{
  "generated": "2026-08-14",
  "canonical": "https://onionvps.com/data/glossary.json",
  "count": 68,
  "categories": [
    {
      "id": "virtualisation",
      "label": "Virtualisation",
      "count": 7
    },
    {
      "id": "storage",
      "label": "Storage",
      "count": 4
    },
    {
      "id": "network",
      "label": "Networking",
      "count": 10
    },
    {
      "id": "performance",
      "label": "Performance",
      "count": 4
    },
    {
      "id": "security",
      "label": "Security",
      "count": 5
    },
    {
      "id": "legal",
      "label": "Law & jurisdiction",
      "count": 12
    },
    {
      "id": "crypto",
      "label": "Cryptocurrency",
      "count": 8
    },
    {
      "id": "privacy",
      "label": "Privacy tooling",
      "count": 8
    },
    {
      "id": "mail",
      "label": "Email",
      "count": 3
    },
    {
      "id": "operations",
      "label": "Operations",
      "count": 7
    }
  ],
  "terms": [
    {
      "slug": "kvm",
      "term": "KVM",
      "aliases": [
        "Kernel-based Virtual Machine"
      ],
      "category": "virtualisation",
      "definition": "KVM is full hardware virtualisation built into the Linux kernel, giving each guest its own kernel and hardware-enforced isolation from other tenants.",
      "expansion": "Because a KVM guest runs its own kernel, it can load kernel modules, run non-Linux operating systems, use real swap and support nested virtualisation. Memory allocated to a KVM guest is genuinely reserved, which is the practical difference from container-based virtualisation.",
      "url": "https://onionvps.com/glossary/kvm"
    },
    {
      "slug": "openvz",
      "term": "OpenVZ",
      "aliases": [
        "Virtuozzo"
      ],
      "category": "virtualisation",
      "definition": "OpenVZ is container-based virtualisation in which every instance shares the host kernel, so guests cannot load kernel modules or run a different operating system.",
      "expansion": "OpenVZ is why unusually cheap virtual servers exist: density is much higher and memory is routinely oversold. It is also why Docker, WireGuard on older hosts and custom kernels frequently fail on budget providers.",
      "url": "https://onionvps.com/glossary/openvz"
    },
    {
      "slug": "lxc",
      "term": "LXC",
      "aliases": [
        "Linux Containers"
      ],
      "category": "virtualisation",
      "definition": "LXC is Linux-native containerisation that isolates processes with namespaces and cgroups while sharing the host kernel.",
      "expansion": "LXC is excellent inside a trust boundary you already own and weak as a multi-tenant boundary, because a kernel escape affects every container on the host.",
      "url": "https://onionvps.com/glossary/lxc"
    },
    {
      "slug": "hypervisor",
      "term": "Hypervisor",
      "aliases": [],
      "category": "virtualisation",
      "definition": "A hypervisor is the software layer that creates and runs virtual machines, allocating physical CPU, memory and IO between them.",
      "expansion": "A type-1 hypervisor runs directly on the hardware; KVM is unusual in being a type-1 hypervisor implemented as a Linux kernel module, which lets it use the whole Linux driver ecosystem.",
      "url": "https://onionvps.com/glossary/hypervisor"
    },
    {
      "slug": "nested-virtualisation",
      "term": "Nested virtualisation",
      "aliases": [],
      "category": "virtualisation",
      "definition": "Nested virtualisation lets a virtual machine itself run virtual machines, by exposing the processor virtualisation extensions to the guest.",
      "expansion": "It is required for Proxmox VE, VM-based CI jobs and some Docker configurations. Many providers disable it, which is the usual reason those workloads fail elsewhere.",
      "url": "https://onionvps.com/glossary/nested-virtualisation"
    },
    {
      "slug": "vcpu",
      "term": "vCPU",
      "aliases": [
        "virtual CPU"
      ],
      "category": "virtualisation",
      "definition": "A vCPU is a virtual processor presented to a guest, backed by scheduling time on a physical core or thread.",
      "expansion": "The decisive question is whether the backing thread is shared with other tenants or reserved. A dedicated vCPU has no other tenant scheduled against it; a shared one competes, producing steal time.",
      "url": "https://onionvps.com/glossary/vcpu"
    },
    {
      "slug": "steal-time",
      "term": "CPU steal time",
      "aliases": [
        "st time"
      ],
      "category": "performance",
      "definition": "Steal time is the proportion of time a virtual CPU was ready to run but the hypervisor gave the physical core to another guest.",
      "expansion": "It appears as the \"st\" column in top and vmstat. Sustained values above 2–3% indicate contention and show up as tail-latency spikes rather than as uniformly slow throughput.",
      "url": "https://onionvps.com/glossary/steal-time"
    },
    {
      "slug": "cloud-init",
      "term": "cloud-init",
      "aliases": [],
