What is a warrant canary, and do hosting providers publish one?

How does a warrant canary work?

By staying silent on cue. A provider posts a statement, dated and often signed, saying it has received no legal process it would be barred from revealing. It renews that statement on a fixed schedule.

If an order with a gag arrives, the provider stops renewing. Readers who watch the page notice the missed date. The EFF's 2014 FAQ traces the name to the canaries that miners carried to warn of danger.

A warrant canary tells you about one company's mail, for one past period, and nothing else.

Why would a warrant canary be legal?

Because of a theory, not a statute. In US law, the government can impose silence through a gag order. The EFF argues that compelling a provider to lie is a different matter, and courts rarely uphold compelled speech.

The EFF's FAQ of 10 April 2014 says no court had yet upheld a canary. It adds that no law forbids publishing what a provider has not received.

The gags themselves are real. Under 18 U.S.C. § 2709(c), a communication provider that gets a national security letter may not reveal it, once the FBI certifies certain dangers.

This page describes laws and published commentary; it is not legal advice.

Which laws impose secrecy on hosting providers?

Several, on both sides of the Atlantic. Each gives a reason a canary might exist, and a reason it might not survive.

• United States: 50 U.S.C. § 1874 lets a gagged provider publish counts only in bands: 0–999, 0–499, 0–249, or 0–99 a year. Every band starts at zero, so a band never says "none".
• Budapest Convention on Cybercrime: Article 16(3) makes parties oblige a data custodian to keep a preservation order confidential. Articles 20(3) and 21(3) do the same for real-time collection and interception.
• EU e-Evidence Regulation: Article 13(4) makes the provider keep orders confidential and secret. Article 13(2) lets the authority delay telling the person concerned, or skip it.

How Iceland, Switzerland, Romania and the Netherlands word these secrecy duties at home was not checked for this page.

What can't a warrant canary tell you about a rented server?

Most of what matters. A canary speaks for the company that posts it, and a rented server involves several companies.

• Third parties: an order sent to the datacenter, its network operator or a payment processor never touches the host's canary.
• Physical seizure: police who take a machine at the datacenter, under local law, may never send the host an order to hide.
• Missed updates: an expired canary can mean an order, an error, an illness or a company that closed.
• Records: a canary says nothing about what the host keeps, which is what any order can reach.

The useful question is not whether a host received an order, but what an order could take from it.

Do hosting providers publish warrant canaries?

Some do, but canaries are better known among VPN brands. On 1 November 2026, Google's autocomplete for "warrant canary" suggested VPN brands. For "warrant canary hosting" it suggested no hosting canary at all.

Ravenquay publishes no warrant canary. Do not read that absence as a sign of an order, or as the reverse. It is simply not something Ravenquay offers.

What does Ravenquay publish instead?

The full list of records it keeps, because that defines what any order could reach. No logs: neither connection nor traffic records, no IP address of any visitor or customer, and no trace of how you found the site apart from a referral code if your link had one. We hold only what billing and operating your server need: the account number and an email if you add one; every top-up and order (amount, coin, network, transaction ID, date); and per server its name, plan, term, location, system, SSH public key, IP addresses and dates, as well as the temporary root password we set when you gave no key, which no longer opens the server once you change it. We have no control over the datacenter’s network equipment. We hand over records only when a Panamanian court orders it.

Ravenquay belongs to DomaineGoat LLC, a company incorporated in Panama that answers to Panamanian law alone. The datacenter holding each server operates under the law of its own country. The same list is in the privacy policy. Why the company sits in Panama is on is Panama a good jurisdiction for a hosting company.

What should you check instead of a canary?

What the host collects, logs and answers to. Five questions do more than any canary:

1. What identity data does it take at signup?
2. What does it log about connections and traffic?
3. Which country's law governs the company, and which the datacenter?
4. Can you encrypt your own disks with keys the host never sees?
5. Does it publish a dated list of the records it keeps?

Ravenquay checked 34 dedicated-server hosts on 30 October 2026: 13 required no ID at all, 16 could require it in some cases, and 3 always did.

A longer checklist is on what privacy-focused hosting should include. How seizure works across borders is on can police seize my server in another country. Prices are on how much a Ravenquay unmetered server costs.