Choosing an offshore jurisdiction

Start from the adversary, not from the map

Almost every jurisdiction guide begins with a list of countries and their attractive properties. That is backwards, and it is why people end up paying an Iceland premium for a workload whose only realistic risk is an automated copyright notice.

Write down who you are actually worried about. There are four broad answers, they call for different countries, and three of them are much cheaper to satisfy than the marketing suggests.

Adversary 1: an automated copyright claimant

This is by far the most common case and the easiest to solve. Enforcement agencies send high volumes of automated notices citing US statute. Those notices have no legal force outside the United States, and a claimant who wants a result must bring a real claim in the country where the server sits.

Any of our eight locations defeats this. Since they all do, optimise for something else — price and latency. Bulgaria at index 1.00 or Moldova at 1.02 are the rational choices, and paying the Iceland premium here buys you nothing you did not already have.

Adversary 2: a civil claimant or a regulator

Here the instrument matters. Inside the EU, a European Investigation Order moves between member states quickly with narrow refusal grounds. Outside it, a claimant needs mutual legal assistance or letters rogatory, which take months and can be refused outright.

Switzerland is the strongest answer because the IMAC framework requires dual criminality — the conduct must be an offence under Swiss law too, which filters out a large category of foreign claims before they start. Panama is the strongest by pure friction, since no MLAT is in force with most EU member states and requests fall back to letters rogatory.

Adversary 3: a hostile local state

If you are publishing about a government that can reach you physically, the jurisdiction question is about distance from that specific state, not about privacy in the abstract. Iceland is the strongest general answer thanks to the IMMI framework and constitutional speech protection.

The important corollary is that the server is the easy part. Your own operational security — how you connect, what you write from where, who knows the project is yours — is where this threat model is actually won or lost.

Adversary 4: a signals-intelligence agency

No hosting jurisdiction solves this, and any provider implying otherwise is taking your money for a feeling. An agency with network-level access does not need to serve your host with anything.

What actually helps: end-to-end encryption, full-disk encryption with a key we never see, minimising what the server knows, and assuming the network is observed. Choose the jurisdiction for the other three adversaries and spend your remaining effort on cryptography.

A short decision table

Compressed to something you can act on in thirty seconds:

Two mistakes that are easy to avoid

The first is treating company registration as jurisdiction. Where a company is incorporated has little to do with which police force can enter the building the server is in. Physical location governs seizure; registration governs corporate law.

The second is putting everything in one country. Whatever the legal properties, a single jurisdiction is a single point of failure. Keep your primary where it performs best and your encrypted backups somewhere with different legal exposure — that combination survives events that either location alone would not.