      "category": "virtualisation",
      "definition": "cloud-init is the standard mechanism for configuring a virtual machine on first boot, using metadata supplied by the platform.",
      "expansion": "It handles SSH key injection, hostname, network configuration and arbitrary user scripts, which is what makes fully automated provisioning possible.",
      "url": "https://onionvps.com/glossary/cloud-init"
    },
    {
      "slug": "nvme",
      "term": "NVMe",
      "aliases": [
        "NVM Express"
      ],
      "category": "storage",
      "definition": "NVMe is a storage protocol that connects solid-state drives directly over PCIe, reaching roughly 500,000 random IOPS with sub-100-microsecond latency.",
      "expansion": "Its deep parallel queue model is architecturally different from SATA, which inherits a single-queue design intended for mechanical disks. For database-backed applications the random-IOPS gap is the difference users actually feel.",
      "url": "https://onionvps.com/glossary/nvme"
    },
    {
      "slug": "iops",
      "term": "IOPS",
      "aliases": [
        "input/output operations per second"
      ],
      "category": "storage",
      "definition": "IOPS measures how many individual read or write operations a storage device completes per second.",
      "expansion": "Random 4K IOPS at a queue depth of one is the number that predicts database behaviour; sequential throughput is the number that appears in marketing.",
      "url": "https://onionvps.com/glossary/iops"
    },
    {
      "slug": "raid-10",
      "term": "RAID 10",
      "aliases": [
        "RAID 1+0"
      ],
      "category": "storage",
      "definition": "RAID 10 mirrors data across pairs of drives and stripes across the mirrors, giving both redundancy and high performance at the cost of half the raw capacity.",
      "expansion": "It is the standard choice for virtualisation storage because it tolerates a drive failure without the write-amplification penalty of parity RAID. RAID 5 and RAID 6 store parity instead of a full mirror, which is cheaper per usable terabyte but turns every small write into a read-modify-write cycle — ruinous for a host running dozens of database-backed guests. RAID 10 also rebuilds far faster after a failure, because it copies from one surviving mirror rather than recomputing parity across the whole array, and a long rebuild is exactly when a second drive is most likely to fail. Every OnionVPS NVMe pool is RAID 10; the Hold line uses RAID 6 on its bulk HDD arrays, where the access pattern is large and sequential and parity costs nothing noticeable.",
      "url": "https://onionvps.com/glossary/raid-10"
    },
    {
      "slug": "luks",
      "term": "LUKS",
      "aliases": [
        "Linux Unified Key Setup",
        "LUKS2"
      ],
      "category": "security",
      "definition": "LUKS is the standard Linux full-disk encryption format, storing key material in a header on the encrypted volume itself.",
      "expansion": "On a VPS it protects data at rest against physical seizure and disk decommissioning. It does not protect against an attacker with access to the running hypervisor, because the key is in memory while the machine runs.",
      "url": "https://onionvps.com/glossary/luks"
    },
    {
      "slug": "snapshot",
      "term": "Snapshot",
      "aliases": [],
      "category": "storage",
      "definition": "A snapshot is a point-in-time copy of a virtual machine disk, taken instantly and stored on the same infrastructure.",
      "expansion": "Snapshots protect against your own mistakes and are ideal before an upgrade. They are not backups: if the underlying storage is lost, the snapshots go with it.",
      "url": "https://onionvps.com/glossary/snapshot"
    },
    {
      "slug": "asn",
      "term": "ASN",
      "aliases": [
        "Autonomous System Number"
      ],
      "category": "network",
      "definition": "An ASN identifies a network that controls its own routing policy and announces its address space to the global routing table via BGP.",
      "expansion": "A provider running its own ASN controls its routing, peering and address space directly rather than reselling someone else's. OnionVPS operates AS200558.",
      "url": "https://onionvps.com/glossary/asn"
    },
    {
      "slug": "bgp",
      "term": "BGP",
      "aliases": [
        "Border Gateway Protocol"
      ],
      "category": "network",
      "definition": "BGP is the protocol that autonomous systems use to exchange routing information and decide how traffic crosses the internet.",
      "expansion": "BGP path selection is why two servers the same physical distance apart can have very different latency: the route matters as much as the distance.",
      "url": "https://onionvps.com/glossary/bgp"
    },
    {
      "slug": "ixp",
      "term": "IXP",
      "aliases": [
        "Internet Exchange Point",
        "peering exchange"
      ],
      "category": "network",
      "definition": "An IXP is a shared physical facility where networks interconnect directly rather than paying a transit provider to carry traffic between them.",
