Why we are domiciled in Panama (it is not the cliché)

When you read a VPN privacy policy that ends with "Domiciled in Panama" or "Headquartered in the British Virgin Islands," it is reasonable to assume marketing. There is a script the industry follows: pick a small jurisdiction with no data retention law, put your boilerplate into a privacy policy, call yourself "no logs." Panama gets used so often it has become a punchline.

We did pick Panama. It was not for the cliché reasons. Here is the actual decision tree.

The criteria that mattered to us

• No mandatory data retention law for telecommunication operators.
• A judiciary that has historically required individualised, narrow warrants — no bulk requests.
• Not part of the Five Eyes, Nine Eyes, or Fourteen Eyes intelligence-sharing arrangements.
• A reasonable bar for incorporating and operating a foreign-owned company.
• A central government that does not have a track record of de-platforming privacy companies under pressure.

Why Switzerland, BVI, and Iceland did not win

Switzerland

Romantic, but not what it used to be. Switzerland passed the BÜPF revision in 2018, which expanded data-retention obligations on internet service providers. The law has carve-outs for VPNs and small operators, but those carve-outs depend on a regulator that has been quietly tightening interpretations. We watched ProtonMail navigate that and decided we did not want the politics.

British Virgin Islands

The BVI has been heavily used by hedge funds and shell companies, and that use has invited international pressure. Operating a privacy company there increasingly attracts more scrutiny than the privacy gains justify.

Iceland

Genuinely good track record. Excellent infrastructure, including geothermal-powered data centers. The reason we did not pick it: every transit cable in or out of Iceland is concentrated through a small number of submarine choke points, all of which pass through Five Eyes territory. The legal protections are great; the network topology is not.

Why Panama

Panama law specifically does not require ISPs or hosting providers to retain user activity logs. The constitution protects communications privacy. The judiciary has demonstrated, in repeated cases, that warrants for individual subscriber data must be narrow and supported by probable cause.

Equally important: Panama is geographically central. Network-wise it sits between South America, North America, and Europe with high-quality undersea cables in three directions. We can run servers in friendly jurisdictions and route traffic through Panama back-haul without latency penalties.

The trade-offs (which we will own)

• Banking is harder. International transfers from a Panamanian entity attract more compliance friction than from an EU entity. We pay a small premium for treasury services.
• Reputational shorthand. Panama has been associated with the Panama Papers since 2016. We are explicitly not in any of those structures, but the association exists.
• Hiring locally is constrained. Most of our engineers are remote from Bangalore, Berlin, and Lisbon. Panama is the legal home; the staff lives elsewhere.

What this means for your data

A correctly-served subpoena in Panama, requesting your VPN activity, returns nothing — because nothing exists, and because Panamanian law does not compel us to start collecting it. A subpoena in another jurisdiction is unenforceable against us; foreign courts cannot directly compel a Panamanian entity. We can be asked nicely; we can be sued for breach of contract; we cannot be ordered to hand over what we do not have.

This is not a tax dodge or a flag of convenience. It is structural privacy, paid for in operational complexity. If that calculus changes — if Panamanian law shifts, if the judiciary changes character — we will say so on the transparency report, in the blog, and on the home page.