What a VPN server seizure actually yields.
State of things on 17 October 2026: Pevnost is in private beta. Accounts can be created and paid by bank transfer; Bitcoin and Lightning follow once our BTCPay wallet is connected, Monero and cash by post later. The first server is being installed and is not live yet.
"No logs" is a claim about software. A seizure is a test of hardware. Here is what someone gets if they walk into the data centre with a court order, or without one, and take our server. We wrote our threat model before we wrote the marketing, so this is the threat model.
What is on the disk
Our VPN nodes are rented servers that happen to have disks. We use the disk for one thing: a public, published boot image. The disk holds a bootloader, a kernel, and a compressed filesystem image whose hash is published. The image contains no secrets: no WireGuard private keys, no account data, no customer keys, nothing that is not already on this website or in our public repository. The node boots that image entirely into memory (toram) and never writes to the disk again. Logs go to a volatile journal in RAM; our DNS resolver logs nothing; WireGuard itself keeps no history.
So the disk yields: our software. Compare its hash with the published one and you have verified our build, which is what we want you to do anyway.
What is in memory while it runs
Everything that makes the node work: the server's WireGuard private key, the list of customer public keys with their tunnel addresses, and the live WireGuard state. That state includes, for each connected device, the current endpoint IP and the time of the last handshake. We say this plainly in the privacy policy: while you are connected, the server holds your address in memory, because it must send packets back to you. It is never written anywhere, and it is gone a few minutes after you disconnect and the moment the power goes.
What survives power‑off
Nothing. The node receives its keys from our control server only after we approve it, and the approval must be repeated after every single boot. Pull the plug, take the machine, boot it elsewhere: it comes up with the public image, asks our control server for approval with a fresh, temporary management key, and waits. An unexpected approval request is an incident, not a restart; we do not approve it, and the node never receives a key. Without a key it is a box running a resolver for nobody.
What does not help
Honesty is part of the product, so here is the other column.
- Cold boot attacks. RAM keeps its contents for seconds after power loss, longer when cooled. A prepared attacker who seizes a running machine and freezes the memory could in principle read the live state described above. Our rented hardware has no memory encryption; our own hardware, planned for the next phase, will use AMD SME/TSME or equivalent so that memory is encrypted with a key that dies with the power. Until then the honest statement is: a running server, seized by someone who knows what they are doing, could reveal who was connected at that moment. Not history. The moment.
- The uplink. No VPN protects against a tap on the cable between the data centre and the internet. An observer there sees encrypted WireGuard traffic between customer addresses and our server, and plaintext traffic between our server and the sites customers visit. Correlating the two by timing and volume is possible for an adversary who sees both ends. We do not claim to defeat that.
- The hosting provider. Our providers, like every carrier, can monitor and sample network flows to and from their machines. That means records of which IP addresses talked to our server and when may exist at the provider, under the provider's retention duties, outside our control. It does not include what happened inside the tunnel. We say this in the privacy policy because it is true for every VPN and most do not say it.
- Remote management. Rented servers come with a management controller (iLO, IPMI) in the provider's hands. It can reboot the machine and attach media. It cannot read the memory of a running Linux system, but it can force the reboot that triggers our manual approval, which is the protection.
What a court order to us returns
A production order gets the list from the privacy policy: a random account ID, an expiry date, device public keys (random 32‑byte values generated on the customer's device), a payment record (with the payer's name where the method shows one), aggregate node load. No activity, no addresses, no times. A preservation order under § 7b of the Code of Criminal Procedure can freeze that same list for 90 days. We count every request in the transparency report and the warrant canary covers the orders that come with a gag.
Why we bother
Because "we promise not to look" is weak and "there is nothing to look at" is strong. Every part of the design above exists to move claims from the first category to the second. Where we cannot (the running state, the uplink, the provider's flows), we tell you, and we are working on the parts that hardware can fix.