Bare metal, European
jurisdiction.

The five jurisdictions we operate in are not interchangeable. Different threat models. Different regulatory regimes. Different operational trade-offs. The matrix below puts them side by side across twelve legal and operational dimensions that procurement and legal teams ask about during vendor evaluation, the kind of side-by-side that legal teams typically have to assemble themselves from public records before they can answer the question of which jurisdiction the company should sit in. Read the rows where the dimension matters to your specific situation. Ignore the rest. The buyers who already know which dimensions matter to them have half the answer before reading the table.

Two patterns visible in the matrix. Luxembourg and Switzerland sit at the regulated-EU end. Iceland and Slovenia sit at the operational-flexibility end. Sweden splits the difference. Luxembourg pairs predictable EU-style data protection with professional-secrecy provisions specific to financial-services hosting that few other EU jurisdictions match. Switzerland pairs EU-equivalent data protection with banking-secrecy provisions and a non-EU jurisdiction sitting outside the GDPR territorial scope despite the equivalence agreements that govern most operational scenarios. Iceland leans into constitutional press freedom — the same protections newspapers and broadcasters operate under, applied to data hosting through case law that has held up. Slovenia leans into a less restrictive regulatory environment combined with the lowest cost basis in our network. The right jurisdiction matches the buyer's exposure profile. The wrong jurisdiction is worse than no jurisdiction story. It produces false confidence about protections that do not actually apply when tested.

The default offering is AMD EPYC bare metal — current-generation Genoa or Bergamo depending on what is in stock at the chosen facility — with ECC DDR5 memory, NVMe SSD storage, and 1 Gbps unmetered bandwidth as standard. The 10 Gbps tier is available at every location for workloads that need it. Hardware is dedicated to the customer; no virtualisation layer between you and the metal unless you provision it yourself. IPMI access is included for full out-of-band management, with the option to disable it entirely if your threat model rules out remote KVM access.

The encryption posture is simple and customer-controlled. Full-disk encryption is available on every plan; the keys live on your side, not ours. Our operators cannot decrypt the disk to satisfy a hypothetical legal order because we do not have the key material. The standard implementation is LUKS for Linux workloads, BitLocker for Windows. For higher assurance, we support customer-managed HSMs — bring your own YubiHSM or Thales Luna, we install it physically in the rack, and the key material never leaves your custody. This is the architectural pattern the EU Data Act explicitly endorses in Chapter VII as one of the technical measures that meaningfully protects EU customer data from third-country government access.

Starter      # €119/month, single-socket
  CPU:        AMD Ryzen 7 7700X / Intel Xeon E-2488
  Cores:      8 physical (16 threads)
  RAM:        64 GB DDR5 ECC
  Storage:    2 × 1 TB NVMe SSD (RAID-1)
  Network:    1 Gbps unmetered
  IPs:        5 × IPv4 + /64 IPv6

Professional # €249/month, dual-socket
  CPU:        AMD EPYC 9354P / Intel Xeon Gold 6444Y
  Cores:      32 physical (64 threads)
  RAM:        256 GB DDR5 ECC
  Storage:    2 × 3.84 TB NVMe SSD (RAID-1)
  Network:    1 Gbps unmetered (10 Gbps option +€60/mo)
  IPs:        5 × IPv4 + /64 IPv6

Enterprise   # Custom, from €489/month
  CPU:        AMD EPYC 9654 / Intel Xeon Platinum
  Cores:      64 to 128 physical
  RAM:        512 GB to 3 TB DDR5 ECC
  Storage:    Custom NVMe array, optional Optane / SAS hybrid
  Network:    10 Gbps minimum, 25 Gbps option
  IPs:        Custom allocation, /29 ranges available

The network is our own. We run our own provider-independent address space, peered into the European internet since 2003 — over twenty years of operating history. BGP anycast is available for workloads that need geographic redundancy. IPv6 is allocated as a /64 per server by default, with /48 ranges available for clients that need them. Reverse DNS is fully configurable on every IP — the address resolves to your hostname, not to an opaque provider string.

The other thing the network gives us is peering control. We choose our transit providers and we choose our peering partners. None of our IPv4 transits route through U.S.-controlled networks for European destinations — traffic between European locations stays on European backbones (DE-CIX, AMS-IX, NetIX, Equinix Stockholm) without transiting through hyperscaler infrastructure. The latency benefits are incidental; the sovereignty benefits are the point.

Three things "offshore" used to mean. The first was geographic — your data sits somewhere other than the buyer's home jurisdiction. The second was legal — the hosting jurisdiction has different disclosure obligations than the buyer's. The third was operational — fewer questions asked, weaker KYC, less paperwork. Each meaning has aged differently. The geographic meaning is intact but no longer sufficient on its own to provide the protection a buyer expects. The legal meaning still applies, though the gaps between jurisdictions have narrowed substantially since the GDPR took effect in 2018, the Schrems II decision invalidated the Privacy Shield framework in 2020, and the EU Data Act became fully applicable on 12 September 2025 with material implications for cross-border data processing arrangements. The operational meaning is dead at any reputable provider. Dead. The providers who still sell it are operating in regulatory grey-zones that buyers should not associate themselves with regardless of how well the marketing copy reads.

What offshore actually means in 2026 is structural, not promotional. A genuine offshore posture has three components — a corporate counterparty in a jurisdiction with predictable rule of law and meaningful constitutional or statutory protections, operating infrastructure physically located in that jurisdiction with verifiable on-the-ground presence rather than virtual reseller arrangements, and an absence of legal entry points from the buyer's threat-model jurisdictions. The first two are observable. The third requires the kind of legal due diligence that most buyers do not run themselves and that most marketing pages do not survive. We publish our corporate structure and our legal opinions on each of the five jurisdictions because the alternative is asking buyers to trust the marketing copy, and we have read enough offshore hosting marketing copy to know that the gap between what is claimed and what is true is wider than the buyer realises.

The five jurisdictions we operate in were chosen against this definition. Each has a predictable rule of law and meaningful protections. Each has operating infrastructure we own or directly control. Each has been audited internally by counsel for legal entry points before we deployed there. The selection is not exhaustive — we could have added more jurisdictions and chose not to, because three additional candidates we evaluated did not pass internal due diligence in 2024 and 2025. Buyers can ask which jurisdictions failed and why. We will tell them, on a discovery call rather than in published material, because the legal positioning of those rejected jurisdictions is more delicate than a marketing page can carry responsibly.

The decision matrix at the top of the page covers every dimension. The decision rarely depends on every dimension. Most buyers walk into the discovery call with a specific exposure profile and need a recommendation, not a comparative analysis. The ladder below maps exposure profiles to jurisdictional recommendations, the way we structure the conversation when a prospect asks "which one for us." The ladder is opinionated. It also tracks how 80%+ of our offshore-dedicated deployments actually distribute across the five jurisdictions, because the recommendations are derived from the patterns we observe rather than from theoretical positioning.

The ladder collapses at the discovery call into a 20-minute conversation. We walk through your specific exposure — what you are protecting, who you are protecting against, what regulatory regime applies to you, what the buyer's home jurisdiction looks like — and recommend one jurisdiction with one reasoning. Sometimes the recommendation is "you do not need offshore at all, your home jurisdiction works for what you are doing." About 1 in 5 of these calls ends that way. The honest answer wins long-term customers more than the upsell does. If the recommendation is offshore, the ladder above tells you which one it will be before we say it on the call.