Law Enforcement FAQ

While this page is specifically geared towards law enforcement, we make it public so our users can have visibility into what data we have and don't have.

What is SporeStack?

SporeStack is a Virtual Private Server host that accepts cryptocurrency for payment. A user will generate a token to fund payments for servers. They pay to add balance to that token, and then with that token they upload an SSH public key which we attach to the server when it's launched. However, we don't actually host the server. They are hosted at Digital Ocean or Vultr under an account that we manage.

What information do you have on your users?

Users are associated by the token and what servers they launch. Our logs don't have IP addresses of our users who connect to the website or API. Unless a user sends us a message telling us that they live at such-and-such an address, with a certain name, and that they're using a given token, we have very little, if any, personal information on them. We know when their token was last used, its balanace, and the amount of deposits over its lifetime.

What activity is logged?

Within a 90 day window, we know when a server was started or stopped (via the API), launched, deleted, rebuilt, etc. We also know what SSH key was used.

Can you associate payments with tokens/servers?

Typically, yes. If you give us the cryptocurrency used, transaction ID, and a subpoena, we can associate that payment with a token, and then show what servers are associated with the token. The servers may be active, deleted, expiring soon, or not for a while. However, this is generally only the case with a 90 day window from the transaction.

Can you provide us an image of a server?

Yes/no. We have no straight forward way to image and upload an image of servers hosted at Vultr or DigitalOcean. Your best option is for us to tell you what servers are hosted on a given token (or a token we find by payment), and then send a search warrant to Digital Ocean (or Vultr) using the provider's ID and IP address of the server, asking for an image.

Now, more recently we have added SporeStack EU -- the process for exporting an image from there has yet to be explored. As for Slow Servers, that is something that we would handle.

If a server has been deleted, we don't have any backup of it. Digital Ocean and Vultr probably doesn't either. Though we can't guarantee that they do not, it seems cost prohibitive to retain disk images of all deleted servers. Doing such does not appear to be standard procedure for any VPS providers that we are aware of.

How long is your log retention?

Logs are retained for 90 days. These logs mostly show timing information about server creation and actions (such as renewal, start, stop, etc). The database also shows when servers were created or deleted, so this information might not be particularly helpful.

What about database retention?

Information about deleted servers are removed from the database after 90 days. This also applies to token messages (a way to get support) and invoices.

If I'm outside of the US, how can I get data from SporeStack?

We don't claim to be legal experts, but from what we understand, you need some kind of MLAT and possibly to work with US law enforcement.

The exception to that is if the server in question is hosted in your jurasdiction. Thus, it seems reasonable for German police to inquire about a server in Frankfurt, or Mexican Police to inquire about a server in Mexico City.

If I have a Bitcoin transaction from 2021, what can you tell me?

Probably not very much. Our database records and logs go back 90 days.

How do I know if a server is hosted on SporeStack?

Most SporeStack servers will have reverse DNS that ends with "hostedonsporestack.com" and forward DNS should match this. So if you see "hostedonsporestack.com" in logs, or do reverse lookups to find this from IPs querying you, you know it was probably a server hosted on SporeStack.

I'm not actually law enforcement. I'm a user and I find this very creepy!

We don't blame you. We exist in the US and have to comply with certain laws. We'd be shutdown probably pretty quickly for non-compliance. Consider reading our Privacy Guide on the main page for tips on how to stay more private while using SporeStack (or possibly any other VPS host).

Contacting us with legal requests

Please email us at "legal" at this domain if you have a legal request.

Law enforcement guides for our upstream providers

• DigitalOcean
• Vultr does not appear to publish this. Start with their AUP page.

Final Notes

For a general "feel" of what we have and don't have, see the website launcher on the front page. You'll see what it takes to pay for a token and launch a server.