      "expansion": "Direct exchange traffic is shorter, cheaper and usually lower-latency. Presence at DE-CIX, AMS-IX, LINX or Equinix Ashburn is a meaningful signal about a provider's network quality.",
      "url": "https://onionvps.com/glossary/ixp"
    },
    {
      "slug": "peering",
      "term": "Peering",
      "aliases": [],
      "category": "network",
      "definition": "Peering is a direct interconnection between two networks that exchange traffic with each other without paying a third party to carry it.",
      "expansion": "Settlement-free peering reduces both cost and hop count. A provider that peers widely delivers lower latency than one that buys all its connectivity as transit.",
      "url": "https://onionvps.com/glossary/peering"
    },
    {
      "slug": "transit",
      "term": "IP transit",
      "aliases": [],
      "category": "network",
      "definition": "Transit is a paid service in which one network carries another network's traffic to the rest of the internet.",
      "expansion": "Multiple diverse transit providers is what keeps a network reachable when one upstream has an outage. OnionVPS buys transit from Cogent, Lumen, Arelion, GTT and Telia.",
      "url": "https://onionvps.com/glossary/transit"
    },
    {
      "slug": "anycast",
      "term": "Anycast",
      "aliases": [],
      "category": "network",
      "definition": "Anycast announces the same IP address from several locations at once, so each user is routed to the nearest instance by BGP.",
      "expansion": "It reduces latency without DNS propagation delay and absorbs volumetric attacks by spreading them across sites. It requires the provider to control its own address space and ASN.",
      "url": "https://onionvps.com/glossary/anycast"
    },
    {
      "slug": "rtt",
      "term": "RTT",
      "aliases": [
        "round-trip time",
        "ping"
      ],
      "category": "performance",
      "definition": "RTT is the time for a packet to travel to a destination and for the response to return, measured in milliseconds.",
      "expansion": "The physical floor is about 1 ms per 100 km each way: light in fibre travels at roughly two-thirds of c and real routes are around 1.35 times the great-circle distance. No provider beats that floor, which is why placement decides more about perceived speed than any hardware specification. What a good network does is get close to the floor — direct peering rather than three transit hops, and uncongested links that do not add queueing delay on top of distance. Note that ICMP ping and application-layer round trip are not the same measurement: routers routinely de-prioritise ICMP, so a ping can look worse than the TCP handshake your users actually experience. Every OnionVPS location page publishes an estimated RTT to every other region, computed from the formula above so the number is reproducible rather than promotional.",
      "url": "https://onionvps.com/glossary/rtt"
    },
    {
      "slug": "jitter",
      "term": "Jitter",
      "aliases": [],
      "category": "performance",
      "definition": "Jitter is variation in packet delay over time, as distinct from the average delay itself.",
      "expansion": "For voice, gaming and trading, jitter often matters more than latency: a consistent 60 ms is far more usable than an average of 40 ms that regularly spikes to 200 ms, because buffers are sized for the worst case rather than the mean. Jitter usually comes from queueing on a congested link, from route flapping, or — on the server side — from CPU steal time delaying the process that should have replied. That last cause is invisible in a network trace and is the reason dedicated vCPU matters for latency-sensitive workloads. Measure it with mtr or a long iperf3 run rather than a handful of pings; a five-packet sample tells you almost nothing about variance.",
      "url": "https://onionvps.com/glossary/jitter"
    },
    {
      "slug": "ipv6",
      "term": "IPv6",
      "aliases": [],
      "category": "network",
      "definition": "IPv6 is the current version of the Internet Protocol, using 128-bit addresses to replace the exhausted 32-bit IPv4 space.",
      "expansion": "A routed /64 subnet, which is the standard allocation, contains about 18 quintillion addresses — enough to give every container and service its own public address without network address translation.",
      "url": "https://onionvps.com/glossary/ipv6"
    },
    {
      "slug": "reverse-dns",
      "term": "Reverse DNS",
      "aliases": [
        "PTR record",
        "rDNS"
      ],
      "category": "network",
      "definition": "Reverse DNS maps an IP address back to a hostname through a PTR record, the inverse of a normal DNS lookup.",
      "expansion": "It is effectively mandatory for outbound mail: most large receivers reject messages from addresses whose PTR does not resolve back to the sending hostname.",
      "url": "https://onionvps.com/glossary/reverse-dns"
    },
    {
      "slug": "port-25",
