The 14-Eyes alliance explained for hosting buyers: the rings, the law, and where to rack

Five, Nine, Fourteen Eyes is an intelligence-sharing map, not hosting law. What membership changes for a rack, what it does not. VPS from $3/mo, 40 locations.

Published 2026-08-30 · Updated 2026-10-14 · FYRHost Editorial · 14 min read

Three rings and one treaty

The Five Eyes — the United States, the United Kingdom, Canada, Australia and New Zealand — share signals intelligence under standing agreements whose lineage runs back to the UKUSA pact of 1946. Nine Eyes adds Denmark, Norway, the Netherlands and France; the Fourteen-Eyes ring completes the set with Germany, Belgium, Italy, Spain and Sweden. The structure is a map of who passes intercepts to whom with how much ceremony — the inner 5, the added 9, the full 14.

The counter-intuitive part for you as a hosting buyer: the rings are a sharing arrangement between agencies, not a surveillance statute and not a hosting regulation. No article of any Eyes agreement tells a datacenter what it may host, what it must log, or when it must answer a subpoena. Those questions are answered by the national law of the country where your rack stands, and by nothing else. The map describes how intelligence moves between governments; it is silent on how a hosting company behaves toward you.

What the agreement family actually produced is institutional: joint facilities, common tradecraft, and historically programs like ECHELON that gave the alliance a public face. The shared vocabulary is real, which is exactly why the term escaped the classified world and became shorthand — but shorthand for one specific question, not a legal classification your server either passes or fails.

The buyer mistake is inverting the logic: treating “inside the ring” as a property of your server rather than a property of relationships between governments. A rack in Amsterdam is governed by Dutch and EU law that applies to everyone equally; the alliance neither adds a clause for you nor removes one.

Why buyers reach for the map anyway is the next question, because the borrowing is more rational than it first looks.

Why hosting buyers borrow the term

The operative question for your server is narrow: if an agency obtains account data, would it pass to a foreign counterpart casually or only through documented process? Membership in the alliance is a usable proxy for that answer, which is why every serious outside-the-14-Eyes comparison puts the map next to KYC policy and coin list. The term survives because it compresses a real difference in inter-agency friction into one image you can reason with.

Inside a member state, cooperation among the 5, 9 or 14 partners is institutionalized — shared tools, shared facilities, decades of habit. Outside the club, the same data movement must route through slower machinery: a formal MLAT request, a treaty channel, or the targeted-provider pathways described for surveillance contexts in RFC 7624. Neither setting is a wall, and you should plan accordingly: the map describes the speed and ceremony of data travel between governments, not whether data can travel.

The borrowing has hard limits that the shorthand hides from you. Membership says nothing about the host’s own logging: a no-logs rack inside the ring keeps less account data than a chatty one outside it. It says nothing about the domestic surveillance powers of non-member states, several of which run mass surveillance programs of their own. And it says nothing about what you disclose yourself through a public-chain payment — the topic of the VPS anonymity guide.

Treat the rings as one dial among several, ranked after the ones that actually gate your purchase, and the term does useful work. Treat it as a verdict and it will mis-rank two nearly identical racks for you.

Where the members sit relative to this catalog’s forty sites is the next fact to pin down.

The members, and where this catalog racks

Amsterdam is the catalog’s one rack inside the Fourteen, and it is racked deliberately: AMS-IX is the densest peering fabric on the list, and the latency to your western European readers is the best in the catalog. That trade is published, not hidden — EU and Dutch process in exchange for milliseconds. The full flag-by-flag reasoning lives in the jurisdiction chooser.

Outside the alliance, the three signature postures are all represented for you. Iceland sits outside the rings and the EU, pairs the rack with no mandatory data-retention mandate, and carries a +20% location premium; the Reykjavik page lists the site. Switzerland is outside the rings and the EU with its own judicial overlay under the Swiss FADP at a +35% premium; see the Zurich page. Bucharest is inside the EU but outside the alliance, pairing EU transit with a national retention regime struck down in 2014.

Across all 40 locations the list price is one number, with 6 published premiums — Iceland and Norway at +20%, Switzerland at +35%, Luxembourg, Cyprus and Panama at +15% — and the remaining thirty-four at base list. Non-member coverage is wide: Iceland and Switzerland from the posture shelf, plus sites across Latin America, Africa, the Middle East and Asia at base pricing. The alliance is a thirteen-country question; your catalog is a forty-city answer.

The mistake to avoid is reading the map as the menu. Two racks inside the ring differ from each other more than a ring member differs from some non-members, because national law — not ring membership — writes the operating rules that will govern your data.

