Blackbox:
Zero‑knowledge
VPS

Memory is encrypted by the CPU with AMD SEV-SNP, under a key that never leaves the chip. We cannot read it, even from the hypervisor. The disk is LUKS2, with a passphrase only you ever type.

$ dmesg | grep -i "memory encryption"
Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP

On an ordinary encrypted VPS the host can swap the kernel or initramfs that asks for your passphrase, then read it as you type. Here the firmware, kernel, initramfs and command line are part of a measurement the CPU signs: if we change a byte, the number changes, and the verifier refuses before you type anything. It stops us from tampering with what boots.

$ blackbox-verify --host 23.155.44.139
reported measurement  match
verdict               OK

Every ordinary VPS has an agent inside it that the host can talk to: reset the root password, run a command, read a file. A Blackbox has none, and no virtio port for one. The device is absent from the machine, not switched off, so we cannot run anything inside it. That is why there is no "reset password" button.

$ ls /dev/virtio-ports/
ls: cannot access '/dev/virtio-ports/': No such file or directory

Hand the node your own kernel by URL and SHA-256, write your own disk image over the volume, or paste a link to any ISO and boot from it on the next start. On a measured machine the CPU measures your bytes instead of ours; with an ISO, any operating system that runs on a PC runs here.

Every Blackbox gets a dedicated IPv4 and a whole /64 of IPv6 routed to it. Eighteen quintillion addresses that are yours alone, not a single shared one.

2602:f41c:0:149::/64  routed to your VM

Own address space? Announce it from your Blackbox over our network. Own an ASN? Run your own BGP session with us as transit and originate your prefixes yourself. Both are panel buttons, not tickets.

Set the reverse DNS of your IPv4 and IPv6 yourself, from the panel, live within a minute. Mail servers need it; you do not need us for it.

$ dig -x 23.155.44.139 +short
mail.example.com.

Run a Tor relay, a VPN exit or a mail server and reports will come, most of them automated and many of them wrong. A human reads every one and talks to you before anything happens to your machine. No script suspends you because a blocklist said so.