What offshore hosting actually protects you from

Offshore hosting is sold as a shield and bought as one, and the gap between those two beliefs is where most of the disappointment lives. It is a real mechanism with a narrow, well-defined effect — and understanding the boundary of that effect is the difference between a decision that holds and one that collapses the first time somebody sends you a letter.

Two questions people merge into one

Almost every confused conversation about offshore hosting comes from collapsing two separate questions into a single word, “legal”. They are not the same question, they have different answers, and only one of them is affected by where your server sits.

A provider that lets you believe the second question has been dealt with is selling you a problem rather than a service. It is also telling you something useful about how it will behave when a demand actually arrives: a company comfortable with that ambiguity in its marketing tends to be comfortable with it at its abuse desk.

What it genuinely changes

Within question one, the effect is substantial and worth paying for. Three things move.

The instrument that compels removal changes. In the United States, 17 U.S.C. § 512 conditions a provider’s safe harbour on operating a notice-and-takedown procedure. That is domestic law rather than a treaty, and it creates an incentive strong enough that American providers remove first and ask afterwards, because the alternative is losing the safe harbour entirely. A host outside that jurisdiction has no safe harbour to lose and therefore no structural reason to remove pre-emptively. What replaces the notice is a court: slower, public, adversarial, and requiring somebody to actually make a case.

The speed changes, and the speed is most of the value. A notice-and-takedown pipeline can remove your service in hours on the strength of a form nobody verified. A judicial route takes weeks and needs a claimant willing to spend money and be named in public. The great majority of complaints are backed by nobody willing to do either. This is the largest practical effect of moving jurisdiction, and it is rarely the one that gets advertised.

The number of parties who can pull the plug changes. A reseller sitting on top of somebody else’s infrastructure has an upstream, that upstream has its own abuse desk and its own risk appetite, and it has an upstream of its own. Every layer is a party who can terminate you for reasons that have nothing to do with law and that you will never see. A host owning its hardware in one jurisdiction removes those layers — which is why “do you own the racks” is a more revealing question than “which country”.

Four things it does not touch

These are the assumptions that cause people to buy the wrong thing, in roughly the order they come up.

1. The law where you live

If you are resident somewhere, that country’s law applies to you personally regardless of where your files sit. Moving a server does not move you. Criminal liability, tax obligations, regulatory duties and civil exposure all follow the person rather than the disk. Any framing that suggests otherwise is describing a world in which jurisdiction attaches to hardware, and that world does not exist.

2. Your domain name

A domain is a separate contract, with a separate party, under a separate legal system — and it is very often the softest point in the arrangement. A registry can suspend a name far more easily than a host can be made to unplug a machine, and some registries will do it on request from an agency with no order at all. If your hosting is offshore and your domain is not, you have moved the strong link and left the weak one where it was.

3. Everyone else you depend on

Payment processors, CDNs, email deliverability, app stores, advertising networks, DNS providers. Each has its own terms and its own tolerance, and each can end your service independently of your host. Offshore hosting protects one link in a chain you did not draw. Draw the chain first, then decide whether hosting was the fragile part.

4. The two things no host will accept

Every serious provider anywhere refuses child sexual abuse material and material organising violence against people, without a court order and without waiting for one. A provider claiming otherwise is either lying or is about to become somebody’s example. Treat “we accept absolutely anything” as a warning rather than a feature: it is a claim nobody can actually operate, and a company that makes it has not thought about the day it is tested.

There is a fifth, quieter one: outbound attacks. No host lets denial-of-service traffic or mass exploitation leave its network, because it gets their address ranges null-routed by other people and takes down customers who did nothing. That is a network-integrity rule rather than a content rule, and being able to tell the two apart is most of what it takes to read an acceptable-use policy properly.

A test you can apply to any provider

Four questions, asked before you pay, in writing. The answers tell you more than any comparison table, and whether the provider answers at all is itself the first result.

1. What exactly happens when you receive a complaint about my service? A good answer is a procedure with timings attached. A bad answer is a sentiment.
2. What records exist about me, and how long do they live? If the answer is vague, the honest reading is that the list is long. Ask for it enumerated, item by item.
3. Who else can terminate my service, and what sits above you? This flushes out resellers. The phrase “our upstream” in a reply means at least two parties you never chose can end your service.
4. What instrument would actually make you act, and has one ever arrived? The first half tests whether they understand their own legal position. The second half has a number for an answer, and a provider willing to publish that number is making a claim you can watch move.

When it is worth the trade

There is a real cost, and it is not the monthly price. It is distance: latency to your users, a smaller pool of engineers who know the local network, and a legal environment you cannot read as fluently as your own. Paying that cost makes sense in a fairly narrow set of situations.

• You publish material that attracts volume complaints which are not themselves unlawful where the host sits — and you have already been removed once for it.
• Your platform carries other people’s speech and you would rather adjudicate it yourself than have a web form do it on your behalf.
• Your service is lawful where it operates but politically inconvenient somewhere with a well-staffed takedown apparatus.
• You need the number of parties who can unplug you to be exactly one, and you want that one to be identifiable and contractually bound to you.

If none of those describe you, the honest answer is that you probably do not need this, and the guide arguing that case is the better seven minutes. If one of them does, the next question is which jurisdiction — and that question has six sub-questions, every one of which is checkable before you commit to anything.

Written by the engineers who run the platform, and re-read 9 days ago. If something here is wrong or has gone out of date, say so from the panel — that is where about half of these came from.