No-KYC hosting
Answer
No-KYC hosting means renting a server without submitting identity documents, a name, an email address or a phone number. Incognito VPS issues a 20-character access token at checkout, accepts payment in twelve cryptocurrencies, and stores no customer identity field at all — there is nothing in the database to disclose.
What KYC normally collects, and why it exists
Know Your Customer rules originate in anti-money-laundering law and apply to regulated financial institutions. Hosting providers are not financial institutions, and in none of our eight jurisdictions is a hosting company legally required to verify who its customers are. The verification you encounter at most hosts is not compliance — it is fraud control, imported wholesale from the card networks.
That distinction matters, because it explains the shape of the problem. When a provider accepts Visa, the card networks impose chargeback liability, and the cheapest defence against chargeback fraud is collecting enough identity to make the customer traceable. Remove the card rail and the entire justification collapses. A payment that settles on-chain cannot be reversed, so there is nothing to defend against and no reason to ask.
What a no-identity account actually looks like
At checkout you receive a token in the form IVPS-XXXX-XXXX-XXXX-XXXX. That token is the account. It is generated client-side from a CSPRNG, shown once, and stored on our side only as an Argon2id hash — we cannot reproduce it, email it to you, or recover it if you lose it. There is no password-reset flow because there is no second factor to reset against.
The account record contains a token hash, a balance in USD cents, a list of server IDs and a creation timestamp. It contains no name field, no email field, no phone field, no billing address and no IP history. This is not a policy choice that could be reversed under pressure; the columns do not exist in the schema.
- Fields stored
- token hash, balance, server IDs, created-at
- Fields not stored
- name, email, phone, address, payment identity
- Token entropy
- 80 bits, CSPRNG-generated client-side
- Hash
- Argon2id, m=64 MiB, t=3, p=4
- Recovery path
- none — by design
The honest limits of no-KYC
No-KYC removes the identity layer at the provider. It does not make you anonymous, and any host telling you otherwise is selling you something. Your server has a public IP address that you will connect to. If you SSH to it from your home connection, your ISP sees that association, and so does anyone with a view of the path.
Nor does it place you outside the law. We operate real companies in real countries and we comply with valid legal orders from the jurisdictions we operate in. What no-KYC changes is the volume of information such an order can produce: an order served on us for customer identity returns an Argon2id hash and a balance, because that is the entirety of what exists.
For actual anonymity you need to combine this with a transport layer — Tor or a VPN you trust — and operational discipline about what you put on the server. We wrote a guide on exactly that, and it is more useful than any feature on this page.
Frequently asked questions
01 Do you require an email address?
No. There is no email field at signup, at checkout or in the account record. Your access token is issued at checkout and shown once. If you want notifications you can optionally supply a webhook URL, which is stored encrypted and is never used for identity.
02 What happens if I lose my access token?
The account becomes permanently unreachable and the servers under it run until the paid term expires, then terminate. We cannot recover it because we store only an Argon2id hash. Write the token down at checkout — that warning appears three times during the flow for this reason.
03 Is no-KYC hosting legal?
Yes. Hosting providers are not regulated financial institutions and no jurisdiction we operate in requires customer identity verification for server rental. Our acceptable-use policy still applies and still prohibits illegal content — no-KYC removes the identity layer, not the law.
04 Can you be compelled to reveal who I am?
A valid order can compel us to disclose what we hold. What we hold is a token hash, a USD balance, a list of server IDs and a creation timestamp. There is no name, email or payment identity in the record because those columns do not exist in the schema.
Related