Can police seize my server in another country?

Can foreign police act on a server in another country?

Not by themselves. Inside the EU, officers from the requesting state may assist on the ground, but they are bound by the host state's law. They hold no enforcement powers there unless that law allows it and both authorities agree (Directive 2014/41/EU, Article 9(5)).

The Budapest Convention allows only two kinds of access without the other state's permission. Police may read publicly available data. They may also take stored data that a person entitled to disclose it hands over voluntarily (Article 32).

A server abroad can be seized, but only by the hands of the country it stands in.

Does cross-border seizure really happen?

Yes, at scale. Eurojust announced on 30 May 2024 that over 100 servers had been taken down or disrupted in one coordinated operation against malware droppers.

Eurojust coordinated the simultaneous actions and helped prepare European Investigation Orders and mutual legal assistance requests.

Can EU authorities order the provider directly instead?

Yes, since 18 August 2026, for stored data. The e-Evidence Regulation lets a judicial authority order a service provider "offering services in the Union" to produce or preserve data. That holds "regardless of the location of the data" (Article 1).

A provider offers services in the Union when people there can use them and it has a substantial connection. That connection exists with an EU establishment, a significant number of EU users, or activity targeted at member states (Article 3(4)). Orders go to its designated establishment or legal representative in a member state.

The order reaches only data stored when it arrives. Production is due within 10 days, or 8 hours in an emergency. Denmark does not take part.

This page explains published law; it is not legal advice.

Will I be told before my server is seized?

Often not. Secrecy is built into these tools. Budapest Article 16(3) makes parties oblige a data custodian to keep a preservation order confidential.

Under the e-Evidence Regulation, the issuing authority must inform the person whose data it takes. National law can let it delay, restrict or omit that notice, and the provider must keep the order secret (Article 13). Why a published canary cannot fill that gap is on what a warrant canary is, and whether hosts publish one.

What could Ravenquay be asked to hand over?

Only what it holds. No logs: neither connection nor traffic records, no IP address of any visitor or customer, and no trace of how you found the site apart from a referral code if your link had one. We hold only what billing and operating your server need: the account number and an email if you add one; every top-up and order (amount, coin, network, transaction ID, date); and per server its name, plan, term, location, system, SSH public key, IP addresses and dates, as well as the temporary root password we set when you gave no key, which no longer opens the server once you change it. We have no control over the datacenter’s network equipment. We hand over records only when a Panamanian court orders it.

Ravenquay belongs to DomaineGoat LLC, a company incorporated in Panama that answers to Panamanian law alone. The datacenter holding each server operates under the law of its own country. The machine itself stands in the datacenter, so that country's police can reach it under their own law. Why the company sits in Panama is on is Panama a good jurisdiction for a hosting company.

Ravenquay checked 34 dedicated-server hosts on 30 October 2026: 28 took crypto, but only 13 never required an ID document. A host can only hand over the identity papers it collected. How each country treats stored data is on which European countries still have data retention laws.

How do I protect data on a server that could be seized?

Encrypt it, and keep the keys elsewhere. Encryption protects data at rest against theft, resold disks and unlawful access. The cryptsetup project's FAQ gives the ground rules for LUKS:

• Passphrase: for LUKS1 and LUKS2, use more than 65 bits of entropy, such as 14 random lowercase letters.
• Header backup: make one, and keep it off the server. With the passphrase, a header backup still opens most or all of the data.
• Keys: never store the key file or passphrase on the machine it protects.

Once unlocked, an encrypted volume reads in the clear to whoever runs the system. Customers get no IPMI or KVM-over-IP console; the team carries out the reboots and reinstalls you ask for in the dashboard. An encrypted system disk would therefore need a network unlock at each boot. A simpler layout encrypts a data volume that you open over SSH after each reboot.

Encryption does not change your legal duties. Budapest Article 19(4) lets authorities order people who know how a system is protected to give necessary information. No backup service is included, so store copies of your data elsewhere.

Prices for all four locations are on how much a Ravenquay unmetered server costs.