A VPS with no KYC — no ID, no phone, no verification

KYC stands for know-your-customer: the process of verifying who a customer is before serving them. It began in banking, where anti-money-laundering rules genuinely require regulated institutions to identify account holders. Hosting providers borrowed the term and the habit, even though renting a virtual server is not a regulated financial activity. In practice a host’s KYC looks like some combination of these:

• a working email you must confirm, often with disposable addresses blocked;
• a phone number and an SMS or call verification code;
• a payment card whose billing name has to match the account;
• a scan of a government ID or passport, sometimes with a selfie or liveness check;
• geolocation and device fingerprinting to flag “risky” signups.

Why do they bother? Rarely because a law tells a VPS company to collect passports. The real drivers are commercial: card networks impose chargeback liability, so hosts try to tie every order to a recoverable, identifiable person; fraud teams treat anonymity itself as a risk score; and resellers inherit the KYC demands of whatever upstream they build on. Identity verification is the path of least resistance for a business that settles in fiat — not a legal necessity for selling compute.

We collect none of the above. There is no email requirement, no phone number, no SMS code, no card in your legal name, no ID document, and no selfie. The reason we can skip all of it is that we never touch the card networks and fiat processors that make KYC feel mandatory. You pay in Monero — our primary coin — with Bitcoin and Lightning also accepted, and payments are processed by OxaPay, a payment processor, with no card network or billing name in the path. Self-hosted BTCPay with native Monero — removing the intermediary — is on our roadmap.

Instead of an account tied to your name, an order is tied to a random 32-character token issued at checkout. That token is your credential — save it, and you can manage or top up the server without ever having handed us a personal detail. The mechanics of how that token stands in for an identity are covered on anonymous VPS; this page is about the thing we deliberately do not do, which is verify who you are.

There is no verification gate between choosing a server and using it. The whole flow is designed so that no step ever asks “prove who you are”:

1. Pick a plan. Choose a size on pricing. No account and no personal details are needed to reach checkout.
2. Take your order token. Checkout returns a random 32-character ID. This is your account for the order. An email is optional and, if you want one at all, a disposable address works.
3. Pay in crypto. Pay in Monero — our primary coin — or in Bitcoin or Lightning; payments are processed by OxaPay, a payment processor. There is no card form and no billing name to match. See how to pay with Monero for the step-by-step.
4. Get provisioned. On confirmation the server is built automatically — no human reviews your identity, because there is no identity to review. Manage it from the panel over Tor or clearnet.

No verification call, no “your order is under manual review” email, no waiting on a risk team. The absence of KYC is not a discount you unlock; it is simply how ordering works here.

For the buyer, in most jurisdictions, yes. There is no general legal duty to present identification in order to rent a server, and paying for a lawful service without identifying yourself is permitted. The important distinction is that legality attaches to what you run, not to whether you were verified. Skipping KYC does not change your obligations one bit: the workloads you host must comply with our Acceptable Use Policy and with the law that applies to you.

Choosing where your server lives is a separate, legitimate decision — some people pick a jurisdiction on purpose for data-protection or free-expression reasons, which is what our offshore VPS pages are about. That is about the server’s legal home, not about hiding who you are from us.

This is the distinction that matters most, so we state it plainly. A bulletproof host markets the opposite of accountability: it advertises that it ignores abuse complaints and legal process. We do neither, and we do not want the customers who are shopping for that. Not collecting identity you do not need is a privacy decision; ignoring abuse is a different thing entirely, and we reject it.

Concretely, that means:

• We publish a real Acceptable Use Policy and enforce it. Some workloads are not welcome here regardless of how anonymously they were ordered.
• We run a staffed abuse desk and acknowledge reports within 24 to 48 hours. Enforcement happens at the service level — suspend, throttle, or terminate the offending service — which we can do without ever having your identity.
• We cooperate with legitimate legal process, and we do not manufacture data to hand over. What we hold and for how long is bounded in advance by the no-logs policy, and requests we receive are counted in the transparency report.

The result is privacy for lawful users, not immunity for abuse. You get a server without proving who you are; you do not get a place to break the rules, because the rules are published and answered — we just enforce them against the service, not against your identity.