Law & jurisdiction

Yes. Renting a server in another country is an ordinary commercial transaction, and no jurisdiction we operate in prohibits it. Offshore hosting changes which law governs the server and which court can compel disclosure. It does not make otherwise-illegal content legal, and it does not exempt you from the law where you live.

The DMCA is United States copyright statute. Its notice-and-takedown procedure and safe harbour apply to service providers situated in the United States. A server in Panama, Moldova or Seychelles is governed by that country's copyright law instead — which in most cases requires a court order rather than a private notice.

We assess whether it is valid legal process from a court with jurisdiction over OnionVPS. If it is, we comply with exactly what is ordered and nothing beyond it. In practice that is very little: an email address and a payment reference. If it is not valid, we reject it. Either way, the warrant canary reflects reality.

A mutual legal assistance treaty is the formal channel through which one country asks another to gather evidence on its behalf. It matters because a foreign authority generally cannot order a Panamanian or Seychellois host directly — it must route the request through that country's own courts, which is slow and often unsuccessful.

Child sexual abuse material, which we report to the appropriate authority. Malware command-and-control, ransomware infrastructure and exploit kits. Phishing and credential harvesting. Spam and unsolicited bulk mail. Attacks originating from your instance. Content illegal in the jurisdiction hosting it. Everything else lawful is permitted, including content other providers refuse.

Complaints are triaged by evidence, not by volume. Automated copyright notices to non-US locations are forwarded to you for information and no action follows. Reports of active harm — outbound attacks, phishing, malware distribution — get a response within hours. Valid court orders are answered. We do not suspend on a single unverified complaint.

Not for a single unverified complaint. Suspension is reserved for active, ongoing harm: an instance participating in an attack, distributing malware, or hosting CSAM. For everything else you receive the complaint, a stated window to respond, and a route to contest it. Data is never deleted during a suspension review.

Physical seizure of hosting hardware is rare and requires a criminal warrant executed at the datacentre by local authorities. It is far more common for an authority to order the provider to image a specific instance. Full-disk encryption with a passphrase the provider never holds is the only meaningful protection against either.

The GDPR follows the data subject, not the server. If you process personal data of people in the EU, it applies regardless of where the server sits — and hosting outside the EU adds a transfer-mechanism obligation. Offshore hosting does not exempt you from the GDPR; it adds a step to your compliance.

You are. On an unmanaged VPS you are the operator of the service and the publisher of its content; the provider is a conduit. That allocation is what makes intermediary liability protections work in most jurisdictions — the host is not liable for what it neither controls nor knows about, provided it acts on actual knowledge.

Middle relays and bridges are permitted on any OnionVPS instance, without restriction. Exit relays are permitted in approved jurisdictions only, and require a published abuse contact and a reduced exit policy. Exits attract complaints about traffic that is not yours, so we require that you are prepared to answer them.