How to read a jurisdiction before you trust it

Country names do a lot of unearned work in hosting marketing. “Offshore” is not a legal category, and a flag on a page tells you nothing about what happens when somebody sends a letter. These six questions can be answered about any jurisdiction in an afternoon, mostly from public sources, and together they predict provider behaviour far better than any adjective.

1. Is there a notice-and-takedown statute?

This is the question that decides whether correspondence alone can remove your service. You are looking for a domestic law that creates a private procedure — one where a rightsholder writes to a host and the host must act within a deadline to preserve some protection of its own.

• United States — yes. 17 U.S.C. § 512 conditions safe harbour on running the procedure, which is why removal is the default reflex there.
• European Union — a version of it. The e-Commerce Directive conditions liability protection on acting expeditiously once aware, and the Digital Services Act adds timelines and trusted-flagger priority for intermediaries offering services in the Union.
• Many others — no equivalent. Copyright is enforced through the courts, meaning a claimant must file, be named, and wait.

Read the scope clause, not the summary. Most of these instruments attach to providers established in the territory or offering services into it. Those are different tests with different results, and the difference is exactly what a host outside the territory is relying on.

2. Is there a data-retention mandate?

A retention mandate obliges providers to keep subscriber and traffic records for a fixed period, whether they want to or not. Where one exists, a host’s promise to “keep almost nothing” is a promise it is not allowed to keep, and no amount of good intent changes that.

The useful question is not “do you keep logs” but “are you obliged to”. A host in a mandate-free jurisdiction that chooses to keep 24 hours of metadata has made a decision it can shorten tomorrow. A host under a two-year mandate has not made a decision at all. Ask which of the two you are dealing with, and ask them to name the instrument either way.

3. What does a foreign order have to go through?

Assume a foreign agency wants your data. Trace the actual route.

1. Is there a direct-access arrangement? Some jurisdictions have treaties or domestic laws letting foreign authorities reach providers with little local review. That collapses the distance you thought you had bought.
2. Is mutual legal assistance required? An MLAT request goes through a central authority and is granted by a local court. It is public, adversarial and slow — three properties that are the entire point.
3. Can a local court be asked directly by a foreign party? Sometimes yes, and it is faster than MLAT. Worth knowing before you assume the treaty route is the only one.

The property you actually want is not “impossible” — nothing is impossible, and a provider promising that is not describing a legal system. What you want is a route that is public, requires a named claimant, and takes long enough that you find out.

4. Which intelligence arrangements is it inside?

The Five, Nine and Fourteen Eyes groupings are about signals-intelligence sharing between states. They are frequently over-claimed in hosting marketing — membership does not mean an agency reads your disk — but they are a genuine input, because they describe standing relationships in which information moves without a fresh legal step each time.

Treat this as one factor among six rather than a verdict. A country outside every arrangement but with a two-year retention mandate is a worse choice than a country inside one with no mandate and a judicial-only takedown route. Marketing tends to lead with this question precisely because it is the easiest to answer and the least decisive.

5. Does the provider own anything there?

This is the question that separates a jurisdiction from a flag on a dropdown, and it is the one almost nobody asks. A location in a picker usually means capacity rented from a local operator. When a demand arrives, the party holding the machine is that operator — under its own contracts, its own risk appetite and its own upstream relationships. Your host’s legal position is largely irrelevant at that point, because your host is not the one being asked.

6. Is there enough infrastructure to matter?

Several jurisdictions are further outside the reach of a takedown notice than anywhere you are likely to be offered — and have no datacentres, no transit and no engineers. A permissive legal regime with nothing in it is a thought experiment, not a hosting option.

The check is concrete: how many transit carriers reach the building, what the latency is to the nearest major exchange, and whether there is a second facility in the country at all. A jurisdiction that is legally ideal and 200 ms from your users has solved a problem you did not have while creating one you did not previously have either.

Reading the answers together

No jurisdiction scores well on all six, and a provider claiming one does has stopped describing the world. What you are looking for is a defensible combination, and a host that can articulate its own trade-offs without flinching.

What each answer tells you

Question	Weight	Verdict	Why it matters
Takedown statute	High	Decisive	Decides whether correspondence alone can remove your service. Everything else is downstream of this.
Retention mandate	High	Decisive	Decides whether a privacy promise is a choice or an impossibility.
Foreign-order route	High	Decisive	You want public, named and slow — not impossible, which nobody can offer.
Provider ownership	High	Decisive	A rented rack means the legal position you evaluated belongs to somebody else.
Eyes membership	Medium	Contributing	Real, but over-claimed. Never decisive on its own, and the easiest question to answer.
Infrastructure	Medium	Contributing	A permissive country with no carriers is not an option, it is a thought experiment.

If you want to see the six answered rather than described, our own legal position sets them out instrument by instrument, and why one country explains why we answer them for a single jurisdiction instead of nine.

Written by the engineers who run the platform, and re-read 14 days ago. If something here is wrong or has gone out of date, say so from the panel — that is where about half of these came from.