Guide · Privacy
What any dedicated-server host can reach, what Ironatoll keeps, what changes without a remote console, and how to lock your data with LUKS, SSH keys and your own backups.
Quick answer
Can my hosting provider see the data on my dedicated server?
Yes, your hosting provider can see the data on your dedicated server if it is not encrypted, because it holds the hardware: disks, network port and power. Encrypted disks stay unreadable while locked, and a host can only hand over the logs it keeps. Ironatoll keeps no logs and includes no remote console. Dedicated servers from $63.68 per 30 days. No KYC, paid in crypto.
| Part of the server | What any host can reach | What protects you |
|---|---|---|
| Disks, server off | Every byte: a disk can be pulled, copied or read from another system | LUKS full-disk encryption |
| Disks, server running | Unlocked data, for anyone with root or the running hardware | Root kept to your own key; encryption alone does not help |
| Memory (RAM) | Keys and data in memory, with physical access to the running machine | No full protection: this is the limit of renting hardware |
| Network traffic | Every packet crossing the datacenter switch: addresses, ports, timing, volume | SSH, TLS and WireGuard keep the content encrypted |
| Console and boot | Screen and boot control through IPMI or KVM over IP, where fitted | LUKS unlocked over SSH; Ironatoll includes no remote console |
| Logs | Whatever the host chooses to record | Ironatoll: no connection, traffic or IP logs |
Yes, if the disks are not encrypted. The host owns the hardware. Staff with access to the rack can pull a disk, copy it or start the machine from another system. No software setting stops a person standing at the server.
On a rented dedicated server, physical access beats every password; only encryption keeps a disk unreadable in someone else's hands.
At Ironatoll, a person prepares the machine before you get it: A person on our team gets your server ready once your payment is confirmed, usually a few minutes later and never more than one hour after the confirmation; your dashboard shows the status, then the IP address once the server is ready.
It can see where your traffic goes, and its content when it is not encrypted. Every packet crosses the datacenter's switch, and the network owner can copy a port's traffic to a monitor. That shows source and destination addresses, ports, timing and volume.
Encryption cuts this down to metadata. SSH, HTTPS and WireGuard keep the content private on the wire. Ironatoll does not run that network: the datacenter operates its own switches and routers, under its own country's law.
Only what running your server and billing need. The full list, as Ironatoll publishes it:
No logs: connection logs, traffic logs and the IP addresses of visitors and customers are never recorded, and the only trace of how you found us is a referral code, when the link you clicked had one. We keep only what running your server and billing need: your account number and optional email, your orders and top-ups (amount, coin, network, transaction ID, date), and each server’s name, plan, term, location, system, SSH public key, IP addresses and dates, plus, for a server ordered without a key, the temporary root password we set, which stops opening the server once you change it. What the datacenter’s own routers and switches record is beyond our control. Records leave our hands only under an order from a Panamanian court.
A host that checks ID ties each of those records to a name. According to Ironatoll's check of 30 October 2026, 3 of 34 active dedicated-server hosts always ask for ID at signup, and 16 ask in some cases. Ironatoll asks for none: No KYC: no ID, selfie, documents, card or phone number are ever collected. More on can I rent a dedicated server without KYC or ID verification.
Root is yours alone, and the team acts on the requests you make in your dashboard. Root access over SSH: add your own public key at checkout and password login stays off, or leave it empty and get a temporary root password with your server, to change at first login. Reboot, reinstall and cancel are requested from your dashboard and carried out by the team; a reinstall erases the disks. After delivery, check that /root/.ssh/authorized_keys holds only the keys you expect.
No remote console (IPMI or KVM over IP) is included: reboots and reinstalls are requested from your dashboard and done by the team. For you, that means no boot screen to watch and no prompt to type at. A system that stops at boot to ask for a passphrase cannot be answered from a console. Plan disk encryption around SSH, as below.
What a console does, and who can reach it, is explained on what is IPMI (KVM over IP) on a dedicated server.
Six steps, in the order most people take them on a rented Linux server.
