Late last month, we kicked the tires on the privacy policy and practices of a VPN company called Private Internet Access (PIA). Toward the end of the story, we mentioned transparency reports and “warrant canaries” as two possible tactics that PIA and other VPN firms could use as a way to help their customers understand the legal pressures they've been under.

This past weekend, Proxy.sh, an unknown VPN company to Ars, contacted us to say that it was inspired by the story and started publishing its own transparency report.

“It thus appears that not only are we the only VPN provider to keep its customers updated about any intervention that occurs behind the scenes, we are also the only one to publicly publish abuse notices it receives and how it responds particularly to them,” wrote Vicki, the company’s spokesperson. “It was in such spirit that we believe you should hear about us, since it has a direct connection with one of your earliest reports.”

Vicki provided her last name, but unusually added that “I'd be happier you keep this for yourself. Proxy.sh is not the full-time activity of most of its staff, including myself (PR), and we wish to enjoy a distinction between our activity at Proxy.sh and our real life.”

All of the Proxy.sh staff is only listed by first names and cutesy cartoon avatars. The deeper you dig into the company, the weirder things get. For instance, the company’s “transparency report” leads to more questions than answers about the company itself and its strange policies.

Proxy.sh is listed on TorrentFreak on a countdown of privacy-minded VPN firms. And the company, like PIA, says on its site that it does not log any user data.

Each of our VPN nodes is hand-crafted with love and does not log anything. All the protocols are run from RAM, meaning they will completely disintegrate once the power is shut down or the system gets restarted. System and applications are all set to log nothing. We bring in our own kernel.

Also like PIA, there is no way to independently verify this no-logging claim. The company’s new transparency report lists nine DMCA-related notices of claimed copyright infringement since October 31, 2013.

We have always been clear: we will never collaborate with third-party if this involves providing data about you unless you do activities harmful to human beings (and nothing else, including corporations or governments). Most importantly, in the latter case we will privilege NGOs and public rather than governmental or shadow power entities. And as far as anything else is involved (copyright, whistle-blowing, pornography, political, or religious critics, etc.), we will simply respond to lawful cases by blocking ports or relocating activities to another datacenter or country, as well as blatantly point out about lawless or illegitimate cases [sic].

How did Proxy.sh respond to these DMCA requests? For each one, the organization used some variation on this response:

Action that has been taken from Proxy.sh: Because the server is located in a jurisdiction with precise intellectual property laws, we have reset accounts who forwarded port 1196 (nothing may identify a single account) and we have blocked port 1196 via Firewall.

And has Proxy.sh received any requests from law enforcement agencies? Vicki said no.

“We actually never received any communication from law enforcement agencies yet, because (our legal expert assumes) we are based in Seychelles, and apparently the local government here has not followed suit with legal requests that may apply to us, for various reasons but mostly due to the fact there is either no bilateral agreement or simply no translation of the case into Seychellois law,” she added by e-mail. “This is why we added our "Ethical policy" forbidding activities harmful to human beings. But of course when there will be any, we will publish them there. We will publish them all.”

Seychelles is an island nation in the Indian Ocean, and it's a notorious offshore banking and corporate locale. Another Seychelles-based company, Reservella, is the current alleged corporate owner of The Pirate Bay. In total, according to recent regional media reports, Seychelles has approximately 125,000 foreign companies registered there. These entities do not pay any income tax or capital gains tax.

She sells Seychelles by the seashore

When Ars asked to speak with the company’s lawyer, we were referred to Michael Ha. He's the company’s “legal expert,” but he did not immediately reply to our questions.

Vicki elaborated that Ha is from Hong Kong, is retired, and is "currently living in Laos through his retirement. He has great knowledge and experience regarding international regulations.” A quick search of the Hong Kong Bar Association did not turn up anyone by that name.

"I, nor the company, has nothing to do with any official title he may hold (perhaps he was barred, perhaps he was not at all)," Vicki added. "We are happy with him and that's all we need to worry about, at least from our own perspectives. He could be anything from an attorney to a legal journalist or a law academia—as long as he has the expertise. What we enjoy from him is the end result. We also know he is old and supposedly in retirement nowadays in Laos."

The domain on Ha’s e-mail address is 3monkeysinternational.com. Three Monkeys International calls itself an “innovation venture capital firm” that “funds and designs businesses belonging to three diverse markets: network security & privacy tools, B2C & B2B Web services, and online adult entertainment.”

Vicki further explained. "Three Monkeys International Inc. is the legal owner/operator of the proxy.sh brand and provides us the necessary infrastructures to operate (it cashes in money, it provides pay to all staff and costs—think of it as a LLC proxy company, but instead of Delaware, it is in Seychelles)."

This relationship between Proxy.sh and Three Monkeys International is disclosed nowhere on the Proxy.sh site. Apparently the public isn't the only one in the dark about the true nature of Three Monkeys, either.

"[Three Monkeys International] annual revenues or whatsoever financial information is confidential, and we at proxy.sh do not know about it in its entirety," Vicki added. "But we have good faith it has the resources and the entrepreneurship expertise to help us proceed our services. We know for a fact we are not the only startup this firm helps or has helped."

A little searching turned up the fact that Three Monkeys recently invested $20,000 in Domobase, a European real estate startup. Domobase's CEO, Paul Fleury, told Ars that he had been working with Three Monkeys as an angel partner over the past six years.

Three Monkeys' "director," is an individual named Pauline Morel, who also is the director of a company—Nobel Capital Group—that specializes in establishing offshore companies. (It is common in the world of offshore shell companies to formally name local "directors" who are actually controlled by another person.)

Three Monkeys claims to be registered in the Seychelles—“with offices in Switzerland and over 10 entrepreneurs located throughout the world,” according to Vicki. Still, Three Monkeys does not appear to have an actual office. Morel did not respond to Ars' attempts to contact her via phone or e-mail.

On its site, Proxy.sh provides a PO Box address in Seychelles. But neither Three Monkeys International nor Proxy.sh turns up in a search of official Seychelles-registered businesses—but it was unclear if that was only for domestic companies. Ars contacted the Seychelles International Business Authority (SIBA) to verify the status of Three Monkeys and was told by a SIBA customer service officer that doing so would cost $100.

The announcement for Proxy.sh’s transparency report, however, notes that “we are not based in English speaking countries (North America, United Kingdom, etc.).” However, the Seychelles is an English-speaking country (along with French and Seychellois Creole). Its president’s website is entirely in English.