{ "@context": "https://schema.org", "@type": "Dataset", "name": "Incognito VPS jurisdiction legal index", "description": "Structured index of data-retention law, intelligence-alliance membership, EU status, mutual-legal-assistance posture and measured network latency for 16 hosting locations — 8 offshore jurisdictions chosen for their legal properties and 8 mainstream sites chosen for latency — with statute and case citations.", "license": "https://creativecommons.org/licenses/by/4.0/", "creator": { "@type": "Organization", "name": "Incognito VPS", "url": "https://incognitovps.com" }, "dateModified": "2026-09-01", "version": "3.1", "keywords": [ "data retention", "offshore hosting", "Five Eyes", "Nine Eyes", "mutual legal assistance", "jurisdiction", "DMCA", "privacy law" ], "note": "Citations refer to real, verifiable legal instruments. Corrections to ops@incognitovps.com.", "jurisdictions": [ { "country": "Iceland", "iso2": "IS", "city": "Reykjavík", "tier": "privacy", "chosen_for": "legal properties", "coordinates": { "lat": 64.1466, "lon": -21.9426 }, "eu_member": false, "eea_member": true, "eyes_alliance": "none", "us_dmca_direct_effect": false, "eu_investigation_order_applies": false, "legal_instruments": [ { "claim": "No general data-retention obligation applies to hosting providers", "citation": "Act on Electronic Communications No. 70/2022, retention duties limited to telecom operators", "year": 2022 }, { "claim": "Constitutional free-expression protection with narrow, enumerated exceptions", "citation": "Constitution of Iceland, Art. 73 (as amended 1995)", "year": 1995 }, { "claim": "Statutory source protection for journalists and their intermediaries", "citation": "Icelandic Modern Media Initiative (IMMI), Parliamentary Resolution 23/138", "year": 2010 }, { "claim": "Outside EU institutional enforcement; EEA member for trade only", "citation": "EEA Agreement 1994 — no participation in EU judicial-cooperation instruments", "year": 1994 } ], "tradeoff": "The most legally protective address we operate, and the most expensive. Subsea capacity is finite, so bulk-transfer workloads cost more here than anywhere else on the map.", "best_for": [ "Journalism and leak platforms", "Archives and mirrors", "Long-horizon projects", "Renewable-powered GPU training" ], "summary": "Iceland pairs constitutional speech protection with the IMMI source-protection framework and no hosting-level data-retention mandate. It sits outside EU enforcement institutions and runs on 100% hydro and geothermal power. It is the strongest legal posture on our network and priced accordingly.", "latency_ms": { "fra": 41, "lon": 34, "nyc": 51, "sgp": 197, "ams": 38 }, "network": "FARICE-1 + DANICE + IRIS subsea; transit via Arelion & Cogent, RIX peering.", "uplink_gbps": 10, "operating_since": 2020, "price_index": 1.32, "products_available": [ "vps", "dedicated", "gpu", "storage" ], "from_usd_month": { "vps": 5.5, "dedicated": 60.5, "gpu": 157, "storage": 21 } }, { "country": "Switzerland", "iso2": "CH", "city": "Zürich", "tier": "privacy", "chosen_for": "legal properties", "coordinates": { "lat": 47.3769, "lon": 8.5417 }, "eu_member": false, "eea_member": false, "eyes_alliance": "none", "us_dmca_direct_effect": false, "eu_investigation_order_applies": false, "legal_instruments": [ { "claim": "Revised federal data-protection statute with criminal liability for unlawful disclosure", "citation": "Federal Act on Data Protection (nFADP/nLPD), SR 235.1, in force 1 Sep 2023", "year": 2023 }, { "claim": "Foreign requests must run through mutual legal assistance with dual-criminality review", "citation": "Federal Act on International Mutual Assistance in Criminal Matters (IMAC), SR 351.1", "year": 1983 }, { "claim": "Not an EU member; EU directives have no direct effect", "citation": "Bilateral agreements framework — no acquis communautaire transposition", "year": 1999 }, { "claim": "Permanent armed neutrality; no mutual-defence intelligence-sharing obligations", "citation": "Congress of Vienna 1815, reaffirmed in Swiss foreign-policy doctrine", "year": 1815 } ], "tradeoff": "Switzerland is not a takedown-immune jurisdiction. Swiss courts issue orders and we comply with valid Swiss ones. What you buy here is process: dual criminality, judicial review, and a state with no alliance obligation to fast-track a foreign request.", "best_for": [ "Financial and legal data", "Enterprise workloads needing a defensible address", "Encrypted backup vaults", "EU-adjacent latency without EU jurisdiction" ], "summary": "Switzerland