Maybe it's useful to mention security procedures for VPN privacy services. You accept credit/debit card payments, and need to retain records for dealing with fraud, satisfy VAT requirements, etc. Your exit servers need to check account status, check for existing connections to limit concurrency, and so on. But in case adversaries have your exit servers seized, you want them to be clean. So you run them read-only, with no persistent storage, and you do authentication etc with remote servers, using hashed account names and passwords.

Countermail, for example, does the same for its email servers. For Tor relays, there's tor-ramdisk.[0]

0) https://lists.torproject.org/pipermail/tor-talk/2017-Februar...