      "term": "Port 25",
      "aliases": [
        "SMTP port"
      ],
      "category": "network",
      "definition": "Port 25 is the TCP port used for server-to-server SMTP mail delivery.",
      "expansion": "Most hosting providers block it permanently to limit spam, which makes self-hosted mail impossible on much of the market. It is open by default on every OnionVPS instance.",
      "url": "https://onionvps.com/glossary/port-25"
    },
    {
      "slug": "unmetered",
      "term": "Unmetered bandwidth",
      "aliases": [],
      "category": "network",
      "definition": "Unmetered means transfer volume is not counted, though the port speed still caps how much can move.",
      "expansion": "It is distinct from \"unlimited\", which is usually marketing. An unmetered gigabit port can physically move about 324 TB a month; the honest constraint is the port, not a policy.",
      "url": "https://onionvps.com/glossary/unmetered"
    },
    {
      "slug": "ddos",
      "term": "DDoS",
      "aliases": [
        "distributed denial of service"
      ],
      "category": "security",
      "definition": "A DDoS attack floods a target with traffic or expensive requests from many sources at once, to exhaust bandwidth, connection state or processing capacity.",
      "expansion": "Volumetric attacks at layers 3 and 4 are stopped by upstream scrubbing; application-layer attacks at layer 7 send requests that look legitimate and need protocol-aware filtering.",
      "url": "https://onionvps.com/glossary/ddos"
    },
    {
      "slug": "scrubbing",
      "term": "Traffic scrubbing",
      "aliases": [
        "DDoS mitigation"
      ],
      "category": "security",
      "definition": "Scrubbing routes traffic through filtering infrastructure that discards attack packets and forwards legitimate ones.",
      "expansion": "Always-on scrubbing filters continuously; on-demand scrubbing diverts traffic only once an attack is detected, which means the first minutes of every attack succeed.",
      "url": "https://onionvps.com/glossary/scrubbing"
    },
    {
      "slug": "null-route",
      "term": "Null route",
      "aliases": [
        "blackhole"
      ],
      "category": "security",
      "definition": "A null route discards all traffic to an IP address, protecting the wider network by making the target completely unreachable.",
      "expansion": "From the customer's point of view a null route is indistinguishable from a successful attack: the service is unreachable, which is precisely what the attacker wanted. It exists because the alternative can be worse — an attack large enough to saturate a shared uplink degrades every other customer behind it, so the address under attack is dropped upstream to protect the rest. A provider that reaches for null-routing quickly is telling you its scrubbing capacity is thin. OnionVPS filters first and null-routes only when an attack exceeds what the edge can absorb without collateral damage, and tells the affected customer when it happens rather than leaving them to diagnose an outage that has no cause on their server.",
      "url": "https://onionvps.com/glossary/null-route"
    },
    {
      "slug": "fail2ban",
      "term": "fail2ban",
      "aliases": [],
      "category": "security",
      "definition": "fail2ban monitors log files for repeated authentication failures and temporarily firewalls the offending addresses.",
      "expansion": "It reduces log noise and slows brute-force attempts, and it is genuinely useful in front of services that must accept passwords. It is not a substitute for disabling password authentication on SSH, which removes the attack class entirely rather than throttling it — a key-based login cannot be brute-forced at all. Tune it carefully: an aggressive findtime and maxretry will eventually ban you from your own server, which is one of the more common reasons people discover their provider has no out-of-band console. Modern equivalents such as sshguard and CrowdSec work the same way, and nftables can express simple rate limits without any daemon at all.",
      "url": "https://onionvps.com/glossary/fail2ban"
    },
    {
      "slug": "warrant-canary",
      "term": "Warrant canary",
      "aliases": [],
      "category": "legal",
      "definition": "A warrant canary is a regularly republished statement that a provider has not received a secret legal demand; its disappearance implies that one has arrived.",
      "expansion": "It is only meaningful with a fixed schedule, a cryptographic signature and a recent external timestamp proving it could not have been pre-signed. Its legal status is largely untested.",
      "url": "https://onionvps.com/glossary/warrant-canary"
    },
    {
      "slug": "kyc",
      "term": "KYC",
      "aliases": [
        "know your customer"
      ],
      "category": "legal",
      "definition": "KYC is the set of identity-verification duties imposed on regulated financial institutions before providing services.",
