How to choose an offshore jurisdiction (a decision procedure)

The most expensive mistake in offshore hosting is not picking the wrong provider. It is picking the wrong jurisdiction — paying a 40% premium and 140 ms of latency for protection against a threat you do not face, or paying nothing extra and discovering your "offshore" server is subject to the exact regime you were trying to avoid.

Here is a procedure that produces a defensible answer in about five minutes.

Question 1: What is the actual adversary?

Write it down in one sentence. If you cannot, the answer is Romania and you can stop reading — it is the sensible default and you will not regret it.

If you can, it will be one of roughly five:

• Data brokers, marketing databases, provider breaches. Any of our locations solves this, because the data was never collected. Choose on latency and price alone.
• Automated copyright enforcement. Any of the 4 DMCA-ignored locations — Iceland, Moldova, Panama and Seychelles — where a notice arrives with nothing behind it. Our EU sites (the Netherlands, Romania and Bulgaria) are cheaper and closer, and a bulk notice does nothing there either, but the Digital Services Act means a substantiated complaint still gets assessed. If the adversary is a bot sending notices in volume, either group works; if it is a rights holder who will do the work properly, only the first does.
• A civil litigant in a specific country. Choose a jurisdiction with no reciprocal enforcement of that country's judgments. For US plaintiffs, Panama or Seychelles.
• Legal pressure aimed at journalism or publishing. Iceland — on the strength of two Acts you can look up: the Media Act No. 38/2011, which protects sources, and Act No. 30/2002, which makes a takedown wait for a court injunction. If you have seen Iceland recommended on other grounds, the location page says which of those grounds survive checking.
• State-level, targeted at you specifically. No hosting provider can help you, and any that claims to is selling something. Read about compartmentalisation instead.

Question 2: Where are your users?

Latency is the cost you pay daily; jurisdiction is the benefit you might never draw on. Do not sacrifice the first for the second unless question 1 gave you a reason.

• Western Europe → Amsterdam
• Eastern Europe, Turkey, the Balkans → Bucharest or Sofia
• North America → Kansas City if jurisdiction does not matter, Reykjavík if it does
• Latin America → Panama City
• Middle East, South Asia → Victoria

Every location page publishes a ping target. Measure rather than trusting the table, including this one.

Question 3: Does EU membership help or hurt you?

This is the question people skip, and it cuts both ways.

EU membership helps if you have European users and GDPR obligations of your own — hosting inside the EU removes the transfer-mechanism problem entirely. The Netherlands, Romania and Bulgaria give you that and no US takedown clock, which is why they are the pragmatic default. What they do not give you is a site we can call DMCA-ignored: the Digital Services Act applies in all 3, and a substantiated complaint gets assessed.

EU membership hurts if your concern includes European legal cooperation. EU member states have well-developed mutual assistance frameworks; a European order travels between member states far more easily than it travels to Chișinău or Victoria. If that is your threat model, leave the EU: Moldova, Panama, Seychelles.

Question 4: What can you actually afford?

The price index is real and reflects transit cost, not markup. Amsterdam is the ×1.00 baseline. Kansas City is ×0.95. Seychelles is ×1.40 because bandwidth on an island genuinely costs that much more.

On our Standard configuration that is $8.90 versus $12.46 per month. Not enormous in absolute terms — but paying it for protection you do not need is still waste, and the latency is not refundable.

A worked example

A journalist hosting a document archive, users mostly in Europe, concerned about legal pressure from a corporate subject.

1. Adversary: civil legal pressure aimed at publishing. → Iceland's Media Act (No. 38/2011) source-protection provisions are directly on point.
2. Users: Europe. Reykjavík is 21 ms from London and 27 ms from Amsterdam. Acceptable.
3. EU: Iceland is EEA but not EU, so the Digital Services Act does not reach it and no EU-level instrument decides what happens to a complaint. Do not stretch that into 'Iceland has no retention law' — it has one of its own, aimed at the companies carrying the traffic, and the location page says what we will and will not claim about its reach. Helpful here, just less sweeping than the shorthand suggests.
4. Price: ×1.20. A $8.90 configuration becomes $10.68. Worth it for this use case.

Answer: Iceland. Reached in four questions, and defensible if someone asks why.

The counter-example nobody wants to hear

A developer running a personal VPN and a Nextcloud instance, who is worried about "surveillance" in general.

Question 1 does not produce a specific adversary. The honest answer is Romania at ×1.05, or Amsterdam at ×1.00 for better latency. Buying Seychelles here is paying 40% more and adding 140 ms for no benefit that survives scrutiny — the thing this person actually wanted was a provider that does not collect their identity, and every location does that.