Servers in country
Providers with exit locations in Syria: a server here gives you an address in the country. The register’s table records no mandate for VPN operators here; the briefing below sets out what the law asks of providers.
Only a few providers publish an exit here.
Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.
Syria’s cybercrime statute of 2022, Law No. 20, obliges internet access, hosting and application providers to keep traffic data or a copy of content, and punishes a failure to do so. Article 51 of the interim Constitutional Declaration keeps existing legislation in force unless amended or repealed.
Law No. 20 of 2022 on cybercrime sets retention duties by type of provider. Access providers must keep all subscribers’ traffic data, for a period the regulatory authority sets (article 3). Hosting providers must keep a copy of the traffic data and of the content hosted with them (article 4). Application providers must keep a copy of the content exchanged through them, with the traffic data identifying who contributed it (article 5).
A provider that fails to keep the copy or the data faces one to six months’ imprisonment and a fine of two to four million Syrian pounds (article 6). Article 51 of the Constitutional Declaration keeps existing legislation in force unless amended or repealed. Whether a VPN operator counts as an access, hosting or application provider under the law is not established.
In July 2026 Amnesty International called for the law to be suspended and substantially amended. As of 25 July 2026, according to Al Jazeera, the Ministry of Justice had formed legal and technical committees to re-study several laws, the cybercrime law among them.
The Constitutional Declaration makes it a crime to glorify the former government and its symbols, or to deny, praise, justify or play down its crimes (article 49).
Law No. 20 punishes anyone who creates or manages a website or page, or publishes digital content, intended to bring about an unlawful change of the constitution, the separation of Syrian territory or armed insurrection against the constitutional authorities, with seven to fifteen years’ temporary detention and a fine of ten to fifteen million pounds (article 27).
A court may block a website or information system for three months to three years, or permanently, where it was used with its owner’s knowledge to commit an offence under the law (article 37).
Law No. 20 punishes electronic defamation: a fine where it is not public, one to three months’ imprisonment and a fine where it is public, raised to three months to a year where it targets a person performing a public duty (article 24). Insult is a separate offence (article 25).
Spreading false news online that could undermine the prestige of the State or national unity carries three to five years’ imprisonment and a fine of five to ten million pounds (article 28).
The identity of a poster comes from the providers’ stored data on who contributed an item (articles 4 and 5). The judicial police, with the public prosecution’s permission, may seize and search information-technology equipment wherever it is located (article 38), and the owner or manager of a system used for an offence must let them search and seize (article 39).
The Constitutional Declaration says the judiciary is independent and that judges are subject only to the law (article 43), and it prohibits exceptional courts (article 44). It provides for dissolving the existing Supreme Constitutional Court and creating a new one of seven members appointed by the President of the Republic (article 47). It guarantees freedom of expression and makes a violation of the sanctity of private life a crime (article 13).
Human Rights Watch has said the Declaration lacks clear safeguards for judicial independence in practice and gives the president significant authority over judicial and legislative appointments. The order of the rows is the security score, and a server’s location is not a recommendation.
Syria
Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.
A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.
More countries
Coverage147countries
Paying monthly$9.99monthly
Paying yearly$53.88yearly total
Free tierYeslimited free plan
Devices10at once
Security
Usability
Coverage168countries
Paying monthly$11.99monthly
Paying yearly$47.84yearly total
Free tierYeslimited free plan
Devices5at once
Security
Usability
