Offshore VPS Hosting: How to Choose a Jurisdiction

"Offshore" sounds like a single property, as if a server is either offshore or it isn't. In practice it is a choice between countries, and the countries differ a lot. The place your VPS physically runs decides which laws apply to the machine, which authorities can send binding requests to the people who operate it, how complaints are handled, and how many milliseconds stand between your service and its users.

This guide gives you a practical way to make that choice. It covers a simple threat-model framework, the trade-offs between EU and non-EU locations, how cross-border legal requests generally work, what latency really costs you, and the limits that no jurisdiction removes. Throughout, it uses the seven locations MercureHosting actually offers: Iceland, Panama, Moldova, Romania, Switzerland, the Netherlands and Russia.

What "offshore" actually means for a VPS

For hosting, offshore simply means the server is located outside your own country, and often outside the legal systems you are most concerned about. For many customers that means outside the United States, outside the European Union, or both.

Three separate things are bundled into the word, and it helps to pull them apart:

• Where the hardware is. The physical data centre determines which country's courts can issue orders about the machine itself.
• Who operates it. The provider's own location and legal entity determine which authorities can compel the company, regardless of where the disks spin.
• How the provider handles complaints. Two providers in the same country can behave very differently. One forwards every automated notice and suspends on a timer; another reviews each complaint against local law first.

MercureHosting's policy, written in the terms, is that every complaint is reviewed under the law of the country where the server is located, foreign notices don't cause automatic takedowns, and valid court orders issued in the hosting jurisdiction are complied with. The country you pick therefore matters directly: it sets the legal standard your server is measured against.

Start with a threat model, not a country

People often begin with a country they've heard good things about. It is more reliable to begin with your project and work outwards. Answer four questions honestly.

1. Where are your users?

Latency is physics. Every request travels over fibre, and distance plus routing adds delay. An API used by traders in Frankfurt and a blog read mostly in Mexico City want different locations. Write down the two or three regions where most of your traffic will come from.

2. What are you protecting against?

Be specific. Common answers include:

• Automated or bad-faith takedown notices from a particular country's legal system
• Bulk data-retention rules or broad access to subscriber records
• A provider that demands identity documents (that is a checkout question, covered in our post on no-KYC VPS hosting)
• A single point of failure, where one complaint or one outage takes everything down

Each of these points to a different decision. Distance from US notices points away from the US; distance from EU instruments points to non-EU locations; resilience points to several locations at once.

3. What is your budget?

Prices differ by country because power, transit and hardware costs differ. Across our network the entry VPS plan ranges from $11.25 a month in Moldova and Russia to $16.50 in Switzerland. That gap grows on larger plans and dedicated servers.

4. What workload are you running?

Some hardware is only available in certain places. GPU servers, for example, are offered in Iceland, Romania, Switzerland and the Netherlands, so an AI workload narrows your options immediately. Windows RDP, KVM VPS and dedicated servers are available in all seven.

Legal distance: EU, EEA and non-EU locations

Once you know what you're protecting against, you can think about legal distance: how far your server sits from the legal systems that concern you.

EU member states: Romania and the Netherlands

EU countries share a body of law. The GDPR applies, which gives individuals strong rights over personal data and places real obligations on anyone processing it. EU-wide instruments for cross-border cooperation also apply between member states, so a request from one EU country to another can move through established channels.

That is not automatically a downside. Legal predictability is valuable, and for a business serving EU customers an EU location can make compliance simpler. The two EU locations differ in character:

• Romania offers an EU address with strong domestic fibre and competitive pricing. As our Romania page notes, its constitutional court has struck down blanket data-retention laws more than once. EU-wide legal instruments still apply.
• The Netherlands is about the network. Amsterdam is one of the world's largest internet exchange points, which gives excellent peering and very low latency across Europe. Legally it is a mainstream EU jurisdiction where notice-and-takedown is taken seriously, so it is a poor pick if legal distance is your main goal. See the Netherlands page.

Iceland: EEA but outside the EU

Iceland participates in the European Economic Area without being an EU member. It has a long-standing reputation for protecting journalists and publishers, runs on almost entirely renewable electricity, and has good connectivity to both Europe and North America. Power and transit costs make it pricier than Eastern Europe, and there are fewer carrier options than on mainland hubs.

