Transparency

Warrant canary

A PGP-signed quarterly statement of truth. If this page disappears, fails to update on schedule, or its signature breaks, treat the canary as dead. Don't trust this page; verify it yourself.

Last signed
Next signing due
Signing fingerprint
AAB2 A06A E5F9 187B 9565 4584 C1B0 7D4D F41C B15F
Verify this canary ->

As of 2026-05-12, the ServerCrate team affirms:

01 No legal compulsion.

ServerCrate has never received a National Security Letter, FISA court order, gag order, or any classified request for user data, user metadata, or user identity information.

02 No backdoor.

ServerCrate has never been compelled by any government or law-enforcement agency to:

  1. hand over user encryption keys (we don't have them by design);
  2. modify our software or infrastructure to weaken encryption;
  3. insert a backdoor of any kind into our service;
  4. hand over plaintext customer data (architecturally impossible).

03 No surveillance partners.

ServerCrate has never shared user data with advertising networks, data brokers, third-party analytics services, or any external party for non-operational purposes. All analytics are self-hosted and never leave our infrastructure.

04 True zero-knowledge.

Customer data is encrypted client-side via Restic (AES-256) using a key only the customer holds. ServerCrate operators cannot read customer backups even with full root access to the underlying ZFS storage. This is enforced by the protocol, not by policy.

05 No coercion.

The ServerCrate team has not been replaced, coerced, or compromised in a manner that affects the truth of statements 1 through 4.

Proof this canary wasn't pre-generated

The reference block below pins this signing to after a specific Bitcoin block existed. A canary signed before that block's timestamp would be mathematically impossible to produce.

Bitcoin block height
949033
Bitcoin block hash
000000000000000000009f9dce9f7c9370b441b5aab4188956589d26dc4177dc

Cross-check at mempool.space, blockstream.info, or any Bitcoin node you control.

Verify yourself

Three steps. Two minutes. Anything less is just trust theater.

  1. 1Import our team key

    curl -sL https://servercrate.net/pgp/servercrate-team.asc \
  | gpg --import

    Then confirm the fingerprint matches what's on our PGP page and what's in this canary's status card.

  2. 2Fetch the signed statement

    curl -O https://servercrate.net/warrant-canary/canary.asc

  3. 3Verify the signature

    gpg --verify canary.asc

    You want: Good signature from "ServerCrate Team ...". Anything else, bad signature, expired key, unknown key, treat the canary as dead.

The signed statement

The complete PGP-signed message below is what you verified above. It's reproduced here so you can compare byte-for-byte.

Full PGP-signed message
Open raw

What if the canary dies?

If this page is missing, the signature breaks, the signing date is more than 30 days past the next-due date, or the team key changes without a signed transition statement from the outgoing key, assume ServerCrate has been compromised.

Your backups remain yours regardless. By design:

  • Your repository is plain Restic format on standard SFTP. No proprietary container, no vendor wrapper.
  • Your encryption key is local to your machine; we never had it.
  • Point Restic at rsync.net, BorgBase, your own VPS, or any SFTP server. Same commands, same data.
  • Run restic snapshots against the new repo URL, it works because the format is open.
Read the full security model ->

Signed history

Previous canaries (signed, archived, timestamped):

Each future signing is appended here so anyone can audit the entire chain from the team key's birth.