Law Enforcement FAQ

While this page is specifically geared towards law enforcement, we make it public so our users can have visibility into what data we have and don't have.

What is SporeStack?

SporeStack is a Virtual Private Server host that accepts cryptocurrency for payment. A user will generate a token that links payments to servers. They pay to add balance to that token, and then with that token they upload an SSH public key which we attach to the server when it's launched. However, we don't actually host the server. They are hosted at Digital Ocean under an account that we manage.

What information do you have on your users?

Users are associated by the token and what servers they launch. Our logs don't have IP addresses of servers. Though we may be able to tell if they connect to us via "normal" internet or our Tor Hidden Service. Unless a user emails us telling us that they live at such-and-such an address, with a certain name, and that they're using a given token, we have very little, if any, personal information on them.

Can you associate payments with tokens/servers?

Typically, yes. If you give us the cryptocurrency used, transaction ID, and a subpoena, we can associate that payment with a token, and then show what servers are associated with the token. The servers may be active, deleted, expiring soon, or not for a while.

Can you provide us an image of a server?

Yes/no. We have no straight forward way to image and upload an image of that server. Your best option is for us to tell you what servers are hosted on a given token (or a token we find by payment), and then send a search warrant to Digital Ocean using the Droplet ID and IP address of the servers, asking for an image. They have backend access that should make for a cleaner way to do this.

If a server has been deleted, we don't have any backup of it. Digital Ocean probably doesn't either. Though we can't guarantee that they do not, it seems cost prohibitive to retain disk images of all deleted servers.

How long is your log retention?

We are shooting for 90 day log retention. We may have more or less and SporeStack is in flux and under development, so things may change. These logs mostly show timing information about server creation and actions (such as renewal, start, stop, etc).

What about database retention?

Information about deleted servers are removed from the database after 90 days. This also applies to token messages (a way to get support) and unpaid invoices.

If I'm outside of the US, how can I get data from SporeStack?

We don't claim to be legal experts, but from what we understand, you need some kind of MLAT and possibly to work with US law enforcement.

If I have a Bitcoin transaction from 2021, what can you tell me?

Probably not very much. Our database and more readable logging is more in the 2022 Q3 timeframe.

What do your logs look like?

This format is subject to change. But more or less, they look like this as of 2022-11. We have multiple API proxy nodes that have different IP addresses and the most we can tell is if a user connected to our API using api.sporestack.com or our Tor Hidden Service api.spore64i5sofqlfz5gq2ju4msgzojjwifls7rok2cti624zyq3fcelad.onion endpoint, as our clearnet and Tor API proxies are separate. This came from a test token and server that we made, not a customer's. Nonetheless, we've still redacted points that could have privacy implications. The logs you would receive for a valid legal request would not be redacted in this manner.

(REDACTED TIME): INFO: (REDACTED INTERNAL IP):46794 - "GET /token/(REDACTED TOKEN)/servers HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37934 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37934 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):56498 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):56498 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):56506 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):56506 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):50632 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):50632 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):50634 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):50634 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):38882 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):38882 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):38890 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):38890 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):59138 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):59138 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):59154 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):59154 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):59492 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):59492 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):59502 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):59502 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):40552 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):40552 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):40562 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):40562 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):55474 - "GET /token/(REDACTED TOKEN)/balance HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):55474 - "GET /token/(REDACTED TOKEN)/servers HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37238 - "GET /token/(REDACTED TOKEN)/balance HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37244 - "GET /token/(REDACTED TOKEN)/servers HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37256 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO:sporestack_api.routes:Token (REDACTED TOKEN) topped up with btc, txid: (REDACTED BITCOIN TXID), $5
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37256 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37256 - "GET /token/(REDACTED TOKEN)/balance HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37256 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37256 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37256 - "OPTIONS /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37256 - "POST /token/(REDACTED TOKEN)/add HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37256 - "GET /token/(REDACTED TOKEN)/balance HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37256 - "GET /token/(REDACTED TOKEN)/servers HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):45430 - "OPTIONS /server/(REDACTED MACHINE ID)/launch HTTP/1.1" 200 OK
(REDACTED TIME): INFO:sporestack_api.routes:(REDACTED MACHINE ID) launched with SSH key: (REDACTED SSH KEY FINGERPRINT)
(REDACTED TIME): INFO:sporestack_api.routes:(REDACTED MACHINE ID) paid for with token (REDACTED TOKEN)
(REDACTED TIME): INFO:sporestack_api.database:Adding machine_id='(REDACTED MACHINE ID)' id=(REDACTED DROPLET ID) created_at=(REDACTED CREATION EPOCH) expiration=(REDACTED EXPIRATION EPOCH) region='nyc1' token='(REDACTED TOKEN)' ipv4='' ipv6='' deleted=False provider='Digital Ocean' running=True deny_smtp=True ssh_key_fingerprint='(REDACTED SSH KEY FINGERPRINT)' flavor='vps-1vcpu-512mb-10gb' operating_system='centos-7' hostname='delme' autorenew=False to database.
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):45430 - "POST /server/(REDACTED MACHINE ID)/launch HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):41674 - "OPTIONS /server/(REDACTED MACHINE ID)/launch HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):41674 - "POST /server/(REDACTED MACHINE ID)/launch HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37470 - "OPTIONS /server/(REDACTED MACHINE ID)/launch HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37470 - "POST /server/(REDACTED MACHINE ID)/launch HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37474 - "OPTIONS /server/(REDACTED MACHINE ID)/launch HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):37474 - "POST /server/(REDACTED MACHINE ID)/launch HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):38366 - "OPTIONS /server/(REDACTED MACHINE ID)/launch HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):38366 - "POST /server/(REDACTED MACHINE ID)/launch HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):38378 - "OPTIONS /server/(REDACTED MACHINE ID)/launch HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):38378 - "POST /server/(REDACTED MACHINE ID)/launch HTTP/1.1" 200 OK
(REDACTED TIME): INFO:sporestack_api.database:(REDACTED MACHINE ID) being updated with IP address: (REDACTED IPv4 ADDRESS OF SERVER) (REDACTED IPv6 ADDRESS OF SERVER)
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):38378 - "GET /token/(REDACTED TOKEN)/servers HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):59804 - "GET /token/(REDACTED TOKEN)/balance HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):59808 - "GET /token/(REDACTED TOKEN)/servers HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):34326 - "GET /token/(REDACTED TOKEN)/balance HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):34326 - "GET /token/(REDACTED TOKEN)/servers HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):34340 - "GET /token/(REDACTED TOKEN)/servers HTTP/1.1" 200 OK
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):53830 - "GET /token/(REDACTED TOKEN)/servers HTTP/1.1" 200 OK
(REDACTED TIME): INFO:sporestack_api.routes:(REDACTED MACHINE ID) deleted with 0 days remaining
(REDACTED TIME): INFO:sporestack_api.routes:Returned $0.24 to (REDACTED TOKEN) for (REDACTED MACHINE ID)
(REDACTED TIME): INFO: (REDACTED INTERNAL IP):53830 - "POST /server/(REDACTED MACHINE ID)/destroy HTTP/1.1" 200 OK

I'm not actually law enforcement. I'm a user and I find this very creepy!

We don't blame you. We exist in the US and have to comply with certain laws. We'd be shutdown probably pretty quickly for non-compliance. Consider reading our Privacy Guide on the main page for tips on how to stay more private while using SporeStack (or possibly any other VPS host).

Contacting us with legal requests

Please email us at "legal" at this domain if you have a legal request.

Final Notes

For a general "feel" of what we have and don't have, see the website launcher on the front page. You'll see what it takes to pay for a token and launch a server.