Non-EU Europe: Switzerland, Moldova and Russia

• Switzerland is the premium option. It has a strong federal data-protection act (the revised FADP, often written revFADP), a stable legal system outside the EU, and foreign requests that generally have to go through Swiss legal channels. It is also our most expensive location, and Swiss law is strict rather than lawless: clearly illegal content is acted on.
• Moldova is our value location. It is not an EU member, connects into Romanian and Ukrainian backbones for solid European reach, and has the lowest prices in the network. Upstream capacity is smaller than at Western hubs, and the regional political situation is worth monitoring if you plan years ahead.
• Russia sits outside EU and US legal frameworks and is inexpensive, with good reach into CIS countries and Central Asia. Domestic law has its own data and content requirements, and international payment and routing conditions can change at short notice. Read the location page carefully before choosing it.

Outside Europe: Panama

Panama is outside both EU and US legal frameworks while staying close to users in the Americas, with good latency to Latin America and the US East Coast. It is a common pick for jurisdictional diversity and for mirrors. Latency to Europe and Asia is higher, and the hardware inventory is smaller than at European hubs.

How cross-border legal requests generally work

A frequent misunderstanding is that an offshore server can't be reached by foreign authorities at all. The reality is more procedural than that.

Countries cooperate on criminal matters through mutual legal assistance treaties (MLATs) and similar agreements. Broadly, an authority in country A that wants records held in country B asks country B's authorities, who assess the request under their own law and, if it qualifies, obtain an order locally. The details vary by treaty and by country, and some countries have no treaty relationship with each other at all.

What this means in practice:

• A foreign request usually has to pass through the hosting country's legal process before it binds a provider there. That adds review, and it adds a second legal standard the request must meet.
• It does not mean a request can never succeed. Serious crimes are exactly what these treaties exist for.
• Within the EU, cooperation between member states is more integrated than between unrelated countries, which is the core of the EU versus non-EU distinction.

The other half of the picture is what a provider can hand over at all. A provider can only disclose records it actually holds. MercureHosting's privacy policy lists them: a contact method, an optional alias, order and payment references, service metadata such as assigned IPs and power state, short-lived edge security logs and support correspondence. It does not log the contents of your server or its traffic. Jurisdiction decides who can ask; data minimisation decides what there is to give.

Latency: the part you can measure

Legal questions involve judgement. Latency you can test. Our location notes give rough round-trip ranges:

• The Netherlands: about 5–20 ms to most of Western Europe
• Switzerland: about 10–25 ms to Western and Central Europe
• Romania: about 25–40 ms to Central Europe
• Moldova: about 30–50 ms to Central Europe
• Russia: about 40–60 ms to Central Europe
• Iceland: about 40–60 ms to Western Europe, 80–100 ms to US East
• Panama: about 40–60 ms to US East, 120 ms or more to Western Europe

These are guides, not promises. Your users' actual experience depends on their ISP, peering and routing on the day.

How much latency matters

For a static website behind sensible caching, an extra 50 ms is barely noticeable. For an interactive application that makes several sequential round trips per page, it compounds. For game servers, trading tools, VoIP or a remote desktop session, it is felt directly: a Windows RDP desktop 120 ms away feels sluggish in a way that one 20 ms away does not. If your project is interactive, weight latency heavily. Our guide to Windows RDP and GPU servers goes into that in more detail.

Test before you commit

Ask a few users, or use machines you already have in your target regions, to measure the path to a test IP in each candidate location. ping gives round-trip time; mtr shows every hop and where loss or delay appears.

# Round-trip time, 20 probes
ping -c 20 203.0.113.10

# Per-hop latency and packet loss, report mode
mtr --report --report-cycles 50 203.0.113.10

# On Windows, the closest equivalents
# ping -n 20 203.0.113.10
# pathping 203.0.113.10

Look at the average and the spread, not only the best result. A path with low average latency but frequent spikes can feel worse than a slightly slower, steady one.

Comparing the seven locations

The table below summarises what we publish about each country. Prices are the entry VPS S plan (2 vCPU, 4 GB RAM) per month before term discounts; longer terms cut the monthly price by up to 50%.

If you'd rather not weigh this by hand, the jurisdiction selector scores each location on privacy, speech, EU latency, US latency and budget and suggests a starting point.

