cryptoservers.io

Warrant Canary

A weekly PGP-signed statement confirming what we have not been compelled to do. Re-signed automatically every Monday with the published key. If it goes stale without a corresponding incident post-mortem, assume something material has changed.

Canary is fresh. Signed 3 days ago · next signing in 3d day3s · stale threshold in sd days.
Signed 2026-04-20 Week W17-2026 Key 0xA62AEDAF647EE3E6
Cryptoservers warrant canary seal

Current signed statement

Verbatim, PGP-clearsigned with the published Cryptoservers key. The signature is computed over the exact bytes you see below — copy & gpg --verify it yourself.

Signed 2026-04-20 · Week W17-2026 · Key 0xA62AEDAF647EE3E6
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Cryptoservers Ltd — Warrant Canary
Week  : W17-2026
Signed: 2026-04-20 (Monday)
Period: 2026-04-13 through 2026-04-19 inclusive (UTC)

STATEMENTS

1. Cryptoservers Ltd has NOT received, as of the date of this signing:
   - any National Security Letter from any jurisdiction;
   - any gag order or prior-restraint order from any jurisdiction;
   - any bulk-metadata retention or bulk-surveillance order from any jurisdiction;
   - any order requiring BGP route injection, DNS hijack, or active tampering with
     customer traffic;
   - any request to install surveillance equipment or to provide a backdoor into
     our hypervisor, control panel, billing, or support systems.

2. Cryptoservers Ltd has NOT been compelled to transfer ownership or operational
   control of any Infrastructure to any third party.

3. Cryptoservers Ltd's signing key (the key whose fingerprint appears on the
   published signature below) remains in the sole custody of the original two
   founding engineers, unmodified, and has NOT been replaced, compromised or
   surrendered since its publication on 2026-04-22.

AGGREGATE REPORTING (period 2026-04-13 to 2026-04-19 UTC)

- - DMCA-style take-down notices received .............. 147
- - DMCA-style take-down notices actioned ..............   0    (see /dmca)
- - Court orders received (Saint Kitts and Nevis) ......   0
- - Court orders received (Iceland) ....................   0
- - Court orders received (Netherlands) ................   1
- - Court orders received (Romania) ....................   0
- - Court orders received (Switzerland) ................   0
- - Court orders complied with .........................   1    (narrow scope)
- - Abuse reports received (all categories) ............ 312
- - Abuse reports actioned .............................  28    (see /abuse)

NEXT SIGNING

This canary is renewed every Monday. The next signing is scheduled for
2026-04-27. If no successor signature has appeared by 2026-05-04 (14 days after
this one) and no publicly-announced infrastructure incident explains the delay,
assume something material has changed and act accordingly.

The current public key is fingerprint:
  4DCF 5D6D 10AF F2AA 47E2  070E A62A EDAF 647E E3E6

Archived signed statements are available under /canary/archive/.

- -- Cryptoservers Ltd
   [email protected]
   Charlestown, Saint Kitts and Nevis
-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRNz11tEK/yqkfiBw6mKu2vZH7j5gUCaemx3QAKCRCmKu2vZH7j
5g5EAP468WfyWd0bnmPFdZq0YCDVvUpDUa2cgANJ8AneBTVDmgD+OhdZmbaolYUo
Xe8pqjxWTn6XAO5iJa9LoO7BBy6agg4=
=+4fd
-----END PGP SIGNATURE-----

How to verify

You need GnuPG installed. The whole process takes about ten seconds.

2

Confirm the fingerprint

The key fingerprint MUST be 4DCF 5D6D 10AF F2AA 47E2 070E A62A EDAF 647E E3E6. Cross-check via _openpgpkey.cryptoservers.io DNS and keys.openpgp.org.

3

Download the canary

Save the signed block: curl -o canary.asc https://cryptoservers.io/canary/current.asc

4

Verify the signature

Run gpg --verify canary.asc. Output must include “Good signature” and the fingerprint from step 2. If not — stop and treat the canary as compromised.

Previous signings

Every past canary is downloadable. The current week sits at the top; older weeks populate as the calendar advances.

Signed Week Period covered DMCA rcvd Orders rcvd Gag orders Archive
current 2026-04-20 W17-2026 2026-04-13 / 2026-04-19 121 0 0 .asc
2026-04-13 W16-2026 2026-04-06 / 2026-04-12 182 0 0 not yet
2026-04-06 W15-2026 2026-03-30 / 2026-04-05 114 1 0 not yet
2026-03-30 W14-2026 2026-03-23 / 2026-03-29 153 0 0 not yet
2026-03-23 W13-2026 2026-03-16 / 2026-03-22 124 1 0 not yet
2026-03-16 W12-2026 2026-03-09 / 2026-03-15 136 1 0 not yet
2026-03-09 W11-2026 2026-03-02 / 2026-03-08 140 0 0 not yet
2026-03-02 W10-2026 2026-02-23 / 2026-03-01 188 1 0 not yet
2026-02-23 W09-2026 2026-02-16 / 2026-02-22 129 0 0 not yet
2026-02-16 W08-2026 2026-02-09 / 2026-02-15 129 0 0 not yet
2026-02-09 W07-2026 2026-02-02 / 2026-02-08 129 0 0 not yet
2026-02-02 W06-2026 2026-01-26 / 2026-02-01 127 1 0 not yet

Rows marked “not yet” are future or not-yet-materialised weeks — each becomes a downloadable .asc on the first page load after that Monday.

Why we publish this

A warrant canary is not a cryptographic proof of anything positive — it is a ritual of negative disclosure. In jurisdictions where a legal order can compel a provider not to speak about the order itself, the order cannot compel the provider to continue to publish a signed statement that the order has not occurred. The absence of the expected signature therefore communicates information that the issuing authority cannot lawfully block.

Our canary is renewed every Monday. If the W17-2026 signing is not followed by a 2026-04-27 signing (or a same-week infrastructure-incident post-mortem on /status that explains the delay), the reasonable inference after 2026-05-04 is that Cryptoservers Ltd has received a category of order described above and has been compelled to remain silent about it. You should then migrate away, rotate credentials, and treat our infrastructure as hostile until the canary returns with a fresh post-mortem.

This document is governed by the Terms of Service and the operational policies at /privacy, /abuse, and /dmca. It is not legal advice; it is an operational signal.