Start with three separate questions
A hosting location tells you where a machine is intended to run. It does not describe every party handling an account, backup or support request. The operator, infrastructure suppliers and customer can have different legal responsibilities. A useful assessment follows the complete service rather than treating a country label as the answer to every legal question.
- Operator: who provides the service and enters the agreement?
- Placement: where are the primary system, stored copies and operational records?
- Access: which parties can administer the service or receive data?
The service operator is KoalaVPS
KoalaVPS is the operator named for this service. The terms explain the service relationship; the privacy policy explains the handling of account and operational information. Selecting a region concerns the placement of infrastructure. It does not, by itself, specify a company’s registered office or decide all obligations that may apply to the operator, customer or workload.
Four regions, with their own national context
The catalogue contains Stockholm, Helsinki, Oslo and Reykjavík. Sweden and Finland are EU member states. Norway and Iceland participate in the European Economic Area through EFTA. The GDPR has been incorporated into the EEA Agreement, so choosing an EEA EFTA location does not remove the European data-protection framework. National law and procedures still require attention in each country.
- STO / Stockholm / Sweden / EU
- HEL / Helsinki / Finland / EU
- OSL / Oslo / Norway / EEA EFTA
- RKV / Reykjavík / Iceland / EEA EFTA
Official documentation: EFTA: the European Economic Area · EFTA: GDPR incorporation and legal status
Stockholm: the Swedish region
Stockholm names the Swedish placement option. Sweden is an EU member, and its national data-protection authority is Integritetsskyddsmyndigheten, usually called IMY. For an order using this region, assess the selected service, its stored copies and the parties with access alongside the Swedish and applicable European framework. The city alone does not establish where every account record or external application dependency resides.
- Region code: STO
- Country: Sweden
- European framework: EU member state
- National data-protection authority: IMY
Official documentation: European Union: Sweden · EDPB: national supervisory authorities
Helsinki: the Finnish region
Helsinki identifies the Finnish placement option. Finland is an EU member, and its national supervisory authority is the Office of the Data Protection Ombudsman. Include database replicas, backup destinations and administrative access in a Finnish placement decision. If an application sends information to a separate service, that additional processing has to be considered on its own terms.
- Region code: HEL
- Country: Finland
- European framework: EU member state
- National data-protection authority: Office of the Data Protection Ombudsman
Official documentation: European Union: Finland · EDPB: national supervisory authorities
Oslo: the Norwegian region
Oslo is the Norwegian catalogue region. Norway is an EEA EFTA state outside the EU, and Datatilsynet is its national data-protection authority. EEA participation and GDPR incorporation are relevant parts of the assessment. They do not mean that every EU instrument or every national legal procedure is identical across the four regions.
- Region code: OSL
- Country: Norway
- European framework: EEA EFTA
- National data-protection authority: Datatilsynet
Official documentation: EFTA: EEA participation and scope · EDPB: national supervisory authorities
Reykjavík: the Icelandic region
Reykjavík identifies the Icelandic placement option. Iceland participates in the EEA through EFTA, and Persónuvernd is its national data-protection authority. Its physical separation from mainland Europe is a geographic fact; legal reach, access arrangements and recovery-copy placement require their own assessment. The selected service and the actual data flows remain the useful starting point.
- Region code: RKV
- Country: Iceland
- European framework: EEA EFTA
- National data-protection authority: Persónuvernd
Official documentation: EFTA: GDPR in the EEA · EDPB: national supervisory authorities
A chosen region should remain a visible decision
The placement principle is to keep the selected region explicit throughout the service lifecycle. A planned move to another country should be described before it happens and agreed with the customer. Replication, restores and emergency recovery need equally clear treatment in the service terms. The primary region, destination of any recovery copy and country of a later migration should never be silently treated as interchangeable.
- Record the selected region with the order
- Identify the destination before a planned cross-border migration
- Describe any recovery exception and its notification process
- Keep the customer’s placement record aligned with the actual service
Legal reach can involve more than the storage country
Applicable rules can depend on an organisation’s establishment, the processing activity, the people concerned and the legal instrument being used. The GDPR’s territorial scope therefore needs more than a pin on a map. Cross-border mechanisms also exist for electronic evidence; the EU framework is one example for providers and requests within its scope. Each request requires an assessment of the facts and the relevant procedure.