      "expansion": "These duties bind banks, exchanges and payment institutions because they handle money transmission. Hosting is not a regulated financial activity, so a compute provider has no equivalent obligation in the jurisdictions where we operate. Hosts that demand a passport do so for chargeback and fraud control, not because a statute requires it — which is why crypto-settled providers, who cannot receive a chargeback, generally do not ask. The distinction matters practically: an identity document collected for fraud control is still an identity document that can be breached, sold, or produced in response to a demand years later.",
      "url": "https://onionvps.com/glossary/kyc"
    },
    {
      "slug": "no-kyc-hosting",
      "term": "No-KYC hosting",
      "aliases": [
        "anonymous hosting"
      ],
      "category": "legal",
      "definition": "No-KYC hosting is server hosting that requires no identity verification — no government ID, billing address, phone number or payment card.",
      "expansion": "The provider therefore holds no identity information that can be breached, sold or compelled. That is an architectural property rather than a policy promise.",
      "url": "https://onionvps.com/glossary/no-kyc-hosting"
    },
    {
      "slug": "offshore-hosting",
      "term": "Offshore hosting",
      "aliases": [],
      "category": "legal",
      "definition": "Offshore hosting means placing a server in a jurisdiction other than your own, typically one outside the Fourteen Eyes alliances and outside EU data-retention rules.",
      "expansion": "It changes which law governs the server and which court can compel disclosure. It does not make illegal content legal, and it does not exempt you from the law where you live.",
      "url": "https://onionvps.com/glossary/offshore-hosting"
    },
    {
      "slug": "five-eyes",
      "term": "Five Eyes",
      "aliases": [
        "FVEY"
      ],
      "category": "legal",
      "definition": "The Five Eyes is a signals-intelligence sharing alliance between the United States, United Kingdom, Canada, Australia and New Zealand.",
      "expansion": "Nine Eyes adds Denmark, France, the Netherlands and Norway; Fourteen Eyes adds Belgium, Germany, Italy, Spain and Sweden. Privacy-oriented hosting typically avoids all fourteen.",
      "url": "https://onionvps.com/glossary/five-eyes"
    },
    {
      "slug": "fourteen-eyes",
      "term": "Fourteen Eyes",
      "aliases": [
        "14 Eyes",
        "SIGINT Seniors Europe"
      ],
      "category": "legal",
      "definition": "The Fourteen Eyes is the widest of the signals-intelligence sharing groupings, comprising the Five Eyes plus Denmark, France, the Netherlands, Norway, Belgium, Germany, Italy, Spain and Sweden.",
      "expansion": "Membership is a legitimate jurisdiction signal but not a complete analysis: a non-member can still have aggressive domestic retention law, and a member can have strong judicial oversight.",
      "url": "https://onionvps.com/glossary/fourteen-eyes"
    },
    {
      "slug": "mlat",
      "term": "MLAT",
      "aliases": [
        "mutual legal assistance treaty"
      ],
      "category": "legal",
      "definition": "An MLAT is a treaty through which one country formally requests another to gather evidence on its behalf.",
      "expansion": "Requests routinely take six to eighteen months, most treaties require dual criminality, and many exclude civil matters entirely — which is why offshore jurisdiction is particularly effective against speculative civil discovery.",
      "url": "https://onionvps.com/glossary/mlat"
    },
    {
      "slug": "dmca",
      "term": "DMCA",
      "aliases": [
        "Digital Millennium Copyright Act"
      ],
      "category": "legal",
      "definition": "The DMCA is United States copyright statute whose notice-and-takedown procedure and safe harbour apply to service providers situated in the United States.",
      "expansion": "A server outside the US is governed by local copyright law instead, which in most countries requires a court order rather than a private notice. Copyright still applies; only the enforcement mechanism differs.",
      "url": "https://onionvps.com/glossary/dmca"
    },
    {
      "slug": "data-retention",
      "term": "Data retention",
      "aliases": [],
      "category": "legal",
      "definition": "Data retention laws require communications providers to store connection metadata for a defined period so that authorities can obtain it later.",
      "expansion": "The EU's original Data Retention Directive was invalidated by the Court of Justice in 2014, and Romania struck its national law down twice on constitutional grounds. Several offshore jurisdictions impose no such obligation at all.",
      "url": "https://onionvps.com/glossary/data-retention"
    },
    {
      "slug": "gdpr",
      "term": "GDPR",
      "aliases": [
        "General Data Protection Regulation"
      ],
      "category": "legal",
      "definition": "The GDPR is the EU regulation governing processing of personal data of people in the EU, regardless of where the processing happens.",
