No-KYC Hosting: Servers Without ID

No-KYC hosting is defined simply: renting and administering a server without transmitting the slightest identity information — no name, no address, no ID, no phone number. No named account, no invoice in your name, no customer database associating a natural person with a machine. At VPSPLEX, since 2021, a customer's identity comes down to a 160-bit token generated in their browser: that is all, and it is deliberate.

The public debate usually pits KYC against anonymity, as if you had to choose between security and privacy. That's wrong. An ID does not protect a server, a network, or an application: the security of an infrastructure lies in KVM virtualization, hardening of hypervisors, anti-DDoS at the network edge, and the responsiveness of competent support — not a scanned passport. On the other hand, every KYC database created is a concrete risk, deferred to you, the customer, for years.

Why? Because a centralized database always ends up leaking. Between 2023 and 2026, the sector has not lacked examples: in 2023, ID scans and verification selfies from a major European hoster were exposed via a poorly secured API; in 2024, a telecom operator's customer database — complete identities and supporting documents — was resold on a forum before fueling doxxing and SIM-swap fraud; in 2025, successive revelations showed that government requests to hosters number in the thousands each year, the vast majority without a judicial warrant, and almost always accompanied by a non-disclosure order that prevents you from learning that your data was accessed; in early 2026, several ransomware groups specifically targeted KYC databases, exfiltrating identity documents to use as leverage for blackmail.

Note the common mechanism: in each case, it's the customers — the most numerous, the least protected — who absorb the final cost. The hoster gets a fine, sometimes; you carry a compromised identity for ten years. The argument 'I have nothing to hide' does not hold up to this reading: you don't know who will buy the database tomorrow, nor what the law will be the day after. A journalist covering corruption, a whistleblower, or a security researcher do not need to be guilty to need protection: they just need to be visible.

KYC is not a bad practice per se: it's a practice whose cost is shifted onto the customer. We made the opposite choice — collect nothing, so we have nothing to lose and nothing to hand over.

The token is not just another password: it is a deliberately amnesiac identity. A classic system associates login, password, email, invoice, and ID; breaking or convincing a single link is enough to trace back to you. With us, the final link — the ID — does not exist, and the chain stops at the hash.

Concretely, support cannot "verify your identity" before helping you, because there is no identity to verify: they verify possession of the token, via a cryptographic challenge, that's all. It is less comfortable — a lost token is a lost account, services included — and that is exactly the price of the ownership you care about. If we could recover your account, someone else could recover it in your place.

Threat model, honestly

Let's be precise about what no-KYC protects — and what it does not. It protects against customer-database leaks, mass requests, cross-referencing by data brokers and opportunistic denunciation: with no name, no email, no logs, there is literally nothing to correlate. It does not protect against a targeted investigation into you upstream: if you administer your server from an identified connection without a VPN or Tor, your ISP — not us — knows what you are doing. It does not protect against the compromise of your workstation, nor against global traffic analysis. No-KYC removes the KYC; it does not replace serious operational hygiene. We document ours in the guides.