offers the revised nFADP data-protection regime, mandatory mutual-legal-assistance process with dual-criminality review, and permanent neutrality. It is the strongest \"defensible in front of a regulator\" address on the network, with 8 ms latency to Frankfurt.", "latency_ms": { "fra": 8, "lon": 21, "nyc": 88, "sgp": 158, "ams": 14 }, "network": "SwissIX + DE-CIX Frankfurt; transit via Init7 and Cogent.", "uplink_gbps": 10, "operating_since": 2020, "price_index": 1.45, "products_available": [ "vps", "dedicated", "storage" ], "from_usd_month": { "vps": 6, "dedicated": 66.5, "storage": 23 } }, { "country": "Netherlands", "iso2": "NL", "city": "Amsterdam", "tier": "privacy", "chosen_for": "legal properties", "coordinates": { "lat": 52.3676, "lon": 4.9041 }, "eu_member": true, "eea_member": true, "eyes_alliance": "nine", "us_dmca_direct_effect": false, "eu_investigation_order_applies": true, "legal_instruments": [ { "claim": "Blanket telecom data retention struck down and never re-enacted", "citation": "District Court of The Hague, C/09/480009 (11 Mar 2015), following CJEU Digital Rights Ireland", "year": 2015 }, { "claim": "Hosting providers benefit from conditional liability exemption (mere conduit / hosting)", "citation": "EU Digital Services Act (Reg. 2022/2065), Art. 6 — successor to e-Commerce Directive Art. 14", "year": 2024 }, { "claim": "US DMCA §512 has no direct legal effect; notices are handled under Dutch NTD code of conduct", "citation": "Dutch Notice-and-Takedown Code of Conduct (2008, revised 2018)", "year": 2018 }, { "claim": "Member of the Nine Eyes intelligence-sharing arrangement", "citation": "SIGINT Seniors Europe — publicly documented", "year": 1982 } ], "tradeoff": "The fastest, best-connected address we sell — and the one with the most enforcement exposure. The Netherlands is an EU member and a Nine Eyes participant. Pick it for network quality, not for legal distance.", "best_for": [ "Anything latency-sensitive in Europe", "CDN origins and mirrors", "Game servers", "High-throughput transfer" ], "summary": "Amsterdam gives you AMS-IX-grade peering with over 1,100 direct adjacencies and 25 Gbps uplinks. Dutch blanket data retention was struck down in 2015 and never restored, and US DMCA notices carry no direct legal force. The trade-off is EU membership and Nine Eyes participation.", "latency_ms": { "fra": 7, "lon": 8, "nyc": 74, "sgp": 165, "ams": 1 }, "network": "AMS-IX (400G) + NL-ix + Speed-IX; transit via NTT, Arelion, Lumen. 1,100+ direct peers.", "uplink_gbps": 25, "operating_since": 2020, "price_index": 1.16, "products_available": [ "vps", "dedicated", "gpu", "rdp", "storage" ], "from_usd_month": { "vps": 4.5, "dedicated": 53.5, "gpu": 138, "rdp": 11, "storage": 18.5 } }, { "country": "Romania", "iso2": "RO", "city": "Bucharest", "tier": "privacy", "chosen_for": "legal properties", "coordinates": { "lat": 44.4268, "lon": 26.1025 }, "eu_member": true, "eea_member": true, "eyes_alliance": "none", "us_dmca_direct_effect": false, "eu_investigation_order_applies": true, "legal_instruments": [ { "claim": "Data-retention law struck down as unconstitutional — twice", "citation": "Constitutional Court Decision 1258/2009 and Decision 440/2014", "year": 2014 }, { "claim": "Follow-up retention bill also declared unconstitutional", "citation": "Constitutional Court Decision 461/2014 on Law 82/2012 replacement", "year": 2014 }, { "claim": "Hosting liability exemption under the DSA regime", "citation": "EU Digital Services Act (Reg. 2022/2065), Art. 6", "year": 2024 }, { "claim": "Not a member of any Eyes intelligence-sharing tier", "citation": "No documented SIGINT Seniors participation", "year": 2024 } ], "tradeoff": "EU membership means EU instruments — European Investigation Orders reach Bucharest. What Romania gives you is a constitutional court that has twice refused to let the state retain communications data, plus very good price-per-core.", "best_for": [ "Price-sensitive European workloads", "Node hosting", "Windows RDP", "GPU inference at EU latency" ], "summary": "Romania is the only EU jurisdiction where the constitutional court struck down mandatory data retention twice, in 2009 and again in 2014, and refused the replacement bill. It combines that precedent with EU-grade connectivity and the lowest cost per core in our EU footprint.", "latency_ms": { "fra": 29, "lon": 41, "nyc": 112, "sgp": 148, "ams": 33 }, "network": "InterLAN + RONIX + Balkan-IX; transit via GTT and Cogent.", "uplink_gbps": 10, "operating_since": 2021, "price_index": 