      "expansion": "It follows the data subject rather than the server, so hosting outside the EU does not exempt you — it adds a transfer-mechanism obligation such as standard contractual clauses.",
      "url": "https://onionvps.com/glossary/gdpr"
    },
    {
      "slug": "ibc",
      "term": "IBC",
      "aliases": [
        "International Business Company"
      ],
      "category": "legal",
      "definition": "An IBC is a corporate form offered by jurisdictions such as Seychelles, Belize and the British Virgin Islands, characterised by confidentiality and minimal reporting.",
      "expansion": "Typical features include no public beneficial-ownership register, no local tax on foreign income, and limited exposure to foreign legal process.",
      "url": "https://onionvps.com/glossary/ibc"
    },
    {
      "slug": "bulletproof-hosting",
      "term": "Bulletproof hosting",
      "aliases": [],
      "category": "legal",
      "definition": "Bulletproof hosting describes a provider that claims to ignore all abuse complaints and law enforcement, including for criminal activity.",
      "expansion": "It is distinct from anonymous hosting, which simply does not collect identity data. Bulletproof providers' address space is blocklisted wholesale, so mail is rejected and users face constant CAPTCHAs.",
      "url": "https://onionvps.com/glossary/bulletproof-hosting"
    },
    {
      "slug": "monero",
      "term": "Monero",
      "aliases": [
        "XMR"
      ],
      "category": "crypto",
      "definition": "Monero is a cryptocurrency that hides sender, receiver and amount at the protocol level using ring signatures, stealth addresses and RingCT.",
      "expansion": "Unlike Bitcoin there is no public balance or transaction graph to analyse, which makes it the default recommendation for privacy-motivated purchases.",
      "url": "https://onionvps.com/glossary/monero"
    },
    {
      "slug": "ring-signature",
      "term": "Ring signature",
      "aliases": [],
      "category": "crypto",
      "definition": "A ring signature proves that one member of a group signed a message without revealing which one.",
      "expansion": "In Monero it hides which output is actually being spent, by mixing the real input with decoys drawn from the chain.",
      "url": "https://onionvps.com/glossary/ring-signature"
    },
    {
      "slug": "stealth-address",
      "term": "Stealth address",
      "aliases": [],
      "category": "crypto",
      "definition": "A stealth address is a one-time destination address generated for each payment so that transactions to the same recipient cannot be linked.",
      "expansion": "It is why a Monero recipient can publish a single address without every payment to it becoming publicly correlatable.",
      "url": "https://onionvps.com/glossary/stealth-address"
    },
    {
      "slug": "ringct",
      "term": "RingCT",
      "aliases": [
        "Ring Confidential Transactions"
      ],
      "category": "crypto",
      "definition": "RingCT conceals transaction amounts on the Monero blockchain while still allowing the network to verify that inputs equal outputs.",
      "expansion": "It closed the last major analytical surface in Monero: before RingCT, visible amounts allowed transactions to be correlated even when parties were hidden.",
      "url": "https://onionvps.com/glossary/ringct"
    },
    {
      "slug": "stablecoin",
      "term": "Stablecoin",
      "aliases": [
        "USDT",
        "USDC"
      ],
      "category": "crypto",
      "definition": "A stablecoin is a token pegged to a fiat currency, typically the US dollar, and backed by reserves held by an issuer.",
      "expansion": "Stablecoins remove exchange-rate risk from an invoice but are the least private option: the ledger is transparent and the issuer can freeze or blacklist addresses.",
      "url": "https://onionvps.com/glossary/stablecoin"
    },
    {
      "slug": "trc20",
      "term": "TRC-20",
      "aliases": [],
      "category": "crypto",
      "definition": "TRC-20 is the token standard on the TRON blockchain, most commonly used for USDT.",
      "expansion": "It is usually the cheapest network for a hosting-sized payment, with fees measured in cents and confirmation in about a minute.",
      "url": "https://onionvps.com/glossary/trc20"
    },
    {
      "slug": "confirmation",
      "term": "Confirmation",
      "aliases": [
        "block confirmation"
      ],
      "category": "crypto",
      "definition": "A confirmation is a block added to the chain after the block containing a transaction, each making reversal exponentially harder.",
      "expansion": "Merchants require more confirmations on chains where reorganisations are cheap. The requirement is shown on the invoice before payment.",
      "url": "https://onionvps.com/glossary/confirmation"
    },
    {
      "slug": "atomic-swap",
      "term": "Atomic swap",
      "aliases": [],
      "category": "crypto",
      "definition": "An atomic swap exchanges two cryptocurrencies directly between wallets, with cryptography guaranteeing that either both sides complete or neither does.",