Official documentation: EDPB: GDPR territorial scope · European Commission: cross-border electronic evidence
Review the authority, narrow the scope, document the response
The handling principle is to verify who is requesting information, the legal authority relied upon and the particular data or service involved. A request should receive qualified review, with unsupported or excessive demands questioned through the available procedure. Any disclosure should be limited to what is lawfully required or otherwise lawfully justified. Customer notification must respect applicable restrictions.
- Verify the requester and the legal basis
- Identify the affected account, service, period and data categories
- Check jurisdiction, procedure and any conflicting obligations
- Seek clarification or challenge an overbroad demand where appropriate
- Keep a proportionate record and disclose only the justified scope
Foreign requests need their own transfer analysis
A third-country authority’s demand is not an automatic permission to disclose personal data from the EU. The EDPB’s Article 48 guidance distinguishes recognition of a foreign decision from the lawful basis for processing and the ground for an international transfer. An applicable agreement or another permitted route must be assessed in context; neither automatic acceptance nor a blanket promise of refusal is a sound policy.
Official documentation: EDPB: Article 48 and third-country authority requests
Follow the data beyond the primary disk
Primary storage, snapshots, backups, logs, account records and support attachments can follow different paths. A regional choice is meaningful only when those paths are understood. The service record and privacy information should distinguish each category and explain the parties allowed to access it. Remote administration and external processors belong in that inventory too.
- Primary system and application data
- Snapshots, independent backups and recovery replicas
- Account, billing, security and support records
- Administrative access and external service providers
Protect regional transfers as well as regional placement
Replication and migration should use authenticated encryption, restricted credentials and defined endpoints. Keep keys and access permissions separate from the transfer job where appropriate. Retention and deletion of the previous copy must be part of the move. Routing over a private connection and encrypting the data are separate controls; neither geography nor a network label alone demonstrates confidentiality.
Minimise collection without promising legal immunity
The account model avoids routine identity-document collection. That limits unnecessary information gathered at signup; it does not erase payment, security, infrastructure or support records that a service may need. Retention and preservation duties must be assessed under the applicable rules. The privacy and transparency pages describe those principles, while the acceptable-use policy applies across every region.
Turn a location preference into an operational checklist
Before placing a sensitive workload, document the service parties, primary location, recovery destinations, access model and contractual requirements. Keep the record current when you change providers or application dependencies. This page explains the general framework; a specific regulated activity or dispute needs an assessment of its own facts.
- Match the selected region to the order and service description
- Review backup and log placement rather than assuming it matches
- Check the privacy, acceptable-use and service terms together
- Identify any processing outside the chosen region or EEA
- Use the linked primary sources for the legal framework and its current scope
A little more clarity.
Does choosing a server region select the operator’s country of registration?
No. The operator and the placement of infrastructure are separate questions. A selected region identifies the intended server location; it does not by itself specify a registered office or settle every applicable obligation.
Are all four countries in the European Union?
Sweden and Finland are EU members. Norway and Iceland are EEA EFTA states outside the EU. GDPR incorporation into the EEA Agreement is relevant to all four locations, while national procedures and other legal instruments can differ.
Does a Norwegian or Icelandic region sit outside the GDPR framework?
No. The GDPR has been incorporated into the EEA Agreement. Applicability still depends on the processing and parties involved; an EEA EFTA label is not a general exemption from data-protection obligations.
Can a foreign authority ever reach data held in another country?
Cross-border legal mechanisms exist. Whether a request has effect depends on the relevant law, procedure, parties and facts. The storage country alone cannot establish that every foreign request is ineffective.
Will a planned move to another country be visible to me?
The placement principle calls for the destination and effect of a planned cross-border move to be disclosed and agreed before the move. Recovery exceptions and notification procedures belong in the service terms.
Do backups automatically stay in the same country as the server?
The primary location does not by itself determine backup placement. Review the service’s snapshot, backup and recovery destinations separately, including retention and access.
Does a private connection between regions mean the data is encrypted?
Routing and encryption are separate controls. A transfer should use authenticated encryption and an explicit access policy; a private-network description alone is not proof of either.
Does no-KYC prevent a provider from receiving a legal request?
No. It describes the identity-verification model. A provider can still have operational records and legal obligations. Collection limits, retention and the scope of a request need to be assessed accurately.
Does the acceptable-use policy change with the selected country?
The KoalaVPS acceptable-use policy applies across the catalogue. A region selection does not remove the customer’s own obligations under applicable law.