1.06, "products_available": [ "vps", "dedicated", "gpu", "rdp", "storage" ], "from_usd_month": { "vps": 4, "dedicated": 49, "gpu": 126, "rdp": 10, "storage": 17 } }, { "country": "Bulgaria", "iso2": "BG", "city": "Sofia", "tier": "privacy", "chosen_for": "legal properties", "coordinates": { "lat": 42.6977, "lon": 23.3219 }, "eu_member": true, "eea_member": true, "eyes_alliance": "none", "us_dmca_direct_effect": false, "eu_investigation_order_applies": true, "legal_instruments": [ { "claim": "Blanket retention provisions annulled as unconstitutional", "citation": "Constitutional Court Decision No. 2 of 12 Mar 2015, case 8/2014", "year": 2015 }, { "claim": "Retention now requires prior judicial authorisation per request", "citation": "Electronic Communications Act, Art. 251b as amended post-2015", "year": 2015 }, { "claim": "Hosting liability exemption under the DSA regime", "citation": "EU Digital Services Act (Reg. 2022/2065), Art. 6", "year": 2024 }, { "claim": "Not a member of any Eyes intelligence-sharing tier", "citation": "No documented SIGINT Seniors participation", "year": 2024 } ], "tradeoff": "Cheapest euro-adjacent capacity we operate and a real anti-retention precedent, but it is still an EU member state with full mutual-recognition obligations. Transit is thinner than Amsterdam.", "best_for": [ "Budget VPS fleets", "CI runners and build farms", "Staging environments", "Bulk storage in the EU" ], "summary": "Sofia is our lowest-cost location. Bulgaria annulled blanket retention in 2015 and now requires per-request judicial authorisation. Good Frankfurt path at 34 ms, EU jurisdiction, and the best price per gigabyte of NVMe on the network.", "latency_ms": { "fra": 34, "lon": 47, "nyc": 118, "sgp": 143, "ams": 38 }, "network": "BIX.BG + Balkan-IX; transit via Neterra and Cogent, direct path to Frankfurt.", "uplink_gbps": 10, "operating_since": 2022, "price_index": 1, "products_available": [ "vps", "dedicated", "rdp", "storage" ], "from_usd_month": { "vps": 4, "dedicated": 46, "rdp": 9.5, "storage": 16 } }, { "country": "Moldova", "iso2": "MD", "city": "Chișinău", "tier": "privacy", "chosen_for": "legal properties", "coordinates": { "lat": 47.0105, "lon": 28.8638 }, "eu_member": false, "eea_member": false, "eyes_alliance": "none", "us_dmca_direct_effect": false, "eu_investigation_order_applies": false, "legal_instruments": [ { "claim": "Non-EU state — EU instruments including European Investigation Orders do not apply", "citation": "EU candidate status granted 2022; no acquis transposition, no judicial-cooperation membership", "year": 2022 }, { "claim": "No general data-retention mandate on hosting providers", "citation": "Law No. 241/2007 on Electronic Communications — retention duties scoped to operators", "year": 2007 }, { "claim": "US copyright law has no extraterritorial force; no bilateral IP-enforcement treaty", "citation": "Law No. 139/2010 on Copyright — domestic procedure only", "year": 2010 }, { "claim": "Not a member of any Eyes intelligence-sharing tier", "citation": "No documented SIGINT Seniors participation", "year": 2024 } ], "tradeoff": "Real legal distance from both Brussels and Washington at a low price. In exchange: thinner transit, a smaller local operations market, and a country actively negotiating EU accession — the legal picture here has a five-year horizon, not a twenty-year one.", "best_for": [ "Cost-sensitive privacy workloads", "Mirrors and backup targets", "Tor relays and bridges", "Proxy endpoints" ], "summary": "Moldova sits outside the EU legal perimeter — European Investigation Orders and DSA obligations do not reach it — while remaining 42 ms from Frankfurt. There is no hosting-level retention mandate and no bilateral copyright-enforcement treaty with the United States.", "latency_ms": { "fra": 42, "lon": 54, "nyc": 124, "sgp": 152, "ams": 46 }, "network": "MD-IX + direct Bucharest and Frankfurt paths; transit via StarNet and Cogent.", "uplink_gbps": 10, "operating_since": 2021, "price_index": 1.02, "products_available": [ "vps", "dedicated", "gpu", "rdp", "storage" ], "from_usd_month": { "vps": 4, "dedicated": 47, "gpu": 121.5, "rdp": 9.5, "storage": 16.5 } }, { "country": "Panama", "iso2": "PA", "city": "Panama City", "tier": "privacy", "chosen_for": "legal properties", "coordinates": { "lat": 8.9824, "lon": -79.5199 }, "eu_member": false, "eea_member": false, "eyes_alliance": "none", "us_dmca_direct_effect": false, "eu_investigation_order_applies": false, "legal_instruments": [ { "claim": "Constitutional protection of private communications