This page only means something while it keeps changing.
Below is a signed statement of things that have never happened to us, renewed every 30 days. We may one day be legally forbidden from telling you that something has changed — but nobody can force us to keep signing a statement we know to be false. So watch the date, not the words. If this stops being renewed, that silence is the message.
- LunoVPN has never received a National Security Letter, a FISA order, or any similar secret demand.
- LunoVPN has never received a gag order preventing it from disclosing such a demand.
- LunoVPN has never handed over user activity data to any government, agency or third party.
- LunoVPN has never been compelled to modify its systems to enable surveillance.
- No backdoor, interception capability or logging mechanism has been added to our infrastructure.
- LunoVPN retains full control of its infrastructure and signing keys.
REPLACE_WITH_REAL_SIGNATURE_BLOCK — this placeholder must be replaced with a genuine detached signature, or the signature section removed entirely, before this page goes live.
The status above is calculated in your browser from the statement date, so it cannot be faked by leaving a cheerful graphic on the page. If the counter turns amber or red, the statement is overdue — which may be an administrative slip, or may not be.
What to do if this page goes quiet
If the statement above goes past its renewal date, or an individual assertion quietly disappears while the others remain, the responsible assumption is that our circumstances have changed and we may be unable to say so directly. That is the entire mechanism: the canary is designed to be informative by its absence.
Before concluding anything, check an outside archive of this page rather than our copy, because a lapse could genuinely be human error and the archives will show you whether the wording changed or simply stopped. Then act proportionately to your own threat model — for most people that means paying attention, and for a few people it means changing tools.
The statement is signed with our published key. Verifying it confirms the text came from us and has not been altered by anyone in between — including by whoever is hosting this page.
A canary only means something while it is fresh. If the statement has not been renewed within its stated period, treat that as significant rather than as an administrative oversight.
Do not rely on our copy. The Wayback Machine and archive.today hold independent snapshots of this page, so you can compare wording across time without trusting us to show you the truth.
Every past statement stays published below. A canary that quietly loses a sentence is telling you something the company may not legally be able to say aloud.
The numbers, plainly
What we have been asked for, and what we handed over. The second figure can only ever be zero, because activity data is not something we hold — that half is verified by the independent audit rather than by this page.
These figures are placeholders for launch and must be replaced with your real, verified numbers before publishing. A canary containing invented numbers is worse than no canary at all, because it destroys the credibility of the mechanism precisely when someone needs to rely on it.
Want the other half of the picture? Read the 131-control independent audit →
Why a statement about nothing is useful
Some legal demands arrive with an instruction not to discuss them. A company served with one can be forbidden from warning the people it affects, from mentioning it in a transparency report, or in some cases from acknowledging that anything happened at all. From the outside, a provider under a gag order looks identical to a provider that has simply had a quiet year.
The warrant canary is a workaround built on a legal distinction: being prohibited from speaking is not obviously the same as being compelled to lie. So instead of promising to tell you when something happens, we publish a signed statement that it has not happened, and renew it on a schedule. If we can no longer sign that statement truthfully, we stop signing it. Nothing is said, and that is the point.
The honest weaknesses
We would rather set out the limitations ourselves than let someone else present them as a discovery. The legal theory behind canaries is largely untested: there is little case law, it differs between jurisdictions, and a determined authority might argue that ceasing publication is itself a prohibited disclosure. A canary is a weak signal that is better than no signal, and it should be read that way.
There is also the ordinary human failure mode. Companies get busy and forget to renew, which produces a false alarm and erodes trust in the mechanism for everyone. That is why we publish the renewal schedule, calculate the staleness in your browser rather than asserting a status, and keep every previous statement on this page so a lapse is visible instead of ambiguous.
Why a no-logs provider publishes one anyway
It is a reasonable question: if there are no activity logs, what could anyone be compelled to hand over? The answer is that a canary reports on demands, not on data. We could receive a request while holding nothing useful, and still be forbidden from mentioning it. More importantly, a demand could in principle target the future rather than the past — an instruction to start collecting something we do not currently collect. The audit tells you what exists today. The canary is the mechanism for telling you, by going silent, that something about that has changed.
Every version stays published
A canary you cannot compare is a canary you have to trust. Past statements remain here permanently, so anyone can check whether the wording has changed rather than only whether it still exists.
Add one row per renewal, oldest at the bottom, and never remove an old entry. If an assertion is ever dropped from a new statement, leave the previous version visible above it so the change is obvious rather than silent — that visibility is the whole value of the archive.
Canary questions
What is a warrant canary?
What should I do if this page stops being updated?
Are warrant canaries legally reliable?
Why does a no-logs provider need a canary at all?
How often is this statement renewed?
Could you be forced to keep renewing a false canary?
The strongest guarantee is having nothing to give.
No email at signup, no logs to search, and a canary for everything a policy cannot cover.