Offshore hosting in our Panama datacenter, for work that survives a fair audit but meets disproportionate friction in US or EU

No. The word "bulletproof" implies impunity, and impunity is not what we sell. We operate under Panamanian law, our AUP excludes content that is illegal in Panama or in major receiving jurisdictions, and we respond to lawful court orders from courts with proper jurisdiction. What we do offer is a hosting jurisdiction where frivolous DMCA notices, abusive lawfare campaigns, and US administrative pressure do not have direct effect. The distinction matters and we will not blur it for marketing.

Panama does not recognize the US DMCA. A DMCA notice from a US copyright holder, sent to us, has no automatic legal effect. We forward the notice to the customer for awareness and we move on. If the underlying complaint represents an actual copyright violation under Panamanian law, the rights holder has a path through Panamanian courts and we respect that path. If it is the typical DMCA template letter from a copyright bot, it does not result in your site disappearing.

We respond to lawful court orders from courts with proper jurisdiction. A US federal court order for data on a server in Panama runs into Panamanian sovereignty, which means the order has to be transmitted via the appropriate diplomatic channel (mutual legal assistance treaty) and then evaluated by a Panamanian court. The friction is significant and the bar is much higher than a US-domestic request. For requests that arrive without proper procedure, we decline. For requests that arrive properly through the right channel and meet Panamanian legal standards, we comply because we are not a criminal organization.

About 20 to 30 percent of new applications get rejected during the AUP screening phase. The rejection reasons fall into three buckets. First, content explicitly prohibited (CSAM, terrorism, malware infrastructure, fraud) — automatic rejection. Second, applications that look legitimate on paper but raise red flags during the screening (unverifiable business identity, applicant connected to previously banned accounts, content that meets the AUP technically but appears to mask something else) — also rejected. Third, high-risk verticals where the applicant cannot or will not provide the required documentation (no gaming license for a stated gambling operation, no AML procedures for a stated exchange) — rejected. The screening process is the product. Without it, the netblock would be unusable within months.

For non-high-risk verticals, you provide a working email and a billing address. We do not verify identity beyond that. We do not require government ID, scans, or video calls. For high-risk verticals (KYC-compliant exchanges, licensed gaming, adult content platforms), we require business documentation (license certificates, business registration, AML procedures). The KYC requirement applies regardless of payment method — paying in Bitcoin does not exempt a stated crypto exchange from showing their license. The reason is straightforward: the operational quality of our shared infrastructure depends on the quality of the customers using it.

EUR via SEPA bank transfer, EUR via card (Visa/Mastercard for non-high-risk verticals), Bitcoin (BTC), Monero (XMR), and Tether (USDT, both ERC-20 and TRC-20). For high-risk verticals where card processors do not work, cryptocurrency is the practical option. For Bitcoin and Monero, we use a payment processor that does not require KYC for the payment itself — your KYC, where required, is for the AUP, not for the payment. Annual prepay in cryptocurrency gets the standard 15% discount.

Three differences. First, jurisdiction: Panama only, while Shinjiru and AlexHost operate in multiple jurisdictions with varying quality. Second, AUP enforcement: we filter on the way in, while most offshore providers filter only after complaints arrive. Third, parent entity: we are a registered Austrian GmbH with audited accounts, while most offshore providers are private operations with limited disclosure. Whether these differences matter to you depends on your priorities. Customers who care about long-term operational stability tend to find them important. Customers who only care about initial price often do not.

Volumetric DDoS protection up to 100 Gbps is included on every plan. For services that attract larger attacks (often the case for political content and high-profile platforms), we have arrangements with our upstream for additional capacity, and we offer a layer-7 mitigation add-on (€149/mo per node) that handles application-layer attacks. The combination handles real-world attacks at scale. If your threat model includes nation-state-level adversaries, we will tell you that on the discovery call and recommend a specialized DDoS provider in addition.

From Panama, latency to North America is around 60-80ms (worse than US hosting, similar to EU hosting), latency to Europe is around 130-160ms (worse than EU hosting, similar to US hosting), latency to LATAM is under 30ms (significantly better than either). For most applications, the latency penalty is acceptable in exchange for the jurisdictional benefit. For applications where every millisecond matters (real-time gaming, financial trading), we recommend a hybrid setup: Panama for the data and main application, plus a CDN with global edge nodes for static content. We can help configure this during onboarding.

For customers who need Panama jurisdiction with redundancy, we offer multi-server setups within the Panama datacenter (on different racks, different power feeds, different network paths). We do not currently offer multi-region within Panama because there is only one Tier 3+ datacenter in Panama with the operational standards we require. For customers who need geographic redundancy across jurisdictions, we offer hybrid Panama + EU setups where the production workload runs in Panama and a cold-standby DR runs in our Vienna or Frankfurt PoPs. The DR setup involves accepting that the DR location is in EU jurisdiction; whether that is acceptable depends on your threat model.