What membership actually changes for a given rack, mechanically, is worth stating precisely.

What membership changes for a rack

Inside a member state, two things differ in practice, and both eventually touch you. Account data that an agency lawfully obtains can move between allied services faster and with less formality, because the sharing habit is institutional. And the intelligence services of the other members treat that country’s cable and facility landscape as shared terrain, a reality the historical programs made public. Neither effect touches the hosting company’s conduct directly; both describe what happens to your data after the local law has done its part.

What membership never changes is the legal regime your rack lives under. Amsterdam runs the GDPR — Regulation 2016/679, with its consent, purpose-limitation and transfer chapters — plus Dutch criminal procedure. Iceland applies the EEA mirror of the same framework. Switzerland runs FADP with adequacy from Brussels. Alliance membership appears nowhere in any of those texts as an operating clause; it neither voids GDPR in Amsterdam nor replaces Swiss process in Zurich, and you should not price it as if it did.

For you the mechanical differences compress into speed-of-process questions: how fast a preservation request moves, whether review happens before or after collection, and whether a foreign partner receives your data with a signature attached. A buyer whose threat model is “foreign civil claimant with template mail” is unaffected by all of it — that traffic pattern is governed by copyright procedure, which the DMCA guide covers separately. Match the dial to your threat, not to the loudest acronym.

The common misreading is treating membership as a switch with two states, safe and unsafe. Every state on the map is safe for lawful workloads and hazardous for prohibited ones; the alliance tilts paperwork speed, nothing more — and your workload is lawful.

The other side of the ledger matters just as much: what the rings demonstrably do not change about a purchase.

What it does not change

Rack reality is jurisdiction-blind, and that blindness works in your favor. IPMI, ECC memory and RAID ship identically on every dedicated tier in every city; DDoS filtering rides on every plan; KVM virtualization runs the same kernel-spinning machinery in Reykjavik as in Amsterdam; provisioning takes about a minute for your VPS and 2–4 hours for metal, everywhere. Nothing on the intelligence map alters one screw in the chassis you are renting.

The checkout is equally map-blind. 19 coins clear your invoice at every site, the account is a token or an email plus a 12-character password at any spend, and the annual term takes the same 20% off the USD total before coin conversion. A buyer who picks Iceland over Amsterdam changes the premium line on the invoice and nothing else in the commerce. That is by design: jurisdiction is a product decision, not a tax on the rest of your catalog.

What the map also does not change is the legibility of your payment. Public chains print their records regardless of latitude — a BTC or USDT invoice is equally readable to whoever later obtains the address, inside the ring or far outside it. Monero hides the amount and the counterparty on XMR rails anywhere; the choice is made at the checkout page, not at the border. The Monero payment guide covers the mechanics.

The recurring buyer error here is spending the whole decision on the map and none on the payment, then discovering that the paper trail led home from a non-member rack perfectly well. The rings never touched your ledger.

Because the payment rail is its own surveillance question, it deserves the same structured treatment the map gets.

The payment rail is its own map

Coins sort into three legibility classes, and the class you pick matters more to most buyers than the ring a rack sits in. Bitcoin and the public USDT networks write address, amount and timing to a permanent ledger anyone can read. Monero hides sender, receiver and amount cryptographically. Everything else sits between, with stablecoins adding a special case: the issuer can freeze specific addresses on ERC-20 and TRC-20, so your rail carries issuer risk that XMR and BTC do not.

The checkout operationalizes your choice: one invoice binds to exactly one network, the watcher credits the exact printed amount against a single-use address, and 19 coins share the same page. Nothing in the flow asks who you are — the whole identity payload is an email string or a 32-character token — so KYC cannot leak what the checkout never collects. The rail decision is the one place where your privacy is decided in one move and cannot be re-rolled after your transfer lands.

The practical failure is upstream, at the off-ramp. Coins bought through an identity-checked exchange carry that link forever, and no rack choice downstream un-does it: the ledger shows your withdrawal, the exchange shows your name. Fund invoices from coins already in your own wallet — the anonymity guide walks the full chain. The map-versus-rail comparison is lopsided in effort terms: buyers obsess over the first and improvise the second, and it is the second that names you.

A non-member flag plus a public-chain invoice funded from a KYC exchange is weaker end to end than an Amsterdam rack funded quietly — a sentence worth rereading before the next section, because retention law rewinds the story to the state side again.