      "expansion": "It is the common route from Bitcoin to Monero without an exchange account, and therefore without identity verification.",
      "url": "https://onionvps.com/glossary/atomic-swap"
    },
    {
      "slug": "wireguard",
      "term": "WireGuard",
      "aliases": [],
      "category": "privacy",
      "definition": "WireGuard is a VPN protocol implemented in about 4,000 lines of kernel code with a fixed modern cipher suite.",
      "expansion": "It is roughly three to four times faster than OpenVPN on the same hardware, reconnects instantly, and is small enough to be meaningfully auditable. It is UDP-only, which makes it blockable on restrictive networks.",
      "url": "https://onionvps.com/glossary/wireguard"
    },
    {
      "slug": "openvpn",
      "term": "OpenVPN",
      "aliases": [],
      "category": "privacy",
      "definition": "OpenVPN is a mature userspace VPN protocol with configurable ciphers that can run over TCP or UDP.",
      "expansion": "Its remaining advantage over WireGuard is that it can run over TCP port 443 and closely resemble ordinary TLS, which matters where VPN traffic is filtered.",
      "url": "https://onionvps.com/glossary/openvpn"
    },
    {
      "slug": "tor",
      "term": "Tor",
      "aliases": [
        "The Onion Router"
      ],
      "category": "privacy",
      "definition": "Tor routes traffic through three volunteer-operated relays chosen so that no single relay knows both the origin and the destination.",
      "expansion": "It provides anonymity from the destination at the cost of latency. Middle relays and bridges are permitted on any OnionVPS instance; exit relays are permitted in approved jurisdictions.",
      "url": "https://onionvps.com/glossary/tor"
    },
    {
      "slug": "tor-exit-node",
      "term": "Tor exit node",
      "aliases": [
        "exit relay"
      ],
      "category": "privacy",
      "definition": "A Tor exit node is the final relay in a circuit, which connects to the destination and therefore appears to be the source of the traffic.",
      "expansion": "Exits receive abuse complaints for traffic carried on behalf of others, which is why many hosts prohibit them and why we permit them only in approved jurisdictions with a published abuse contact.",
      "url": "https://onionvps.com/glossary/tor-exit-node"
    },
    {
      "slug": "onion-service",
      "term": "Onion service",
      "aliases": [
        "hidden service"
      ],
      "category": "privacy",
      "definition": "An onion service is a service reachable only through Tor, whose address is derived from its public key rather than registered with any authority.",
      "expansion": "Because there is no DNS registrar and no public IP, an onion service removes two of the main points at which a conventional site can be identified or seized.",
      "url": "https://onionvps.com/glossary/onion-service"
    },
    {
      "slug": "socks5",
      "term": "SOCKS5",
      "aliases": [],
      "category": "privacy",
      "definition": "SOCKS5 is a proxy protocol that forwards arbitrary TCP and UDP traffic, with optional authentication.",
      "expansion": "Unlike an HTTP proxy it is protocol-agnostic, which is why it is the usual choice for tunnelling application traffic. An unauthenticated SOCKS5 proxy is found by scanners within hours.",
      "url": "https://onionvps.com/glossary/socks5"
    },
    {
      "slug": "shadowsocks",
      "term": "Shadowsocks",
      "aliases": [],
      "category": "privacy",
      "definition": "Shadowsocks is an encrypted proxy protocol designed to be difficult to identify by traffic analysis.",
      "expansion": "It is widely used where VPN protocols are actively blocked, since its traffic does not present a recognisable handshake.",
      "url": "https://onionvps.com/glossary/shadowsocks"
    },
    {
      "slug": "no-logs",
      "term": "No-logs policy",
      "aliases": [],
      "category": "privacy",
      "definition": "A no-logs policy is a commitment not to retain records of user activity such as connection metadata, netflow or DNS queries.",
      "expansion": "The distinction that matters is between logs that are not kept and logs that are never generated. Ask specifically about netflow: a provider can truthfully say it does not sell data while retaining a complete connection record.",
      "url": "https://onionvps.com/glossary/no-logs"
    },
    {
      "slug": "spf",
      "term": "SPF",
      "aliases": [
        "Sender Policy Framework"
      ],
      "category": "mail",
      "definition": "SPF is a DNS record listing which servers are authorised to send mail for a domain.",
      "expansion": "It is the first of three records receivers check. Without it, mail from a new server is treated as suspicious by default.",
      "url": "https://onionvps.com/glossary/spf"
    },
    {
      "slug": "dkim",
      "term": "DKIM",
      "aliases": [
        "DomainKeys Identified Mail"
      ],
      "category": "mail",
