Bulgaria VPS & offshore servers.
Low-cost EU hosting near the Black Sea.

Legal profile

EU status

EU member since 2007

Digital Services Act

Applies; the Communications Regulation Commission is the Digital Services Coordinator

Data protection

GDPR, with the Personal Data Protection Act

Traffic data retention

Telecom retention law annulled in 2015; later rules tested at the EU Court of Justice

Press freedom

71st of 180 (RSF, 2026)

Bulgaria joined the EU in 2007, and the Digital Services Act applies in full. The Communications Regulation Commission (CRC) is the national Digital Services Coordinator (European Commission). Hosting liability now follows the DSA's own rules in Articles 4 to 6, which replaced the e-Commerce Directive provisions that Bulgarian law used to implement.

Article 40 of the Constitution states that the press is free and not subject to censorship, and that stopping or confiscating printed matter or another information medium requires an act of the judicial authorities. RSF ranks Bulgaria 71st in 2026, the lowest of our EU locations, pointing to abusive lawsuits against journalists, opaque state funding of media and threats to reporters.

Copyright complaints and notice-and-action

Copyright is protected by the Copyright and Neighboring Rights Act and enforced through the courts. For hosts, the DSA's notice-and-action mechanism now sets the procedure (DSA, Articles 16 and 17). A valid notice explains why the content is illegal, gives its exact location, identifies the sender and confirms good faith. It gives the host actual knowledge, but it is not an automatic removal order: the host must decide diligently and objectively, and give the customer a statement of reasons if content is restricted. The DSA imposes no general monitoring duty.

Competent Bulgarian judicial and administrative authorities can also issue orders under Article 9 of the DSA. Such an order must state its legal basis and reasons, identify the content precisely and explain the remedies available, and its territorial scope must be limited to what is strictly necessary. The EU Terrorist Content Online Regulation lets competent authorities order terrorist content removed within one hour.

Data protection and retention

The GDPR applies directly, supplemented by the Personal Data Protection Act. The supervisory authority is the Commission for Personal Data Protection (CPDP). Personal data processed in Sofia stays inside the EU.

Data retention has been contested in Bulgaria for years. In 2015 the Constitutional Court annulled the data retention provisions of the Electronic Communications Act. The act contained a retention framework again by 2016, when the new Counter-Terrorism Act amended it (EU Agency for Fundamental Rights). In November 2022, answering questions referred by a Bulgarian court, the EU Court of Justice confirmed that EU law precludes general and indiscriminate retention of traffic and location data as a preventive measure against serious crime (C-350/21).

These retention rules concern providers of public electronic communications networks and services, not hosting as such. What we keep is set out in our privacy policy: your email address, your balance and payment records, your sign-in sessions (browser and country, never the IP address) and your service records. We do not log or inspect the traffic on your server.

Bulgaria is not in the Five, Nine or 14 Eyes intelligence-sharing groups. Those groups share intercepted communications; data on a server in Sofia is still obtained through Bulgarian and EU procedures, as our guide to what the 14 Eyes mean for hosting explains.

How we handle complaints here

1. Every complaint about a server in Sofia is logged and checked against Bulgarian and EU law.
2. We do not act on a notice because it cites the US DMCA, which has no legal force in Bulgaria. What matters is whether the notice meets the DSA's requirements and concerns content that is illegal under EU or Bulgarian law. A notice that does is assessed on those terms, whoever sends it.
3. A valid order of a Bulgarian court, an order from a competent authority under Article 9 of the DSA, or a notice that meets Article 16 of the DSA can require action. You are informed first and can respond, unless a court forbids it, and the DSA requires us to give you a statement of reasons if we restrict content.
4. Requests and outcomes are published in our quarterly transparency report, without customer data.

Who it suits

• A low-cost EU presence. VPS plans start at $2.39, the shared RDP seat costs $4.09, and two Intel dedicated servers are offered: the Xeon E3-1230 v6 at $47.49 and the dual Xeon E5-2680 v4 with 28 cores and 128 GB of ECC memory at $137.99.
• Audiences in the Balkans, Greece, Turkey and the Black Sea region. Sofia is about 300 km from Bucharest and 500 km from Istanbul in a straight line.
• Windows desktops and light workloads for teams in South-East Europe.
• Sites that need GDPR data residency but not premium hardware.

Available in Sofia

Network and latency

In a straight line, Sofia is about 300 km from Bucharest, 500 km from Istanbul, 820 km from Vienna and 1,390 km from Frankfurt. Balkan-IX (B-IX), a neutral exchange headquartered in Sofia, serves operators across the Balkans, and Romania's InterLAN also has a point of presence in the city.

Bulgaria's Black Sea coast carries two subsea systems in service, according to TeleGeography: KAFOS, which links Varna with Romania and Istanbul, and the Caucasus Cable System from Balchik to Poti in Georgia. A third, Kardesa, is planned for 2027. Routes to Western Europe are terrestrial, so Amsterdam or Zürich will usually be faster for users there. Our network page lists latency estimates and shows how to measure the real latency yourself.