# Encrypted VPS: Full-Disk Encryption on a Root Server | NulNet > LUKS guards data at rest; a running VPS still holds keys in RAM. Where the protection stops, and the container pattern that works on KVM. No ID at signup. Source: https://nulnet.com/guides/encrypted-vps-full-disk-encryption/ [Home](https://nulnet.com/) / [Guides](https://nulnet.com/guides/) / Encrypted VPS: Full-Disk Encryption on a Root Server How-to # Encrypted VPS: Full-Disk Encryption on a Root Server ![NulNet light KVM: racks and data flows into a black-hole void](https://nulnet.com/img/theme-vps.png) LUKS guards data at rest; a running VPS still holds keys in RAM. Where the protection stops, and the container pattern that works on KVM. Published 2026-08-30 · Updated 2026-09-08 · NulNet Editorial **Short answer** LUKS guards data at rest; a running VPS still holds keys in RAM. Where the protection stops, and the container pattern that works on KVM. NulNet: VPS from $3/mo and dedicated from $30.80/mo annual. The map spans twenty-one locations — Reykjavik (Iceland) and Zurich (Switzerland) among them, plus Singapore, Dubai, Cape Town and fourteen others. Signup is email plus a 12-character password, or token-only. No KYC. Checkout is crypto-only across BTC, XMR, ETH, BNB, SOL, LTC, TRX, XRP, DOGE, DASH, ADA, GRAM (TON), and USDT (TRC-20/ERC-20/BEP-20/SPL). No payload or guest traffic logs; connection metadata ≤24h. DDoS included. One SKN company, one crypto checkout. Deploy at https://nulnet.com/deploy/. ## What FDE buys you Full-disk encryption with LUKS protects the states you are not watching: a disk pulled from a decommissioned host, a snapshot parked in cold storage, a rescue mount performed without you. In those states the data is ciphertext and useless without your passphrase. On a running machine the picture changes — the kernel keeps the keys in memory and the volume is plaintext to root. So the honest boundary is: the running host's administrator is out of scope, and nearly everything else is in scope. VPS from $3* (fund $50+), storage 1–5 TB NVMe from $24/mo annual-eff, dedicated with IPMI from $30.80/mo. Crypto invoice, no KYC. [Launch now](https://nulnet.com/deploy/?kind=vps&plan=business/) ## The VPS caveat, stated honestly A KVM VPS receives its decryption key over the wire at boot, which means the platform side of the boot is a place your key exists. Two patterns work around that in a no-KYC context. Pattern one, the common middle ground: keep only encrypted volumes inside the machine — LUKS on a loop file or on a secondary disk — and open them over SSH after each boot with a key only you hold. A reboot then waits for you, and nobody mounts your data by casually attaching the disk. Pattern two is metal: on a dedicated server you control the boot chain end to end and can carry the key in an initrd you own, with IPMI as the console of last resort. ## Setup path (LUKS container pattern) - Provision a plain VPS, then `cryptsetup luksFormat` a volume or a loop file sized for the sensitive set. - Open it with your passphrase, build the filesystem inside, and move the data in — keys, mail spools, databases, configuration secrets. - Wire a `keyscript` or systemd unit so reboots wait for input, or open it manually over SSH each time. - Back up the LUKS header to a place you control and test that restore; a header lost without backup means a volume lost with it. Does NulNet encrypt my disks for me? No — root means the keys are yours end to end, and that is the only design worth having here. You configure LUKS inside your own OS; we hold no copy, offer no escrow, and cannot reset a passphrase we never saw. Can you help if I lose my LUKS passphrase? Not past the limit of physics and math: without the passphrase or a header backup, the volume is gone. That is the property you bought. Keep the header and the passphrase backed up somewhere that is not the same disk. Is FDE possible on the Storage plans? Yes — storage boxes are the same root KVM with bigger disks, from 1 TB NVMe at $30 list ($24 on the annual term) upward. For cold archives, a LUKS container opened only while you are actively writing is the usual pattern. Which tier suits encryption best? A VPS handles the container pattern for most sets; when the boot chain itself must hold no third party, that is the dedicated argument — own the initrd, keep IPMI for emergencies. The dedicated storage server pages map disk classes to tiers. ## Related guides - [Minimum-data no-KYC checkout](https://nulnet.com/guides/anonymous-vps-crypto-no-kyc/) - [Buy a VPS with crypto](https://nulnet.com/buy-vps-with-crypto/) - [No-KYC VPS: requirements and limits](https://nulnet.com/no-kyc-vps/) - [Pay with Monero](https://nulnet.com/monero-vps/) - [Offshore VPS](https://nulnet.com/offshore-vps/) - [VPS vs dedicated bare-metal](https://nulnet.com/guides/vps-vs-dedicated/) - [Best no-KYC VPS 2026](https://nulnet.com/best-no-kyc-vps-2026/) - [FAQ: crypto VPS](https://nulnet.com/guides/faq-crypto-vps/) ## Checkout facts - **Price** VPS from $3/mo. Dedicated from $30.80/mo. - **Identity** No KYC. Token-only (no email) or email plus a 12-character password. No passport, phone, or card. - **Payment** Sixteen ways to settle, none of them a card: XMR and BTC lead, ETH, SOL, LTC, BNB and TRX follow, then XRP, DOGE, DASH and ADA, GRAM (TON) for Telegram-adjacent rails, and USDT on four networks — TRC-20, ERC-20, BEP-20, SPL. Live-rate invoice. - **Logs** No payload / no guest traffic logs. Billing and panel actions retained. Connection metadata ≤24h. - **Platform** KVM on ECC and local NVMe. DDoS filtering included. Facilities in 21 cities across four continents — the locations table lists each one's tier, uplink and governing law. Need Iceland or Switzerland plus no KYC? Those two carry a published premium (+20% / +35%); every other flag stays at base list. Pay BTC, USDT, XMR, BNB, XRP, GRAM (TON) or 10 more. Open deploy to pick a plan. ## Ready to launch? Build the box — VPS, storage or bare metal — create the password, pay the invoice that follows. [Launch now](https://nulnet.com/deploy/?kind=vps&plan=business/)[Dedicated](https://nulnet.com/dedicated/)