Signing up for a VPS almost always starts the same way: an email address, a full name, sometimes a phone number, and a billing address that has to match your card. None of that is technically required to run a virtual machine. It exists because payment processors demand it, because marketing teams want a mailing list, and because it has always been done that way.
We took the opposite default. When you register with VMFrost you get a single access token, and that token is the account. No email, no password, no recovery questions.
What a token actually buys you
The practical benefit is that there is no personal data to leak, subpoena, or sell, because we never collected it. A breach of our user table exposes a list of opaque strings and the servers attached to them. That is a meaningfully smaller blast radius than a table of names, emails, and hashed passwords that people reused elsewhere.
The secondary benefit is that there is no password to phish. There is no "reset your password" email for an attacker to intercept, because there is no email and no reset flow. The most common account-takeover path in consumer hosting simply doesn’t exist here.
The tradeoff, stated plainly
This model has a real cost and we would rather you hear it from us than discover it at a bad moment: if you lose your token, your account is gone. Not "gone until you verify your identity". Just gone. We can’t prove you are you, because we never learned anything about you in the first place.
Account recovery and anonymity are the same feature viewed from opposite sides. You can’t have both.
Every provider that offers account recovery does so because it holds identifying information about you. That information is exactly what we are declining to hold. If you want a provider that can restore your access after you lose your credentials, you want a provider that knows who you are. That is a legitimate choice, just not the one we built for.
How to store your token
Treat it the way you would treat an SSH private key or a wallet seed phrase. Concretely:
- Put it in a password manager (Bitwarden, KeePassXC, 1Password) as a secure note, not in a browser autofill field.
- Keep one offline copy. The .txt file we hand you at registration works fine for this, moved onto an encrypted USB drive or written on paper.
- Don’t paste it into chat apps, support tickets, or issue trackers. We will never ask you to send us your token.
- If you share account access with a teammate, understand that you are sharing full control. There are no per-user permissions on a token.
What we do log
Being anonymous isn’t the same as being unlogged. We keep an activity log tied to your token (registrations, logins, server actions, billing events) because we need it to operate the service and to investigate abuse. That log is tied to a token, not a person.
If that distinction matters to your threat model, read the full Privacy Policy rather than relying on this summary.