requiring judicial authorisation", "citation": "Political Constitution of Panama, Art. 29", "year": 2004 }, { "claim": "No general data-retention statute covering hosting providers", "citation": "Law 51 of 2009 on electronic documents — no retention mandate for hosts", "year": 2009 }, { "claim": "No mutual legal assistance treaty in force with most EU member states", "citation": "Panama MLAT register — bilateral treaties limited; requests route through letters rogatory", "year": 2024 }, { "claim": "Personal-data statute modelled on GDPR principles with local enforcement only", "citation": "Law 81 of 2019 on Personal Data Protection, in force March 2021", "year": 2021 } ], "tradeoff": "Genuine legal distance from Europe, and the letters-rogatory route is slow by design. But Panama does have an MLAT with the United States, so it is the wrong choice if your threat model points at Washington. Latency to Europe is 130 ms.", "best_for": [ "Latin-American latency", "Legal separation from the EU", "Cold archives", "Redundancy outside Europe" ], "summary": "Panama has constitutional communications-privacy protection, no hosting-level retention statute, and no MLAT in force with most EU member states — foreign requests fall back to letters rogatory. Note the existing US MLAT: this is distance from Brussels, not from Washington.", "latency_ms": { "fra": 132, "lon": 128, "nyc": 61, "sgp": 218, "ams": 130 }, "network": "Direct subsea landing (MAYA-1, PCCS, ARCOS-1); transit via Liberty Networks and Cogent.", "uplink_gbps": 10, "operating_since": 2021, "price_index": 1.24, "products_available": [ "vps", "dedicated", "storage" ], "from_usd_month": { "vps": 5, "dedicated": 57, "storage": 20 } }, { "country": "Russia", "iso2": "RU", "city": "Moscow", "tier": "privacy", "chosen_for": "legal properties", "coordinates": { "lat": 55.7558, "lon": 37.6173 }, "eu_member": false, "eea_member": false, "eyes_alliance": "none", "us_dmca_direct_effect": false, "eu_investigation_order_applies": false, "legal_instruments": [ { "claim": "EU and US court orders have no enforcement path; MLAT cooperation suspended since 2022", "citation": "Council of Europe expulsion, 16 Mar 2022 — Russia ceased to be a party to CoE conventions", "year": 2022 }, { "claim": "US DMCA and EU DSA carry no legal force in Russian courts", "citation": "Civil Code Part IV — domestic copyright procedure only", "year": 2008 }, { "claim": "Data-localisation duty applies to Russian citizens’ personal data", "citation": "Federal Law 242-FZ on personal data localisation", "year": 2015 }, { "claim": "SORM lawful-interception infrastructure is mandatory for operators", "citation": "Federal Law 374-FZ (\"Yarovaya package\")", "year": 2016 } ], "tradeoff": "We publish this one straight because the honest version is the useful version: Russia removes Western legal reach and replaces it with Russian legal reach, including SORM interception obligations at the operator level. It is the right answer for a narrow threat model and the wrong answer for a general one. Assume network-level observation and encrypt accordingly.", "best_for": [ "Workloads whose adversary is exclusively Western", "CIS-region latency", "Regional mirrors" ], "summary": "Russia is outside every Western enforcement channel — Council of Europe cooperation ended in 2022 and neither DMCA nor DSA has force there. In exchange, Russian law applies in full, including mandatory SORM interception at the operator level. Choose it only when your threat model is specifically Western.", "latency_ms": { "fra": 38, "lon": 47, "nyc": 121, "sgp": 174, "ams": 42 }, "network": "MSK-IX + DATA-IX; transit via Rostelecom and RETN, direct Frankfurt path.", "uplink_gbps": 10, "operating_since": 2022, "price_index": 1.02, "products_available": [ "vps", "dedicated", "rdp" ], "from_usd_month": { "vps": 4, "dedicated": 47, "rdp": 9.5 } }, { "country": "France", "iso2": "FR", "city": "Paris", "tier": "performance", "chosen_for": "latency and peering", "coordinates": { "lat": 48.8566, "lon": 2.3522 }, "eu_member": true, "eea_member": true, "eyes_alliance": "nine", "us_dmca_direct_effect": false, "eu_investigation_order_applies": true, "legal_instruments": [ { "claim": "Connection-data retention is mandatory and applies to hosting providers", "citation": "Code des postes et des communications électroniques, art. L.34-1; Decree 2021-1362", "year": 2021 }, { "claim": "General retention upheld for national-security purposes", "citation": "Conseil d’État, French Data Network and others, decision no. 393099", "year": 