18 terms you will meet while shopping for offshore, no-KYC or so-called bulletproof hosting — defined the way an operator uses them, not the way a sales page does. Each entry links to the page where the concept is put to work.
Offshore hosting comes with a vocabulary that providers tend to use loosely. This glossary pins the terms down as we use them across ServPrivacy — jurisdiction and legal-process language, payment privacy, and the hardware in our racks. Definitions are written for operators, not lawyers: short, specific, and honest about limits. Where a term touches our own policy, we state exactly what we do.
01
Bulletproof hosting
Slang for providers that advertise total immunity: no abuse desk, no questions, nothing ever taken down. In practice, "bulletproof" operations run on rented or compromised infrastructure, attract the worst traffic on the internet, and end in seizures that take every customer down with them. It is not what we sell. ServPrivacy is no-KYC offshore hosting: we collect no identity and we do not process foreign takedown notices, but we operate real hardware in real datacenters under real law, and our acceptable-use policy is enforced — spam, CSAM and malware C2 get removed. Treat "bulletproof" in a provider's marketing as a red flag, not a feature: it signals a host with a short life expectancy.
02
Cold wallet
A cryptocurrency wallet whose private keys never touch an internet-connected machine — a hardware device, an air-gapped computer, or keys on paper. The opposite is a hot wallet, which lives on a networked device and is one exploit away from empty. Sound practice for funding servers: keep the bulk of your coins cold, move only what you plan to spend into a hot wallet, and pay from there. ServPrivacy never asks you to connect a wallet, sign a message, or prove ownership of an address — a balance top-up is a plain on-chain payment to a single-use deposit address, between $30.00 and $5,000.00 per invoice.
03
Data retention
A statutory obligation on providers to store connection metadata — who connected to what, when, from which IP — for a fixed period, available to authorities on request. The EU's blanket Data Retention Directive was struck down in 2014, but national retention laws survive across Europe in varying shapes. The practical lesson: a provider's privacy promise is bounded by the statute books of the country the server sits in, so pick the country first. Panama has no mandatory data-retention law at all, which is why it remains the classic offshore pick. Our own practice everywhere: nginx logs rotate out after 14 days, and we hold no identity to retain in the first place.
A physical machine leased whole to a single customer — no hypervisor, no neighbors, no shared kernel. You get the actual hardware: a Ryzen or EPYC socket, DDR5 ECC memory, NVMe drives in RAID, and the full network port to yourself. Choose dedicated over a VPS when you need sustained all-core CPU, predictable disk latency under load, very large memory, or a threat model that excludes any host-level introspection of your RAM. ServPrivacy dedicated servers start at $66.00/mo, are handed over in 2–12 h, and are paid from a prepaid crypto balance like everything else here.
The Digital Millennium Copyright Act, a United States copyright statute from 1998. Its section 512 created the notice-and-takedown system: US hosts process removal notices in exchange for immunity from their customers' infringement. The point that matters here: the DMCA binds US companies and US infrastructure. It is not international law. ServPrivacy does not process or answer DMCA notices — the statute has no force in our jurisdictions. We act only on binding orders issued by a court with jurisdiction over the specific server, which is what local law actually requires of us. Anyone with a complaint is free to pursue that route; a template email to an abuse desk is not legal process.
Hosting marketed as not acting on DMCA notices. The accurate version of the claim: the provider's servers sit in countries where the DMCA — a US statute — simply does not apply, so there is nothing to "honor" in the first place. It does not mean lawless: courts in the server's own country can still issue binding orders, and a provider that pretends otherwise is lying to you. Our posture, stated plainly: notices are not processed or answered; we act only on orders from a court with jurisdiction over the specific machine; and our own AUP still applies. Romania, our flagship region, is the textbook example — EU due process only, nothing automated.
Error-correcting code memory: RAM with extra bits that let the controller detect and fix single-bit errors on the fly, and catch double-bit errors before they propagate. On a server running for months, bit flips from marginal cells or stray radiation are a statistical certainty, and without ECC they corrupt page caches, filesystem metadata and databases silently — the failures you only discover weeks later. It is the cheapest reliability upgrade in the rack, which is why server platforms support it and consumer desktops mostly don't. Every ServPrivacy plan — VPS and dedicated — runs on DDR5 ECC.
08
IPMI / KVM-over-IP
Out-of-band management for physical servers: a small independent controller (the BMC) with its own network path gives you console video, keyboard input, virtual ISO mounting and power control even when the operating system is down or not yet installed. KVM-over-IP is the screen-and-keyboard part of that. For privacy-focused operators it is the feature that matters most on a dedicated server: it lets you boot your own installer and set up full-disk encryption from scratch instead of trusting a provider-supplied image. Treat the BMC as attack surface in its own right — it should never face the public internet unfiltered.
09
KYC
Know Your Customer: identity-verification obligations that originate in banking and anti-money-laundering law — passports, proof of address, selfies holding documents. Exchanges and payment processors are legally bound by it; hosting providers, in most jurisdictions, are not. When a host demands ID, that is a business choice driven by chargeback risk on card payments, not a statute. Remove the card and the rationale disappears: ServPrivacy accepts only cryptocurrency, so there is no chargeback exposure and nothing that requires your name. An account here is a handle, a password and recovery codes — see the no-KYC policy for exactly what we hold.
