Servers in country
Providers with exit locations in Congo - Brazzaville: a server here gives you an address in the country. The register’s table records no mandate for VPN operators here; the briefing below sets out what the law asks of providers.
Only a few providers publish an exit here.
Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.
Congo-Brazzaville’s Law no. 26-2020 on cybersecurity sets a ten-year retention period for connection and traffic data, binding both network operators and providers and operators of information systems, whose installations a judicial authority may order searched or seized.
Law no. 26-2020 of 5 June 2020 on cybersecurity (Journal officiel of 11 June 2020) obliges operators of electronic communications networks and providers of electronic communications services to keep connection and traffic data for ten years and to install traffic-monitoring mechanisms whose data can be reached in judicial investigations (art. 21). Operators are liable if that data is used against users’ fundamental rights and freedoms.
Article 25 imposes the same ten-year duty on operators of information systems, and lets a judicial authority order their installations searched or seized. Under law no. 27-2020 on cybercrime, a provider of public online communication services commits an offence if it fails to keep data identifying whoever helped create content it hosts (art. 38).
Law no. 26-2020 also requires a prior declaration to supply or import cryptology beyond authentication (art. 30). Whether a VPN operator is covered is not established.
Law no. 27-2020 makes it an offence to create, download, distribute or make available racist and xenophobic material through an information system, with six months to five years and a fine of 1,000,000 to 10,000,000 CFA francs (art. 31).
A provider of public online services that offers no accessible way to report illegal content, such as incitement to racial hatred, child pornography or terrorism, or does not promptly inform the authorities of reported illegal activity, also commits an offence (art. 37).
Threatening or insulting a person through an information system because of membership of a group defined by colour, descent, national or ethnic origin or religion (and, for insult, political opinion) carries six months to five years and the same fine (arts. 32–33).
Accounts are identified through courts and prosecutors: the prosecutor or investigating judge may order any person in Congo, or a provider offering services there, to hand over stored data, including subscriber data (art. 99), and may collect traffic data in real time or require the provider’s help (art. 100).
The coercive measures sit with the prosecutor or investigating judge: real-time interception of content and traffic data (arts. 96, 100) and production orders (art. 99).
A provider drawn into real-time collection must keep it secret on pain of the professional-secrecy penalties (arts. 97, 101). Installing remote monitoring software in a suspect’s system needs a judge’s authorisation on application (art. 102). The order of the rows is the security score, and a server’s location is not a recommendation.
Congo - Brazzaville
Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.
A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.
More countries