2021 }, { "claim": "Hosting providers must remove manifestly unlawful content on notification", "citation": "Loi pour la confiance dans l’économie numérique (LCEN) 2004-575, art. 6", "year": 2004 }, { "claim": "Intelligence services may require algorithmic traffic analysis at operators", "citation": "Loi relative au renseignement 2015-912", "year": 2015 } ], "tradeoff": "This is a latency choice, not a legal one. France participates in the Nine Eyes tier, imposes connection-data retention that reaches hosting providers, and is fully inside EU judicial cooperation — a European Investigation Order arrives here without friction. Pick Paris because your users are in Western Europe and 9 ms to Amsterdam matters. If jurisdiction is what you are buying, buy Iceland or Switzerland instead.", "best_for": [ "Latency-critical French and Benelux audiences", "Low-latency game servers", "CDN origins", "Workloads with no jurisdictional requirement" ], "summary": "Paris is our lowest-latency Western European site, 9 ms from Amsterdam and 8 ms from London, on France-IX and DE-CIX Paris. It is not a privacy jurisdiction: France sits in the Nine Eyes tier, mandates connection-data retention that reaches hosts, and is fully within EU judicial cooperation. Choose it for speed, not for legal distance.", "latency_ms": { "fra": 11, "lon": 8, "nyc": 76, "sgp": 162, "ams": 9 }, "network": "France-IX and DE-CIX Paris peering; transit via Cogent, Arelion and Orange.", "uplink_gbps": 25, "operating_since": 2023, "price_index": 1.12, "products_available": [ "vps", "dedicated", "gpu", "rdp", "storage" ], "from_usd_month": { "vps": 4.5, "dedicated": 51.5, "gpu": 133.5, "rdp": 10.5, "storage": 18 } }, { "country": "United Kingdom", "iso2": "GB", "city": "London", "tier": "performance", "chosen_for": "latency and peering", "coordinates": { "lat": 51.5074, "lon": -0.1278 }, "eu_member": false, "eea_member": false, "eyes_alliance": "five", "us_dmca_direct_effect": false, "eu_investigation_order_applies": false, "legal_instruments": [ { "claim": "Retention notices may compel operators to keep communications data for 12 months", "citation": "Investigatory Powers Act 2016, Part 4", "year": 2016 }, { "claim": "Technical capability notices may require removal of electronic protection", "citation": "Investigatory Powers Act 2016, s.253", "year": 2016 }, { "claim": "Failure to disclose a decryption key on notice is a criminal offence", "citation": "Regulation of Investigatory Powers Act 2000, Part III, s.49–s.53", "year": 2000 }, { "claim": "Outside EU judicial cooperation since Brexit; UK GDPR applies domestically", "citation": "Data Protection Act 2018 as amended by the EU (Withdrawal) Act 2018", "year": 2021 } ], "tradeoff": "The most legally intrusive address we operate, and we would rather say it than bury it. The United Kingdom is a founding Five Eyes member, the Investigatory Powers Act permits retention notices and technical capability notices, and RIPA Part III makes refusing to hand over a decryption key a criminal offence. London is here for its transit position — 1 ms local, 7 ms to Amsterdam, 71 ms to New York. Nothing about it is a privacy argument.", "best_for": [ "UK-facing latency", "Financial-market proximity", "Transatlantic transit", "Workloads with no jurisdictional requirement" ], "summary": "London sits on LINX and LONAP with 7 ms to Amsterdam and 71 ms to New York, which is why it is on the map. Legally it is the weakest position we offer: Five Eyes membership, retention and technical capability notices under the Investigatory Powers Act, and a criminal offence for refusing to disclose a decryption key under RIPA Part III.", "latency_ms": { "fra": 14, "lon": 1, "nyc": 71, "sgp": 168, "ams": 7 }, "network": "LINX and LONAP peering; transit via Arelion, Cogent and Lumen.", "uplink_gbps": 25, "operating_since": 2023, "price_index": 1.18, "products_available": [ "vps", "dedicated", "rdp", "storage" ], "from_usd_month": { "vps": 4.5, "dedicated": 54.5, "rdp": 11, "storage": 19 } }, { "country": "Germany", "iso2": "DE", "city": "Frankfurt", "tier": "performance", "chosen_for": "latency and peering", "coordinates": { "lat": 50.1109, "lon": 8.6821 }, "eu_member": true, "eea_member": true, "eyes_alliance": "fourteen", "us_dmca_direct_effect": false, "eu_investigation_order_applies": true, "legal_instruments": [ { "claim": "General data retention struck down as unconstitutional and unenforced since", "citation": "Bundesverfassungsgericht, 1 BvR 256/08", "year": 2010 }, { "claim": "German general retention held