their customers are. Hetzner does not accept cryptocurrency and may ask for a copy of a photo ID or a credit card prepayment before it processes an order. DigitalOcean takes cards, PayPal and similar wallets, and stablecoins in some regions, but no prepaid or virtual cards. That is fine for a project you run under your own name. For a pseudonymous one, it means the provider can connect the server to your legal identity.

The domain is the hardest part to keep anonymous: registries want a reachable, accountable registrant, and whoever controls the registration can switch your domain off. The recommended option below acts as the registrant itself, so your own details never reach the registry.

Mynymbox also registers domains in its own name and is itself the registrar for .gd, .vg, .gl, .fo, .fm and .st. IncogNET includes a free WHOIS privacy proxy, which hides your details from the public but leaves them with IncogNET and its registrar.

For most domains a registrar has to collect a name, address, phone number and email. What the public sees depends on the registry's rules and on how your registrar handles them:

For generic domains such as .com and .org, ICANN's Registration Data Policy has applied since 21 August 2025. It lets registrars redact personal data but requires them to publish the registrant's country, and the state or province if collected. Redacted data can still be disclosed: ICANN's Registration Data Request Service passes requests from police, security researchers, intellectual-property representatives and others to participating registrars. Its pilot ended in November 2025, and ICANN has kept it running for up to two more years. Lookups now go through RDAP; since January 2025 most generic registries and registrars no longer have to run the older WHOIS service.

Country domains have their own rules

• .us bans privacy and proxy registrations: the registry must hold, and may display, the registrant's real details.
• .eu is open only to people and organisations with a connection to the EU, Iceland, Liechtenstein or Norway, such as citizenship or residence, and EURid may verify registration data before or after a domain goes live.
• .ru rules (in Russian, current version in force since May 2026; an English translation covers the 2021 version) require the registrant's ID document details and an SMS-capable phone number. Registrars may cut off a domain if the data proves inaccurate, on a written request from Russian investigative authorities, or on a demand from the regulator Roskomnadzor, for example when a domain was registered with someone else's personal data without consent.
• Generic domains, and country domains without residency rules, generally work with registrant-of-record services. Read the registry's rules before you buy.

• Separate the identity from the start. Use a new email alias or mailbox for this project only (see Email), and never sign in to the host from an account or device tied to your real name. The alting guide covers keeping identities apart.
• Pay with Monero, or at least not with a card. Bitcoin withdrawn from an exchange where you passed identity checks links the payment to you. Monero hides amounts and addresses by default; see the crypto guide. FlokiNET also takes cash by post. Rules on cryptocurrency and cash payments differ between countries.
• Connect only over Tor or a VPN you trust. Sign up, pay, open support tickets and log in over SSH without exposing your home IP address; most hosts log client-area logins. See the VPN guide.
• Use SSH keys, not passwords. Create a key pair for this server only, turn off password and direct root logins, and keep the private key on an encrypted device.
• Keep the attack surface small. Run a host firewall that allows only the ports you use, and install security updates promptly; Debian and Ubuntu can install them automatically.
• Hide the origin when it matters. An onion service needs no domain, no public IP address and no TLS certificate. Bind the web server to 127.0.0.1 or a Unix socket so it cannot be reached on the server's public address. The Tor Project's setup guide shows how to point Tor at a local web server and recommends Unix sockets, and its operational security notes explain how server software can give away identifying details.
• Remember that certificates are public. Every publicly trusted TLS certificate, including free Let's Encrypt ones, is recorded in Certificate Transparency logs, which anyone can search on sites such as crt.sh. Each hostname you request a certificate for, subdomains included, becomes public.
• Encrypt before you upload. Disk encryption inside a VPS does not stop the host. Encrypt backups and sensitive files on your own machine first.
• Keep fewer logs yourself. Configure your web server and apps to store visitor IP addresses for as short a time as you need, or not at all, and check your own logs for failed logins and unexpected processes.

• ICANN: Registration Data Policyicann.orgWhat registrars must collect, publish and redact for generic domains since August 2025.
• ICANN: Registration Data Request Serviceicann.orgHow police, researchers and rights holders ask registrars for redacted registration data.
• Tor Project: set up your onion servicecommunity.torproject.org
• Tor Project: operational security for onion servicescommunity.torproject.org
• KYCnot.mekycnot.meDirectory of services that do not require identity checks, with user reviews and community-submitted listings. Listings are marked verified, approved or community-contributed depending on how thoroughly they have been checked.