Encrypt your data with LUKS
LUKS is the standard disk encryption on Linux, managed with cryptsetup. A locked LUKS volume is unreadable without your passphrase or key file, even with the disk in hand.
Start with an encrypted data volume
The simplest setup keeps the system disk plain and puts your data on a LUKS volume. After each reboot, you log in over SSH and unlock it with cryptsetup open.
Or unlock an encrypted root over SSH
Debian's cryptsetup notes describe a small Dropbear SSH server inside the initramfs, for headless machines. You connect early in boot and run cryptroot-unlock. Test it well: without a console, a failed unlock means a reinstall, which erases the disks.
Use SSH keys only
Root access over SSH: add your own public key at checkout and password login stays off, or leave it empty and get a temporary root password with your server, to change at first login. Keep the private key on your own computer, protected by a passphrase.
Encrypt everything on the wire
Use SSH for administration, TLS for websites and WireGuard for your own VPN. The switch then sees addresses and volumes, not content. See should I use a dedicated server for my own VPN.
Keep your own backups
There are no automatic backups, so every file you need to keep should also live somewhere you control. The cryptsetup FAQ calls a full backup mandatory, because encrypted disks die like any others. Back up the LUKS header too; Debian's notes warn that an old header copy can bring back a revoked passphrase.
It does not protect a running, unlocked server. Once a LUKS volume is open, its key lives in memory. The cryptsetup FAQ even explains how to read the volume key of an open LUKS1 container back from the running system.
The boot chain is exposed too. The same FAQ says an initrd is about as vulnerable to a competent attacker as an unencrypted root. Whoever holds the hardware can alter it to catch your passphrase.
Encryption protects a dedicated server that is off or locked; it cannot fully protect one running on hardware someone else controls.
No. No logs means nothing is recorded; your traffic still crosses hardware that the host or the datacenter runs. What a no-log host gives you is less to hand over, since an order can only reach records that exist.
At Ironatoll, records are handed over only on an order of a Panamanian court. Traces outside the host, from the blockchain to your home IP, are on what still links a no-KYC server to its owner.
A dedicated server at Ironatoll costs from $63.68 per 30 days for Intel Xeon E-2236 (6 cores / 12 threads), 16 GB RAM, 2 × 480 GB SSD in RAID 1, 30 TB a month at 1 Gbit/s, 1 IPv4 and an IPv6 /64. Every plan is on how much does an Ironatoll dedicated server cost.
6 cores · 16 GB RAM
$63.68
3 months $171.93 (−10%)6 months $305.66 (−20%)1 year $534.91 (−30%)
6 cores · 32 GB RAM
$72.15
3 months $194.80 (−10%)6 months $346.32 (−20%)1 year $606.06 (−30%)
Best value
8 cores · 64 GB RAM
$72.62
3 months $196.07 (−10%)6 months $348.57 (−20%)1 year $610 (−30%)
In every plan: Whole machine · Root access · RAID 1 on two disks · Dedicated IPv4 · No logs · No KYC
Physically, yes: it holds the hardware and can reach unencrypted disks. At Ironatoll, reboots and reinstalls are requested from your dashboard and carried out by the team.
It sees how much traffic your server sends, because the network measures it. Ironatoll counts outgoing traffic per 30-day period for the plan quota and keeps no traffic logs.
It stops anyone from reading the disks while they are locked, including a disk pulled from the machine. It does not protect a running, unlocked system.
No. No logs: we keep no connection logs, no traffic logs and no IP addresses of visitors or customers, on the website, the dashboard or the servers. Logs that your own system writes, such as the SSH daemon's, stay on your server and under your control.
Remove any SSH key you did not add, disable password logins and encrypt your data with LUKS. Physical access stays with whoever holds the hardware, but locked disks are useless to them.
Yes, over SSH. On Debian, dropbear-initramfs starts a small SSH server before the root disk is unlocked, and cryptroot-unlock opens it.
Rent a dedicated server from a host that keeps little
No logs, root by your own SSH key or a temporary password you change, from $63.68 per 30 days. No KYC: no ID, no selfie, no documents. Paid in crypto.
From $63.68/30 days · no KYC
Get a dedicated server