contrary to EU law by the Court of Justice", "citation": "CJEU C-793/19 and C-794/19, SpaceNet and Telekom Deutschland", "year": 2022 }, { "claim": "Constitutional secrecy of telecommunications, subject to statutory limits", "citation": "Grundgesetz, Art. 10", "year": 1949 }, { "claim": "Platform takedown duties for manifestly unlawful content within 24 hours", "citation": "Netzwerkdurchsetzungsgesetz (NetzDG)", "year": 2017 } ], "tradeoff": "The best network position in Europe and a genuinely mixed legal picture. Germany has no enforceable general retention mandate — the Constitutional Court struck it down in 2010 and the CJEU confirmed in 2022 — and Art. 10 of the Grundgesetz protects telecommunications secrecy. Against that: Fourteen Eyes participation and full EU judicial cooperation, so a European Investigation Order reaches Frankfurt directly. Better than Paris or London on paper, still not a substitute for Zürich.", "best_for": [ "Peering-sensitive workloads", "European CDN origins", "GPU training with EU latency", "Bulk transfer" ], "summary": "Frankfurt sits on DE-CIX, the largest exchange point in the world by peak traffic, at 1 ms local and 7 ms to Amsterdam. Germany has no enforceable general retention mandate after the Constitutional Court struck it down and the CJEU confirmed, and Art. 10 of the Grundgesetz protects telecommunications secrecy — but it remains a Fourteen Eyes participant inside EU judicial cooperation.", "latency_ms": { "fra": 1, "lon": 14, "nyc": 84, "sgp": 155, "ams": 7 }, "network": "DE-CIX Frankfurt, the largest exchange point in the world by peak traffic; transit via Arelion, Cogent and Telia.", "uplink_gbps": 40, "operating_since": 2023, "price_index": 1.08, "products_available": [ "vps", "dedicated", "gpu", "rdp", "storage" ], "from_usd_month": { "vps": 4.5, "dedicated": 49.5, "gpu": 128.5, "rdp": 10.5, "storage": 17.5 } }, { "country": "United States", "iso2": "US", "city": "New York", "tier": "performance", "chosen_for": "latency and peering", "coordinates": { "lat": 40.7128, "lon": -74.006 }, "eu_member": false, "eea_member": false, "eyes_alliance": "five", "us_dmca_direct_effect": true, "eu_investigation_order_applies": false, "legal_instruments": [ { "claim": "No federal general data-retention mandate applies to hosting providers", "citation": "No enacted federal statute; retention is contractual, not compulsory", "year": 2026 }, { "claim": "Providers must disclose data under warrant regardless of where it is stored", "citation": "CLOUD Act, 18 U.S.C. § 2713", "year": 2018 }, { "claim": "Foreign-intelligence collection from US providers without individual warrants", "citation": "FISA Amendments Act § 702, 50 U.S.C. § 1881a", "year": 2008 }, { "claim": "Copyright takedown regime applies directly, with safe harbour for compliant hosts", "citation": "Digital Millennium Copyright Act, 17 U.S.C. § 512", "year": 1998 } ], "tradeoff": "Every reason our other pages exist. The United States leads Five Eyes, the CLOUD Act compels disclosure of data wherever it is physically stored, FISA § 702 permits collection from US providers without individual warrants, and the DMCA applies here with full force rather than as a letter you can ignore. New York is on the map because 1 ms to Manhattan and 71 ms to London is what some workloads need. If your threat model includes a copyright claimant, this is the one address on our network where they win by default.", "best_for": [ "North American latency", "US-facing SaaS", "GPU inference near US users", "Workloads with no jurisdictional requirement" ], "summary": "New York gives 1 ms local latency and 71 ms to London on DE-CIX New York and NYIIX. It is the least protective address we operate: Five Eyes leadership, CLOUD Act disclosure duties reaching data stored anywhere, FISA § 702 collection, and the DMCA applying directly rather than as a foreign notice. Choose it for proximity to US users and nothing else.", "latency_ms": { "fra": 84, "lon": 71, "nyc": 1, "sgp": 214, "ams": 76 }, "network": "DE-CIX New York and NYIIX peering; transit via Lumen, Cogent and Zayo.", "uplink_gbps": 40, "operating_since": 2024, "price_index": 1.15, "products_available": [ "vps", "dedicated", "gpu", "rdp", "storage" ], "from_usd_month": { "vps": 4.5, "dedicated": 53, "gpu": 137, "rdp": 11, "storage": 18.5 } }, { "country": "Canada", "iso2": "CA", "city": "Toronto", "tier": "performance", "chosen_for": "latency and peering", "coordinates": { "lat": 43.6532, "lon": -79.3832 }, "eu_member": false, "eea_member": false, "eyes_alliance": "five", "us_dmca_direct_effect": false, "eu_investigation_order_applies": false, "legal_instruments": [ { "claim": "No general data-retention mandate for hosting providers", "citation": "PIPEDA imposes minimisation duties, not retention duties", "year": 2000 }, { "claim": "Copyright notices are forwarded, not enforced — no takedown obligation", "citation": "Copyright Act, s.41.25–41.26 (notice-and-notice regime)", "year": 2015 }, { "claim": "Signals-intelligence agency operates under statutory foreign-intelligence mandate", "citation": "Communications Security Establishment Act (Bill C-59)", "year": 2019 }, { "claim": "Production orders available to law enforcement on judicial authorisation", "citation": "Criminal Code, s.487.014–487.018", "year": 2014 } ], "tradeoff": "A Five Eyes country with one genuinely useful property: the notice-and-notice regime obliges a host to forward a copyright complaint to the customer, not to remove the content. That makes Toronto materially calmer than New York for the most common complaint type, without making it private — CSE operates under a foreign-intelligence mandate and Canada is a founding Five Eyes member. Good North American latency, mild copyright posture, no jurisdictional protection.", "best_for": [ "North American latency outside the US", "Seedboxes with a mild copyright profile", "Backup targets near US users" ], "summary": "Toronto sits on TorIX with 12 ms to New York and 79 ms to London. Canada has no general retention mandate and runs a notice-and-notice copyright regime — hosts forward complaints instead of removing content — which makes it calmer than the United States for routine notices. It remains a founding Five Eyes member, so treat it as a latency choice.", "latency_ms": { "fra": 92, "lon": 79, "nyc": 12, "sgp": 226, "ams": 85 }, "network": "TorIX peering, the largest exchange in Canada; transit via Cogent, Zayo and Bell.", "uplink_gbps": 25, "operating_since": 2024, "price_index": 1.14, "products_available": [ "vps", "dedicated", "rdp", "storage" ], "from_usd_month": { "vps": 4.5, "dedicated": 52.5, "rdp": 11, "storage": 18 } }, { "country": "Singapore", "iso2": "SG", "city": "Singapore", "tier": "performance", "chosen_for": "latency and peering", "coordinates": { "lat": 1.3521, "lon": 103.8198 }, "eu_member": false, "eea_member": false, "eyes_alliance": "none", "us_dmca_direct_effect": false, "eu_investigation_order_applies": false, "legal_instruments": [ { "claim": "No documented participation in any Eyes intelligence-sharing tier", "citation": "No published agreement; cooperation is bilateral and case-by-case", "year": 2026 }, { "claim": "Government may order correction or removal of online statements", "citation": "Protection from Online Falsehoods and Manipulation Act (POFMA)", "year": 2019 }, { "claim": "Designated service providers face binding cybersecurity and audit duties", "citation": "Cybersecurity Act 2018, Parts 3–5", "year": 2018 }, { "claim": "Personal-data protection with consent and purpose limitation", "citation": "Personal Data Protection Act (PDPA) 2012", "year": 2012 } ], "tradeoff": "The best latency in Asia-Pacific and a state with a strong appetite for content regulation. Singapore is not in any Eyes tier and the PDPA is a real data-protection statute, but POFMA gives the executive direct power to order corrections and removals, and the Cybersecurity Act imposes binding duties on designated providers. Excellent for reaching Asian users, poor for publishing anything a government might dispute.", "best_for": [ "Asia-Pacific latency", "Regional game servers", "GPU inference for Asian users", "APAC CDN origins" ], "summary": "Singapore is our Asia-Pacific site on SGIX and Equinix, at 1 ms locally and 155 ms to Frankfurt. It sits in no Eyes tier and the PDPA is a genuine data-protection statute, but POFMA lets the executive order corrections and removals of online statements. Take it for reach into Asia, not for editorial freedom.", "latency_ms": { "fra": 155, "lon": 168, "nyc": 214, "sgp": 1, "ams": 158 }, "network": "SGIX and Equinix Singapore peering; transit via Singtel, Arelion and NTT.", "uplink_gbps": 25, "operating_since": 2024, "price_index": 1.34, "products_available": [ "vps", "dedicated", "gpu", "storage" ], "from_usd_month": { "vps": 5.5, "dedicated": 61.5, "gpu": 159.5, "storage": 21.5 } }, { "country": "Japan", "iso2": "JP", "city": "Tokyo", "tier": "performance", "chosen_for": "latency and peering", "coordinates": { "lat": 35.6762, "lon": 139.6503 }, "eu_member": false, "eea_member": false, "eyes_alliance": "none", "us_dmca_direct_effect": false, "eu_investigation_order_applies": false, "legal_instruments": [ { "claim": "Constitutional secrecy of communications with narrow statutory exceptions", "citation": "Constitution of Japan, Art. 21(2)", "year": 1947 }, { "claim": "No general data-retention mandate for hosting providers", "citation": "Telecommunications Business Act imposes secrecy duties, not retention", "year": 1984 }, { "claim": "Provider liability limited, with a defined disclosure procedure for claimants", "citation": "Act on the Limitation of Liability for Damages of Specified Telecommunications Service Providers", "year": 2001 }, { "claim": "Personal-data protection with cross-border transfer restrictions", "citation": "Act on the Protection of Personal Information (APPI), as amended", "year": 2020 } ], "tradeoff": "Legally the strongest of our performance sites and the most expensive. Japan protects secrecy of communications at constitutional level, has no general retention mandate, and is in no Eyes tier. What it does not give you is distance from a determined claimant: the Provider Liability Limitation Act sets out a working disclosure procedure, and Japan cooperates readily with Western law enforcement through mutual legal assistance. Also 224 ms from Frankfurt — this is a site for Asian users, not a European hedge.", "best_for": [ "East Asian latency", "Japanese-market services", "Regional mirrors", "Low-latency APAC gaming" ], "summary": "Tokyo runs on JPIX and BBIX at 71 ms to Singapore and 168 ms to New York. Japan protects secrecy of communications constitutionally, imposes no general retention duty and joins no Eyes tier — the strongest legal position among our performance sites — but it cooperates readily through mutual legal assistance and has a defined claimant disclosure procedure.", "latency_ms": { "fra": 224, "lon": 232, "nyc": 168, "sgp": 71, "ams": 228 }, "network": "JPIX and BBIX peering; transit via NTT, IIJ and Arelion.", "uplink_gbps": 25, "operating_since": 2025, "price_index": 1.38, "products_available": [ "vps", "dedicated", "gpu", "storage" ], "from_usd_month": { "vps": 5.5, "dedicated": 63.5, "gpu": 164, "storage": 22 } }, { "country": "Australia", "iso2": "AU", "city": "Sydney", "tier": "performance", "chosen_for": "latency and peering", "coordinates": { "lat": -33.8688, "lon": 151.2093 }, "eu_member": false, "eea_member": false, "eyes_alliance": "five", "us_dmca_direct_effect": false, "eu_investigation_order_applies": false, "legal_instruments": [ { "claim": "Two-year mandatory retention of telecommunications metadata", "citation": "Telecommunications (Interception and Access) Act 1979, Part 5-1A", "year": 2015 }, { "claim": "Providers may be compelled to assist with access to encrypted communications", "citation": "Telecommunications and Other Legislation Amendment (Assistance and Access) Act", "year": 2018 }, { "claim": "Founding Five Eyes participant under the UKUSA arrangement", "citation": "UKUSA Agreement, declassified 2010", "year": 1956 }, { "claim": "Privacy Act imposes handling duties on organisations above a turnover threshold", "citation": "Privacy Act 1988, Australian Privacy Principles", "year": 1988 } ], "tradeoff": "Oceania coverage with the second-weakest legal posture on the network. Australia mandates two years of telecommunications metadata retention and, under the 2018 Assistance and Access Act, can compel providers to help access encrypted communications — a power with no equivalent in any of our privacy jurisdictions. It is a Five Eyes founding participant. Sydney exists because 94 ms to Singapore and local latency for Australian users cannot be bought anywhere else on this map.", "best_for": [ "Australian and New Zealand latency", "Oceania game servers", "Regional backup targets" ], "summary": "Sydney covers Oceania on IX Australia at 94 ms to Singapore and 205 ms to New York. Legally it is near the bottom of our range: two-year mandatory metadata retention, Five Eyes founding membership, and powers under the 2018 Assistance and Access Act to compel provider assistance with encrypted communications. A latency choice only.", "latency_ms": { "fra": 258, "lon": 264, "nyc": 205, "sgp": 94, "ams": 261 }, "network": "IX Australia NSW peering; transit via Telstra, Vocus and Arelion.", "uplink_gbps": 20, "operating_since": 2025, "price_index": 1.41, "products_available": [ "vps", "dedicated", "rdp", "storage" ], "from_usd_month": { "vps": 5.5, "dedicated": 65, "rdp": 13.5, "storage": 22.5 } } ] }