Typical matches

• Publishing, journalism, archives: Iceland or Switzerland, with a mirror in a second country. Our censorship-resistant hosting page covers this pattern.
• Low-latency European APIs and proxies: the Netherlands, or Switzerland if you also want non-EU law.
• EU audience on a budget: Romania.
• Budget projects, VPN endpoints, storage: Moldova.
• Audiences in the Americas: Panama.
• CIS audiences or extra jurisdictional diversity: Russia, after reading its considerations.
• AI inference and fine-tuning: one of the four GPU locations.

The legal limits no jurisdiction removes

This is the part that "offshore" marketing often skips, and it is the most important.

Offshore is not lawless

Every one of the seven countries has laws, courts and police. A server in Switzerland is subject to Swiss law; a server in Panama to Panamanian law. Choosing a country changes which rules apply and how requests arrive. It doesn't create a place with no rules.

The Acceptable Use Policy applies everywhere

Some things are banned in every location regardless of local law. The terms list them: CSAM in any form, malware and botnet infrastructure, phishing and fraud, spam, launching DDoS attacks or unauthorised scanning and exploitation, terrorist content and threats of violence, non-consensual intimate imagery and doxxing, and the sale of goods illegal in the hosting country. Anything illegal where the server sits is also prohibited.

Court orders in the hosting country are followed

MercureHosting complies with valid court orders issued in the jurisdiction where the server is located. Picking a country means accepting that country's courts as the final word on your server.

Your own country's law still applies to you

This is the point people most often miss. Moving a server abroad does not move you abroad. If something is illegal where you live, hosting it elsewhere doesn't make it legal for you to do. Offshore hosting is a tool for privacy, resilience, latency and fair complaint handling, not a way around the law that governs your own actions.

Copyright still exists

Foreign notices, including US DMCA notices, don't trigger automatic takedowns here, because the servers are outside the US and complaints are reviewed under local law. But copyright infringement as defined by the hosting country is still against the AUP. Our explainer on DMCA-ignored hosting covers what that does and doesn't mean.

Practical tips once you've chosen

Run more than one jurisdiction for anything critical

A single server in a single country is a single point of failure, legal or technical. For projects that need to stay up, run a primary in one location and a mirror or warm backup in a second with a different legal setting: for example Iceland plus Panama, or Switzerland plus Moldova. Each server is ordered with its own country, so this is just two orders.

Keep backups outside the server

The terms are clear that you're responsible for your own backups unless you've bought a backup service. Encrypt them before they leave the machine and store them somewhere independent of the server's country.

Think about DNS and your domain separately

Your server's country and your domain's registry are different jurisdictions. A country-code TLD is governed by that country's registry rules, while generic TLDs like .com follow their own registry policies. If resilience matters, consider where your domain is registered and who runs your DNS as carefully as where the server sits. Private domains with WHOIS privacy are available alongside servers.

Match the product to the workload

A KVM VPS covers most projects. If you need single-tenant hardware, full-disk encryption with keys only you hold, or IPMI console access, look at dedicated servers. The jurisdiction logic is the same for both.

Pay in a way that matches your privacy goals

Jurisdiction and checkout are separate decisions. A carefully chosen country doesn't help much if the payment trail ties the server to an identity you wanted to keep separate. Our step-by-step guide to paying for a VPS with crypto explains how top-ups and staff verification work.

A short decision checklist

1. List the regions where most of your users are.
2. Write down what you are protecting against, in one sentence per item.
3. Rule out locations that fail on latency, hardware (GPU) or budget.
4. Among the rest, decide whether you want EU predictability or non-EU distance.
5. Read the considerations on each remaining location page, not just the strengths.
6. Test latency from your users' networks with ping and mtr.
7. Decide whether you need a second jurisdiction for a mirror or backup.
8. Read the terms and privacy policy so you know exactly what applies.

For a shorter version of this framework, see the guide on choosing a hosting jurisdiction, and the offshore hosting overview for how ordering works.

Summary

Choosing an offshore VPS location is a trade between legal setting, latency and cost, shaped by what you're actually protecting against. EU locations bring the GDPR and predictable courts; non-EU locations bring distance from EU-wide instruments; every location brings its own law. Measure latency rather than guessing, consider a second jurisdiction for anything that must stay online, and remember the two constants: the Acceptable Use Policy applies everywhere, and your own country's law still applies to you.