      "definition": "DKIM cryptographically signs outgoing messages so a receiver can verify the domain and that the content was not altered in transit.",
      "expansion": "The public key is published in DNS. Together with SPF it forms the basis on which DMARC makes a pass or fail decision.",
      "url": "https://onionvps.com/glossary/dkim"
    },
    {
      "slug": "dmarc",
      "term": "DMARC",
      "aliases": [],
      "category": "mail",
      "definition": "DMARC tells receivers what to do with messages that fail SPF and DKIM, and where to send aggregate reports.",
      "expansion": "Start at p=none and read the reports for a fortnight before tightening. Going straight to p=reject on an established domain reliably breaks systems you had forgotten were sending mail.",
      "url": "https://onionvps.com/glossary/dmarc"
    },
    {
      "slug": "sla",
      "term": "SLA",
      "aliases": [
        "service level agreement"
      ],
      "category": "operations",
      "definition": "An SLA is a contractual commitment to a service level, usually availability, with defined compensation when it is missed.",
      "expansion": "99.99% permits about 4.4 minutes of downtime a month; 99.9% permits about 43 minutes. Check what the SLA covers — network and hypervisor availability, not your application.",
      "url": "https://onionvps.com/glossary/sla"
    },
    {
      "slug": "out-of-band-console",
      "term": "Out-of-band console",
      "aliases": [
        "VNC console",
        "KVM console"
      ],
      "category": "operations",
      "definition": "An out-of-band console attaches to a virtual machine's display and keyboard independently of its network connection.",
      "expansion": "It is how a firewall mistake, a broken SSH configuration or a boot failure gets fixed without a support ticket, and how custom ISO installation is performed.",
      "url": "https://onionvps.com/glossary/out-of-band-console"
    },
    {
      "slug": "custom-iso",
      "term": "Custom ISO",
      "aliases": [],
      "category": "operations",
      "definition": "Custom ISO support lets you upload an installer image and boot the instance from it, rather than choosing from a fixed template list.",
      "expansion": "It is the escape hatch that makes a VPS genuinely general-purpose: BSDs, hardened images, appliance operating systems and anything you built yourself.",
      "url": "https://onionvps.com/glossary/custom-iso"
    },
    {
      "slug": "terraform",
      "term": "Terraform",
      "aliases": [
        "OpenTofu"
      ],
      "category": "operations",
      "definition": "Terraform declares infrastructure in configuration files and reconciles the real environment against them.",
      "expansion": "A provider with a Terraform provider can be treated as code: instances, addresses and firewall rules become reviewable, versioned artefacts.",
      "url": "https://onionvps.com/glossary/terraform"
    },
    {
      "slug": "ttfb",
      "term": "TTFB",
      "aliases": [
        "time to first byte"
      ],
      "category": "performance",
      "definition": "TTFB measures the time from a request being sent to the first byte of the response arriving.",
      "expansion": "It combines network latency with server processing time, which is why it is dominated by distance for a fast application and by the application for a distant one. It feeds directly into Core Web Vitals.",
      "url": "https://onionvps.com/glossary/ttfb"
    },
    {
      "slug": "seedbox",
      "term": "Seedbox",
      "aliases": [],
      "category": "operations",
      "definition": "A seedbox is a server dedicated to downloading and seeding torrents at high speed, typically with large storage and a fast uplink.",
      "expansion": "The technology is entirely lawful; what is transferred determines legality. Jurisdiction is the main selection criterion, because copyright enforcement mechanisms differ sharply between countries.",
      "url": "https://onionvps.com/glossary/seedbox"
    },
    {
      "slug": "control-panel",
      "term": "Control panel",
      "aliases": [
        "hosting panel"
      ],
      "category": "operations",
      "definition": "A control panel is a web interface for administering servers, websites, mail and databases — cPanel, DirectAdmin, CyberPanel and similar.",
      "expansion": "Panels save time and add attack surface. Several require an enterprise-family Linux distribution such as AlmaLinux or Rocky.",
      "url": "https://onionvps.com/glossary/control-panel"
    },
    {
      "slug": "provisioning",
      "term": "Provisioning",
      "aliases": [],
      "category": "operations",
      "definition": "Provisioning is the process of creating, configuring and delivering a server so that it is ready to use.",
      "expansion": "On a modern platform it is fully automated and takes under a minute. Delays are almost always payment confirmation or a manual fraud review, not the machine itself.",
      "url": "https://onionvps.com/glossary/provisioning"
    }
  ]
}