Servers in country
Providers with exit locations in the Seychelles: a server here gives you an address in the country. The register’s table records no mandate for VPN operators here; the briefing below sets out what the law asks of providers.
Only a few providers publish an exit here.
Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.
Seychelles has a dedicated cybercrime statute in force since 1 February 2022 that lets investigators order 90-day preservation of data and, through a court, production of subscriber information, without setting any retention period for providers. Its Data Protection Act 2023 does not apply to national security or to personal data processed by authorities in a criminal investigation.
The Cybercrimes and other Related Crimes Act, 2021, in force since 1 February 2022, lets an investigatory authority order preservation of computer data, traffic data included, for up to 90 days; longer needs a court (s. 20). It may also order disclosure of traffic data sufficient to identify the providers involved and the path of a communication (s. 21). It sets no period for which a provider must keep data.
A court may compel an electronic service provider to submit subscriber information (s. 22) and, within its technical capabilities, to collect traffic data in real time (s. 24). The Act defines that provider as an entity enabling users to communicate by computer system, or processing data for one. Whether it reaches a VPN operator is not established.
As of 24 November 2025, a bill published that day (Bill No. 22 of 2025) would amend the Act, among other changes by letting a court order a service provider to collect or record content data in real time (new s. 24A).
The Act authorises a court, on application by an investigatory authority, to order that indecent material of a child be no longer stored on or made available through a computer system, or be deleted or destroyed (s. 25). The material itself is an offence under section 17, which covers publishing, producing, possessing and accessing child pornography, punishable by up to five years’ imprisonment.
Section 14 punishes using a computer system to send a message that is abusive, obscene, indecent, threatening, false or misleading and causes annoyance, inconvenience or distress, with up to five years’ imprisonment. Section 16 covers offensive electronic communications used to disturb a person’s peace or privacy, and section 18 the sharing of a private sexual photograph or film without consent, each with the same ceiling.
Account identification runs through the orders in sections 21, 22 and 24. An electronic service provider that discloses that an order exists, or what was done under it, commits an offence (s. 19).
The Act divides its powers. Preservation and traffic-data disclosure are ordered by the investigatory authority itself (ss. 20–21); production orders, search warrants and real-time traffic collection require an application to a court (ss. 22–24). Interception of non-public transmissions without authority is an offence carrying up to five years (s. 6).
The Data Protection Act 2023, enforced by the Information Commission, does not apply to processing of personal data by relevant authorities in a criminal investigation or to matters pertaining to national security (s. 4). The order of the rows is the security score, and a server’s location is not a recommendation.
Seychelles
Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.
A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.
More countries
What moved
Every row is the record’s own history[], filtered to U02_server_countries and P04_mandate_response; the whole log holds every field.
29 Aug 20261 changes
NordVPNResponse to a national logging mandateP04_mandate_response
not on the record changed to withdrew_physical
Coverage149countries
Paying monthly$14.99monthly
Paying yearly$139.08yearly total
Free tierNopaid plans only
Devices10at once
Security
Usability
Coverage168countries
Paying monthly$11.99monthly
Paying yearly$47.84yearly total
Free tierYeslimited free plan
Devices5at once
Security
Usability
