Published: 23 September 2026
"Hosted in the EU" is a claim, not a fact. It can mean a server in a named building in a named city, or it can mean a control plane in Ireland, storage in an unspecified "EU region", and a support team with production access somewhere else entirely. If you have ever had to fill in a data-processing questionnaire, you already know that the difference shows up as a blank cell you cannot fill.
This post is about the practical question underneath all of it: which country is the machine physically in, how would you prove it, and what does choosing one over another actually cost you?
Residency, sovereignty, and the word "region"
Three ideas get blurred together, usually by the party who benefits from blurring them.
- Data residency is where the bytes sit. A street address, a city, a country.
- Data sovereignty is whose law reaches them. That follows the residency, but also the provider's own corporate jurisdiction and where its staff sit.
- A "region" is a commercial abstraction. It maps to real facilities, but the mapping can change, it often spans several sites, and it is rarely the level at which you are given a guarantee.
For most obligations a controller has — a record of processing activities, a transfer assessment, an answer to a customer's security review — what you need is the first one, expressed as a country, stable over time, and something you can state without a footnote.
What our answer looks like
We sell a VPS in five countries, and the country is a field on the order form, not a region label:
| Country | City | EU member state | Cheapest plan / month |
|---|---|---|---|
| 🇷🇴 Romania | Bucharest | Yes | €4.00 |
| 🇵🇱 Poland | Warsaw | Yes | €5.00 |
| 🇳🇱 Netherlands | Amsterdam | Yes | €5.00 |
| 🇩🇪 Germany | Frankfurt | Yes | €5.50 |
| 🇦🇹 Austria | Vienna | Yes | €5.50 |
All five are EU member states, so all five are inside the GDPR's home jurisdiction and none of them involves an international transfer under Chapter V when you host there from within the Union. The price difference between the cheapest and the most expensive is €1.50 a month on the entry plan — which is worth saying out loud, because "we had to use the expensive region for compliance" is usually not a real constraint at this scale. The full grid, all six plans across all five countries, is in our location pricing post.
Choosing the country on purpose
When the contract names a country
Some sectors, and plenty of enterprise procurement templates, specify Germany or Austria by name. That is not a technical requirement and there is no point arguing with it — pick Frankfurt or Vienna, pay the extra euro or two, and move on. Vienna in particular is the answer for Austrian public-sector-adjacent work where "in Austria" is written down; we brought that location back online this week.
When the requirement is just "in the EU"
Then optimise for something else — latency to your users, or cost. Bucharest is our base price and satisfies the requirement exactly as well as Frankfurt does. A 32 GB machine is €58.00 there against €78.00 in Frankfurt, and the legal position is identical.
When your users are in one country
Residency and latency usually point the same way, which is convenient. Polish users, Polish server: Warsaw. Romanian and Balkan users: Bucharest. DACH and Central Europe: Vienna or Frankfurt. Pan-European or transatlantic: Amsterdam or Frankfurt.
When you need two countries
Redundancy requirements and residency requirements interact badly if you only read one of them. A standby in a second EU country keeps you inside the same jurisdiction while surviving a single-facility event. Frankfurt with a Bucharest standby is a common shape, and the standby costs €4.00 to €6.00 a month.
What a country field does not give you
Being precise here is the point of the post, so here is the other side.
- Choosing an EU country does not settle who can access the machine. Your own administrators, your own third-party tools, and anything you install that phones home are all part of the answer. A German VPS running an analytics agent that streams to a non-EU endpoint has an international transfer in it, and the flag on the order form did not cause it and cannot fix it.
- It does not classify your data for you. Residency is one control. It is not a lawful basis, a retention schedule, or a DPIA.
- It does not encrypt anything. Full-disk encryption, encryption in transit and key custody are yours to configure. On a full-root KVM machine you can do all of it; nothing is locked away from you.
- It is not a certification. A facility's own compliance posture and your compliance posture are different objects. If you need the former documented, ask us and we will tell you what we can evidence rather than gesturing at a badge.
Why full-root KVM matters for this
A managed platform where you cannot see the host makes several of these questions unanswerable. A KVM virtual machine gives you your own kernel and real root, so what runs on it is entirely enumerable by you: your packages, your daemons, your outbound connections. That is a much easier thing to write down in a processing record than "a managed runtime". Our KVM explainer covers the technical distinction, and if you are weighing the tenancy question more broadly, the noisy-neighbour post covers the isolation side.
Self-hosting is the logical end of this line of reasoning, and a good deal of our blog is about it — your own password manager, your own team chat, your own analytics. Each one removes a processor from your register and replaces it with a machine in a country you chose.
Testing a country before you commit to it
You do not have to take the latency claims on faith, ours included. Every plan is available on hourly billing at the monthly price divided by 720, so you can stand up the same machine in two countries, measure from where your users actually are, and delete both. A 2 GB machine in Bucharest is €0.0056 an hour; an afternoon in two countries is a few cents.
One rule to remember while you do that: powering a VPS off does not stop the charges — a stopped virtual machine still holds its RAM, disk and IP on a node. Delete it when the test is over.
Pick the country deliberately
Open the hourly VPS page or the streaming VPS page, choose a size, and choose the country in the location list. It is one field, it is explicit, and the price for each one is on the form before you confirm. If your procurement paperwork needs something specific from us in writing, open a ticket and ask — that is a better use of our time than a badge on a marketing page.
This is an engineering post about where servers are, not legal advice. If your obligations are serious, get them reviewed by someone qualified to sign off on them.