10
MLAT
Mutual Legal Assistance Treaty — the formal channel through which authorities in one country request evidence held in another. Requests travel government-to-government, are reviewed by the receiving country's own justice ministry and courts, typically take months to years, and can be refused where the alleged offense is not a crime locally. For offshore hosting this is the legal route that actually applies: a foreign authority cannot subpoena a server in another jurisdiction directly. Two things bound what an MLAT request can ever produce — the receiving court's willingness, and what the provider holds at all. We keep no identity records, so the second bound is low. Panama additionally has no MLAT fast lane.
11
Monero (XMR)
A cryptocurrency engineered for privacy at the protocol level: ring signatures hide the sender among decoys, stealth addresses hide the receiver, and RingCT hides the amount. Where Bitcoin's ledger is fully transparent and routinely traced by chain-analysis firms, Monero's is opaque by default — there is no transparent mode to leak into and no "privacy feature" to forget to enable. That makes XMR the natural payment for no-KYC infrastructure, and it is first-class here: one of 21 coins and network variants (17 distinct currencies) accepted for balance top-ups, listed first at checkout, never surcharged.
Hosting you can buy without proving who you are: no name, no ID scan, no address, no phone number, no card. At ServPrivacy an account is a handle, a password and recovery codes; payment is cryptocurrency credited to a prepaid balance; servers start at $8.00/mo. The distinction worth keeping sharp: no-KYC is not bulletproof hosting. We don't know who you are, but the acceptable-use policy still binds what you run — spam, CSAM and malware C2 get removed regardless of how anonymously they were paid for. Privacy from us and from third parties; not immunity from your own conduct.
Non-Volatile Memory Express — the storage protocol built for flash, talking to drives directly over PCIe lanes instead of through SATA controller designs inherited from spinning disks. The practical difference on a server: an order of magnitude more IOPS, sub-100-microsecond latency, and tens of thousands of parallel command queues where SATA has one. Databases, mail queues and busy sites feel it immediately, especially under concurrent load. There are no spinning disks or SATA SSDs anywhere in the ServPrivacy fleet: VPS storage is NVMe in RAID-1, and dedicated servers run NVMe in soft-RAID or RAID-10.
14
Offshore hosting
Hosting your infrastructure in a jurisdiction other than your own, chosen deliberately for its legal properties: data-protection statutes, retention rules, court procedure, and distance from your local subpoena process. Nothing about it is inherently shady — corporations call the same move jurisdictional arbitrage. What to actually evaluate: which country's courts hold power over the physical machine, what the provider logs, and how legal assistance between states (MLAT) works in practice. ServPrivacy operates 6 regions selected on exactly those criteria — Romania, the Netherlands, Switzerland, Iceland, Malaysia and Panama — with the trade-offs of each documented honestly on its location page.
Redundant Array of Independent Disks: combining drives so the array survives hardware failure. RAID-1 mirrors two drives — either can die with zero data loss; RAID-10 stripes across mirrored pairs for the same safety plus more speed and capacity. What RAID is for: staying online through a disk failure. What it is not: a backup — an accidental rm, ransomware, or filesystem corruption replicates to every member instantly. Our fleet runs NVMe RAID-1 under every VPS and soft-RAID or RAID-10 in dedicated servers; for actual backups, VPS plans offer a daily encrypted backup add-on.
16
Reverse DNS (rDNS/PTR)
The PTR record that maps an IP address back to a hostname — the mirror image of a normal A record. It matters more than it looks: most mail servers refuse or junk mail from IPs whose rDNS is missing or contradicts the HELO name, so anyone self-hosting email needs forward-confirmed rDNS — PTR and A record agreeing — before sending a single message. It also names your server in other people's logs, so set it thoughtfully. Every ServPrivacy server ships with a dedicated IPv4 and a /64 IPv6 block, with rDNS included on every plan.
17
Virtual private server (VPS)
A virtual machine carved from a physical host — at ServPrivacy, KVM full virtualization, so you run your own kernel with dedicated vCPU, RAM and NVMe rather than a container sharing the host's kernel. For most workloads it is the right ratio of price to isolation: plans start at $8.00/mo and come online in about 15 min. One honest threat-model note: any hypervisor can technically introspect guest memory, so if your model excludes even that, the answer is a dedicated server. For everything else, full-disk encryption on a VPS plus a provider that retains almost nothing covers the realistic cases.
A statement a provider republishes on a schedule — "as of this date we have received no secret legal demands" — so that its silent removal can signal a gagged request without speaking. A clever construct with real limits: its legal standing is untested, a missed update triggers false alarms, and it tells you nothing about which user is affected. ServPrivacy does not publish one, and we would rather say so than perform it — a canary still asks you to trust the publisher every day. We put the effort into structure instead: no identity collected, 14-day log rotation, and a fleet spread across 6 jurisdictions chosen for due-process requirements, so there is little a gagged demand could take.
Vocabulary done — deploy something
VPS from $8.00/mo in 6 offshore regions, paid in crypto from a prepaid balance.
