Warrant canary
Signed and timestamped since Q1 2022. If it disappears, is delayed, or changes in content, consider that something is wrong — and act accordingly.
Five years of offshore infrastructure, told without marketing: why we exist, how we grew, and what “bulletproof” really means to us.
VPSPLEX was born in the spring of 2021, from two frustrations shared by its founders. The first: KYC data leaks. Within a few months, millions of ID scans and proof-of-address documents ended up online after breaches at services nonetheless considered reputable — documents that never truly disappear from the Internet. The second: abusive takedowns. Hosts, mostly American, were cutting entire servers on the sole basis of automated DMCA complaints, without judgment or effective recourse, hitting independent media and perfectly lawful archives at least as often as genuinely disputed content.
Our founders were already running hosting infrastructure for their own needs. They drew a simple conviction from this: a host that knows your name is a point of failure — for you, and for everyone you host in turn. VPSPLEX was therefore designed backwards. We first listed everything a host does not need to know, then made the collection of that data technically impossible, not just contractually prohibited.
Concretely: an account is a client-side generated token stored as a hash; payment goes exclusively through crypto (BTC, XMR, ETH, USDT, LTC, SOL, TRX), via Paymento or directly on-chain; the servers sit in six jurisdictions chosen for their law — Netherlands, Romania, Iceland, Panama, Switzerland, Russia — not for the price per Mbit/s. No name, no email, no ID ever passes through our forms, for a trivial reason: there is no form.
VPSPLEX has been operated from Panama City, Republic of Panama, since day one — June 2021. This choice is not decorative: it is where our seat is located, where the decisions that bind the company are made, and we have deliberately established no entity anywhere else — neither in the United States nor in the European Union. The law applicable to our activity is Panamanian law, whose courts remain fully competent over us: we claim no immunity, only the slowness and the form of legal procedures, for us as for anyone who would seek to reach us.
Being offshore does not mean being above the law, and we will never promise that. VPSPLEX enforces a strict Acceptable Use Policy (AUP): no phishing, no malware, no spam, no child exploitation. A local court decision, transmitted through official channels, is reviewed and executed within the hour. What we refuse are summary executions: automated takedowns, pressure from rights holders, requests lacking legal basis. “Bulletproof” describes, for us, resilience against abusive complaints — not immunity.
We have never raised funds. No investors, no funding rounds, no board of directors: VPSPLEX's growth is financed by its customers, which remains the best way to stay aligned with them. The team — eight people spread across four time zones — was built slowly, through co-optation, among network operators we had known for a long time.
Five years later, the numbers have changed; the mechanics have not. Six countries, more than eleven thousand VPS deployed, 99.98% uptime, a website translated into twenty-four languages. We still publish a warrant canary every quarter, our incident postmortems remain public, and no one — not even our own support — can link a server to a name.
We do not sell anonymity. We sell the absence of data.
Each step was dictated by a real constraint — legal, technical, or financial. Nothing was accelerated by external capital.
Public launch on June 14, 2021, with three jurisdictions — Rotterdam, Bucharest, Reykjavik —, a single VPS plan, and the token model from day one: no customer ever provides a name, email, or ID.
Publication of the first warrant canary, signed and renewed every quarter since, without a single interruption. In November, 47 minutes of downtime in Reykjavik led to our first public postmortem — causes, errors, and remediations laid bare.
Passing the five-thousandth active VPS. Deployment of our L3–L7 anti-DDoS protection at the network edge — it would prove itself publicly the following year, against an 800 Gbps attack.
Announcement of AS216455, our autonomous system, with clean IPv4 and IPv6 ranges. The same year, the network absorbed a DDoS attack peaking at 800 Gbps without a single service interruption.
Opening of our server site in Panama City — until then the seat of the entity, now also a node of the network, in a jurisdiction with no data retention law — and launch of the GPU line: RTX 4090 from $119 per month for inference, rendering and training.
Moscow joins the map, bringing the network to six jurisdictions. More than 11,000 VPS deployed since 2021, 24 languages, eight people — and the same rules as in 2021.
Six non-negotiable principles that explain both our longevity and our refusals.
Eight people, four time zones. When one goes to bed, another takes over: support and network monitoring run continuously, without call centers or outsourcing.
No venture capital, no fundraising, no external shareholders. Cash flow comes from customer subscriptions — the only 'board of directors' we depend on.
No meeting room, no nameplate at the entrance, no scattered offices: a single anchor point, Panama City, where the entity operating VPSPLEX has been established since 2021. The rest of the team is distributed across four time zones — the company fits in eight machines, a network it owns, and very few surfaces to raid.
Our hardware, our AS (AS216455), our IP ranges monitored against blocklists. We do not resell someone else's capacity: every hypervisor, every router, every cable belongs to us.
No level-1 scripts or 'have you tried restarting?'. Those who answer tickets are those who operate the network — median first response time: 22 minutes.
Quarterly canary, public postmortems, open uptime history. What can be verified does not need to be promised.
Three regular publications are enough to track our real health — legal, technical, and financial.
Signed and timestamped since Q1 2022. If it disappears, is delayed, or changes in content, consider that something is wrong — and act accordingly.
Uptime by site, ongoing incidents, scheduled maintenance. Complete and exportable history since 2022, with no blind spots.
Complaints received, upheld, challenged and rejected — with figures and context. The 2025 record: 377 DMCA-type notices, all rejected with grounds, two court orders executed, eleven informal requests turned away.
Read next: The no-KYC model · Network & AS216455 · Our AUP · Warrant canary
The fastest way to judge us: deploy a VPS, stopwatch in hand. Less than 60 seconds, paid in crypto, without ever saying who you are.
Deploy a server