After researching the EU data retention situation, here's what I found.
Switzerland is looking less reliable. ProtonMail handed over that activist's IP in 2021, and they've been signing EU cooperation agreements through 2024-2025. The privacy reputation seems more marketing than reality now.
Panama works for legal incorporation and jurisdiction protection, but server latency to EU is 180ms+ which kills performance.
Serbia is actually interesting: not in the EU so no data retention laws, 25ms latency to EU cities, low costs, and they don't automatically cooperate with requests. Seems like the best option for EU-facing infrastructure right now.
The setup that makes sense: Panama for legal entity (jurisdiction protection), Serbia for servers (performance), Russia/Kazakhstan as fallback.
Anyone else looked into Serbian hosting providers?
Sorry, but it sounds like a joke. As a Russian citizen I can say that Russian authorities has too many powers in collecting personal data and they are using it for repressions, and I'm not even talking about censorship.
Talking about Kazakhstan, there are much more freedom(comparing to Russia), but it still not the best jurisdiction for VPN.