Warrant canary

A signed statement about the legal orders Void Vector VPN has (or has not) received. If it stops updating, or if the signature stops verifying, treat that as a signal. See the disclosure policy for the reporting channel and the signing key.

Signed on: 2026-08-10 (UTC)
Expires at: 2026-09-09 (UTC)
Freshness anchor: No warrants or other requests have been received by Void Vector VPN
Signing key: /security/pgp.asc · verify with gpg --verify
Raw file: /canary.asc (serving the placeholder canary embedded in the binary; deploy a real one via scripts/canary/sign-canary.sh)

Signed canary

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Void Vector VPN warrant canary

Signed-On: 2026-08-10
Expires-At: 2026-09-09
News-Headline: No warrants or other requests have been received by Void Vector VPN

As of the Signed-On date above, and to the best of my knowledge:

  1. Void Vector VPN has not received any national security letter,
     gag order, warrant, subpoena, or similar legal instrument from
     any government or agency requiring us to compromise our users'
     privacy, hand over user data, deploy backdoors, or knowingly
     ship code we believe undermines the service's security posture.

  2. Void Vector VPN has not been the target of a warrant issued
     under a statutory secrecy order that would prevent us from
     acknowledging it here.

  3. No employee, contractor, or operator of Void Vector VPN has
     been served with any such order in their capacity as a member
     of the project.

  4. This canary is signed with a key whose fingerprint is
     published at https://portal.wrewtopia.com/security/pgp.asc .
     If the signature on this document does not verify, or if this
     canary lapses without a follow-up notice, treat that as a
     signal to raise the alarm, not as confirmation of any
     particular event.

  5. This canary is a human commitment, not a legal instrument.
     Its purpose is to make it obvious when we STOP publishing it.

Freshness anchor (a news headline current as of Signed-On, embedded
so this document cannot be pre-signed):

  No warrants or other requests have been received by Void Vector VPN

Rotation cadence: the canary is refreshed at least every 30 days.
If the current canary is within 7 days of Expires-At, the /canary
page raises a rotation warning. If it is past Expires-At, the page
raises a red alert.

  -- Void Vector VPN operations
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQNTYzdszGzuwIxa6lCsJhsKnktGgUCanoZrAAKCRBCsJhsKnkt
GvVVAQDWBympvH1/v/cSrHXGwqQzXBnINsWZB1QgSoNTOeWElAEAknTCdOhNrslE
Ic/CPVVL1Lc+y+aTN1VvO0zs53Pf2QM=
=OKtq
-----END PGP SIGNATURE-----

How to verify

curl -sSf https://portal.wrewtopia.com/security/pgp.asc | gpg --import
curl -sSf https://portal.wrewtopia.com/canary.asc | gpg --verify

A successful verification against the expected key fingerprint is necessary but not sufficient: also check that the Signed-On date is recent (rotation cadence is at least every 30 days), and that the News-Headline anchor is a real event from around Signed-On (this makes it hard to pre-sign a canary for a future date).

What this canary is not

A warrant canary is a human commitment, not a legal instrument. Its value is that its absence is a signal: a jurisdiction that gags us cannot legally compel us to continue signing new statements, but it also cannot legally compel us to publish false ones. Read that as: trust this canary only in the negative sense, and do not treat its presence as a certification that we are threat-free.