Foreign hosting and 152-FZ
Art. 18(5) of 152-FZ requires databases with Russian citizens' personal data to reside in Russia. Formally it is about the database, not the web server — but a site on foreign hosting that accepts forms writes the data into a database right there, and that is the first thing an audit checks. Exposure under Art. 13.11(8) — up to ₽6M for legal entities, repeat (13.11(9)) — up to ₽18M.
Free online tool — compliance checker: instant results, no signup.
What the law actually requires
When collecting personal data, including online, the operator must ensure recording, systematisation, accumulation and storage of Russian citizens' data using databases located in Russia. The keyword is database: CDNs and static assets may live anywhere, but the DB receiving form submissions must be in Russia.
Typical configurations
- Site + DB on a foreign VPS — direct non-conformity when forms exist
- Foreign web server, DB in Russia — formally conforms, but the architecture needs proving in an audit
- Foreign SaaS forms (Typeform, HubSpot) — data lands in their foreign database: same problem plus cross-border transfer
- CDN in front of a RU server — fine: a CDN stores no database
Checking your site
Find the server country: dig +short site.ru → IP → IP geolocation. The compliance scanner does it automatically: the "Hosting outside Russia" rule fires when the server is abroad and pages carry PII forms — with the country and IP in the report.
Related
Why teams trust us
How it works
Enter your site URL
The scanner opens pages in a browser
Get a grade and a fix list
Why check your site for privacy compliance?
Regulators fine sites for processing personal data without consent — and a site starts processing earlier than it seems: analytics, pixels and widgets write cookies the moment the page loads. The scanner shows the auditor's view: what leaves for third parties before consent, whether the banner works, and whether forms collect data correctly.
Real Browser
Three sessions per page: no action, banner accepted, banner rejected.
Trackers and Jurisdiction
Service catalogue: who receives visitor data and in which country.
Policy at Collection Point
The policy link and consent element are checked next to the form, not in the footer.
Signed PDF
Report with an HMAC integrity stamp — hand it to your lawyer or contractor.
Who uses this
Business
preparing for an audit
Lawyers
technical facts for an opinion
Web Studios
client site handover
DevOps
consent regression monitoring
Common Mistakes
Best Practices
Monitor compliance automatically
Scheduled re-checks with an alert when pre-consent trackers appear on your site.
Sign up freeLearn more
Frequently Asked Questions
Is a formless brochure site on foreign hosting a violation?
By itself, no: with no PII collection there is nothing to localise. Counters and their identifiers are a separate consent-side question.
Is moving only the database enough?
Formally Art. 18(5) is about the database. But with a foreign web server the data still transits it; hosting both in Russia is simpler and safer.
How do I prove the database is in Russia?
A hosting contract naming the datacenter, an architecture diagram, and on request the application's DB connection configuration.
Try the live tool that powered this guide
Free plan — 10 monitors, checks every 5 min, no card required. Upgrade for 1-minute interval and multi-region monitoring.