Yes, and many customers do. The most common pattern: production application in Panama with EU jurisdiction risk, plus EU dedicated hosting for non-sensitive workloads (CI runners, internal tools, dev environments) or for customer-facing services where EU data residency is a contractual requirement. One contract, one invoice in EUR, one technical account spanning both. The split lets you optimize jurisdiction per workload rather than betting everything on a single answer.

Legal adult content is welcome, with appropriate documentation: age verification system in place, performer consent and age documentation maintained, compliance with the laws of the jurisdictions you actually serve. We do not host content that depicts non-consensual acts, content involving minors (regardless of how it is described or framed), revenge porn, or content distributed without the consent of all participants. Performers whose work appears on customer platforms can submit takedown requests via a documented process and we honor those requests within 48 hours.

KYC-compliant exchanges with proper licensing in their operating jurisdictions are welcome. We require: business registration, AML/CFT procedures documented, evidence of KYC enforcement on user onboarding, and where applicable, licenses from regulators (BitLicense, MAS, FINTRAC, etc.). Exchanges that operate without KYC, that openly advertise jurisdictional arbitrage as the value proposition, or that have been the subject of regulatory enforcement actions, do not pass our screening. Mixers, tumblers, and privacy-coin-only services that do not implement basic AML are categorically excluded.

OS Domains GmbH has been operating since 2008. The offshore Panama product launched in 2009. The current Tier 3+ datacenter has been our Panama operation since 2015. We have been through enough complaint cycles, takedown attempts, and edge-case legal questions to have working playbooks for most of them. Customers who have spent time with cheaper offshore providers usually notice the operational difference within the first month.

On cancellation, you get 30 days to migrate your data off the platform. We provide standard tooling for export (rsync, snapshots, database dumps) and we will not hold your data hostage during the migration window. After 30 days, the storage is wiped according to NIST 800-88 standards (multiple-pass overwrite for spinning disks, cryptographic erasure for NVMe), and we provide a written certificate of destruction on request. If our business were to end, we have a documented continuity plan: the Austrian GmbH structure means there is a registered legal entity with audited accounts that owes you obligations, the Panama datacenter is operated under a colocation agreement that survives our company status changes for the contract period, and customer notice would be 90 days minimum before any service termination. We are profitable and bootstrapped without VC pressure, so this is unlikely, but the legal structure is designed for it.

Conditionally yes. Email infrastructure (SMTP relay, MTAs) hosted in Panama works for legitimate transactional and opt-in marketing email targeting LATAM markets, where the local IP origination is actually beneficial for placement. We do not allow cold email infrastructure in Panama because the IP space we use there has to remain clean for the customers who need it for non-email workloads, and cold email has a structural conflict with that. For cold email infrastructure customers, our /smtp-relay, /email-sending-servers, and /cold-email-infrastructure products in EU PoPs are the right answer. The separation is not negotiable: mixing cold email and offshore IPs is how you destroy both products at once.

Yes, but with caveats. We register domains through partner registrars that are not US-based and that do not impose US-style takedown procedures. The available TLDs include the Panamanian .pa, the Swiss .ch, the Icelandic .is, and a curated list of generic TLDs (.com, .net, .org, .info) registered through registrars in jurisdictions that respect proper due process. We do not register .com or .net through US-based registrars because that creates a parallel takedown vector that defeats the purpose of offshore hosting. Domain costs are passed through at our wholesale rate without markup. WHOIS privacy is included by default where the TLD allows it.

When we receive a complaint or legal request that affects your account, we follow a documented process. First, we evaluate the request: is it a legitimate court order from a court with proper jurisdiction over us, or is it a template letter from a copyright bot, or is it an opportunistic administrative request without proper procedure? For the first category, we comply because we are not a criminal organization. For the latter two, we forward the request to you for awareness, document our position internally, and continue operating your service. We do not preemptively delete content or suspend accounts based on unverified complaints. We do not share your information with complaining parties without legal compulsion. We do tell you what arrived and what we are doing about it, so you can take any actions on your side that make sense (engaging counsel, modifying content if you choose to, or doing nothing if the complaint is meritless).

Both options work. For straightforward cases (clear use case, standard verticals, no edge cases), apply directly through the website and the screening team will reach out if anything needs clarification. For cases with operational complexity (high-volume traffic, multiple servers, custom contractual structures, regulatory compliance scenarios) or where you want to verify fit before applying, the 30-minute discovery call is the right starting point. The call is no charge and no obligation. Half the calls we run end with us recommending a different vendor because the use case does not fit our AUP or our operational model. The other half end with a clear path to apply, often with specific recommendations for which plan tier and which configuration fit best.