Offshore locations.
Choose which law applies.

Region first, then the law

Start with your audience. Distance sets a floor under latency that no legal choice removes, so pick the region first and the jurisdiction second. Then match the legal profile to what you publish and to how much procedure you want between a complaint and your server.

Privacy and free expression

Iceland and Switzerland are the strongest fits. Iceland combines constitutional protection against censorship, the 2010 IMMI resolution and 12th place in RSF's 2026 index. The DSA is not yet part of the EEA Agreement, but Icelandic law has its own copyright notice procedure with a counter-notice right. Switzerland ranks 8th, sits outside the EU and has data protection the EU recognizes as adequate. Its courts act on defamation claims, and a paused surveillance reform could widen identification and retention duties.

Six of our seven locations are outside the Five, Nine and 14 Eyes intelligence-sharing groups; only the Netherlands is in the Nine and 14 Eyes. Our guide to the 14 Eyes countries and hosting explains why the legal channels to your data matter more.

Value and hardware choice

Each plan costs the same wherever it is offered, so value comes from what a location lets you buy. Moldova is the only location outside the EU with the whole catalog: all nine dedicated servers from $47.49, the storage and 10 Gbps models, GPU servers and the shared RDP seat. Inside the EU, Bulgaria and Romania also offer the entry-level Xeon servers and the shared seat. In Moldova, check the retention and administrative removal rules and the reputation of your IP range before you commit.

An EU audience

If your users are in the EU and you want their data to stay there, choose Amsterdam for connectivity, Bucharest for GPU servers and six dedicated models, or Sofia for a lean setup near the Balkans. All three apply the GDPR and the DSA. Zürich is the non-EU alternative with an EU adequacy decision.

Asia latency

Kuala Lumpur is about 310 km from Singapore and gives the lowest latency to South-East Asia of our locations. It offers VPS and Windows RDP only, and it comes with Malaysia's statutory copyright notice procedure and stricter speech laws.

EU and non-EU locations

In Romania, the Netherlands and Bulgaria, the Digital Services Act adds a common procedure on top of national law:

• Notice and action. Anyone can send a notice that explains why content is illegal and where it is (Article 16). It gives the host actual knowledge but is not an automatic takedown: the host must decide diligently and objectively.
• Statement of reasons. If content is restricted, the customer must be told why and how to challenge the decision (Article 17).
• Orders from authorities. Courts and competent authorities can order action against specific content or request information (Articles 9 and 10). Under a separate regulation, terrorist content can be ordered offline within one hour.
• No general monitoring. Hosts cannot be required to monitor everything they store (Article 8).

Outside the EU, each country follows its own rules. Iceland is in the EEA, where the DSA is still under scrutiny, and its Act No. 30/2002 has its own copyright notice procedure. Switzerland has no DSA and plans a platform law only for very large services. Moldova, an EU candidate, has drafted a DSA-style law, and its cybercrime law already allows administrative removal orders for specific criminal content. Malaysia has a statutory copyright notice procedure with criminal penalties for false notices. US DMCA notices have no legal force in any of the seven countries; our DMCA policy explains how we answer them.

Data protection follows a similar split. The GDPR applies in the three EU locations and in Iceland. Switzerland's revised data protection act is recognized by the EU as adequate. Moldova's Law No. 195/2024 and Malaysia's Personal Data Protection Act are modern laws, but neither country has an EU adequacy decision, so GDPR-covered data stored there needs a safeguard such as standard contractual clauses.

What no jurisdiction can offer

• Immunity from local courts. Every one of our locations has courts that can order the removal of content or the disclosure of data, and valid orders are followed.
• Distance from EU law for EU-facing services. If you run a platform for people in the EU, EU rules such as the DSA and the GDPR can apply to you as the operator wherever your server is, and EU authorities can act against your domain, your payment channels or access to your site.
• Protection for abuse. Child sexual abuse material, malware, spam, phishing, attacks and fraud are acted on immediately in every location under our acceptable use policy. Read offshore vs bulletproof hosting for the difference.
• Anonymity by default. We ask only for an email address and accept crypto, but most blockchains are public ledgers, so a payment can be traced unless you use a privacy coin such as Monero. What we store is listed in our privacy policy.
• Permanence. Laws change. The DSA may come to Iceland, Switzerland may widen its surveillance duties, and Moldova is aligning its law with the EU as it negotiates accession. We track these changes on each location page, our transparency report lists the requests we receive, and our warrant canary is renewed every quarter.

For the legal background, read Is offshore hosting legal? and our jurisdictions compared article.