Retention law, the other dial

Jurisdiction’s second axis is data retention, and it cuts across the ring map at right angles. The EU’s attempt at a blanket regime, the Data Retention Directive, was annulled by the Court of Justice in 2014, and national transpositions have been falling since; Iceland never carried a comparable domestic mandate, and Switzerland runs its own regime under FADP. Ring membership predicted none of that for you — courts and parliaments did.

The host-side numbers sit on top of the national rules: no payload or guest traffic logs, connection metadata kept at most 24 hours, billing records held as the operating company requires. That is the retention surface you can verify in a policy before paying, and it is shorter than what most jurisdictions would ever mandate. The full-disk encryption guide covers the layer you control on the box itself.

Legal review standards differ along the same axis, and they protect you unevenly but genuinely. The convention behind European process — the ECHR, with its Article 8 privacy guarantees — sets a floor of necessity and proportionality that domestic courts enforce case by case. A rack outside those frameworks may have fewer formal safeguards, not more: the safe-sounding adjective on a storefront is not a substitute for a written, reviewable process you can read. “Outside the Eyes” and “protected” are two different claims, and only one of them appears in any statute.

The buyer mistake is collapsing retention, process and alliance into one verdict. They are three columns; fill them separately for your two or three finalist flags and the choice usually makes itself.

With all the dials named, the purchase decision itself has a natural running order — and latency, not lineage, sits surprisingly low on the list for some buyers and surprisingly high for others.

Ranking the decision factors for a purchase

Order the criteria the way failures actually happen, and you will rarely mis-buy. Acceptable use first, because a workload outside the AUP has no jurisdiction that saves it. KYC posture second, because the account is your identity surface. Coin support third, because the rail decides ledger legibility. Jurisdiction fourth — the Eyes map, retention law and process posture all live here — and latency to your readers fifth, except when it is first.

That last clause is the counter-intuitive one, and it may flip your shortlist. For a trading dashboard, a mail relay or anything interactive, milliseconds outrank the intelligence map: an Amsterdam rack serves your Frankfurt readers fastest, and no flag choice compensates for a slow round trip. For a publishing archive or a Tor service, the ranking flips — posture dominates and a +20% or +35% premium buys exactly what the workload is for. The jurisdiction hub ranks every flag on the catalog by these columns.

Hardware runs parallel to the whole ranking and never interacts with it: VPS from Scout at $5.49 list ($3.00 annual-eff) to Sentinel at $33.50 ($26.80), metal from Shield at $38.50 ($30.80) with IPMI and ECC on every tier, storage from $30/mo at $24/TB annual-eff. Order the Sentry at $7.50 list ($6.00 annual-eff) in whichever flag wins your analysis and the same box stands up in about a minute. The mistake is letting the hardware discussion consume the jurisdiction discussion — the box is the same everywhere; the flag is not.

One more ranking rule from the field: decide the two or three columns that are non-negotiable for your threat model before opening the catalog, because otherwise the premium rows will negotiate you upward without your noticing.

Everything above collapses into a short sequence you can actually run at purchase time.

The jurisdiction decision, in the order to run it

Run it in five moves. First, write your threat model in one sentence — whose process are you trying to slow, and what data would they want — because every later step ranks against it. Second, confirm the workload sits inside the AUP; if it does not, stop here, because no ring position changes that. Third, shortlist two flags on the columns that matter: alliance membership, retention law, process posture, and the premium each charges — Iceland at +20% for speech posture, Switzerland at +35% for judicial process, Amsterdam at base list for milliseconds under full EU rules.

Fourth, decide your payment rail with the same care: XMR when the invoice should carry no readable trail, USDT when the budget wants a stable dollar figure, BTC when auditability is the point — and fund from coins already in your own wallet, one exact transfer per invoice. Fifth, size the box independently of the flag: the ladder from Scout to Sentinel, metal from Shield when whole cores and IPMI matter, the storage tiers for archives — all identical across the map, so nothing you learned here changes at checkout.

Then verify rather than assume, because each of the five moves has a checkable output. Confirm the facility country on your service detail after provisioning matches the flag you paid the premium for. Keep the account token and the recovery file offline, on media you control, since the 32-character token is the only key to the account and support cannot reissue it. Write the one-sentence rationale down — which flag, which rail, which threat — and date it.

Six months later that sentence, not the marketing page you read first, is what tells you whether to renew, resize or move: if the threat never materialized and latency never bothered your users, the premium bought posture you did not spend, and the next term is the moment to reconsider. If the opposite happened, you already know which dial to turn. The rings are one input to one sentence; your sentence is the product.