Can I avoid Indian law by hosting a porn website on a foreign server?

No. If you run the website from India, the acts of publishing and transmitting happen in India, so IT Act 67 and 67A apply to you. Section 75 of the IT Act also extends the Act to offences committed outside India that involve computer systems in India.

Does Vercel or Render allow adult or porn websites?

Vercel's Acceptable Use Policy bans unlawful, sexually exploitative and abusive content and child sexual exploitation, and allows immediate suspension. Render's policy bans unlawful and objectionable content, including content depicting child sexual exploitation, and allows investigation and termination. In India, publishing sexually explicit content is itself an offence under IT Act 67A.

How do Indian police trace the owner of a website?

Police use orders under BNSS Section 94 to obtain records from domain registrars, hosting providers, payment gateways, email providers, telecom operators and ISPs. Linking any one of these to a real identity is usually enough, followed by device seizure and forensics.

How long do hosting and VPN companies keep customer details in India?

Under the CERT-In directions of 28 April 2022, data centres, VPS providers, cloud service providers and VPN providers must keep validated customer names, addresses, contact numbers, emails, IP addresses and registration details for at least 5 years, even after the account is closed. All service providers must keep logs for 180 days within India.

Does domain privacy protection hide my identity?

Domain privacy hides your details from the public WHOIS listing. The registrar still holds your registration and payment details, which can be obtained through legal requests.

Can the government block an adult website hosted abroad?

Yes. The government can block websites under Section 69A of the IT Act, and the Department of Telecommunications orders ISPs to block them. 827 porn websites were blocked in 2018 and 67 in 2022, and 25 OTT apps were blocked in July 2025.

Does putting the app under a foreign company protect the Indian operator?

No. In the 2021 Hotshots app case, the app had been transferred to a London-based company, yet the people running it were arrested in Mumbai and the Enforcement Directorate later conducted raids in a money laundering probe.

Web Development Cyber Law for Developers

Can You Hide a Porn Website on Vercel, Render or Offshore Servers? How Indian Police Trace Website Owners

Q: Does Cloudflare hide my server IP from police?

No. Cloudflare states that when it receives an abuse complaint about a site using its proxy, it forwards the complaint to the website operator and the hosting provider and shares the origin IP address so the content can be located.

Thinking of hosting a porn website on Vercel, Render or an offshore server to escape Indian law? This guide explains why it fails: IT Act Section 75, Vercel and Render policies, how Cloudflare shares your origin IP, the trail every website leaves, BNSS Section 94 police orders, CERT-In's 5-year KYC rule for cloud and VPS providers, and real cases where foreign companies and new domains did not help.

MetaSkillGroup

4 Oct 202612 min read6

Quick answer: No. Hosting a porn website on Vercel, Render, Netlify, a VPS or an offshore server does not protect an operator who lives in India. Indian law applies to you, not to where your server sits. Mainstream platforms like Vercel and Render prohibit illegal and sexually exploitative content and can suspend accounts instantly. Cloudflare forwards abuse complaints to your hosting provider along with your origin IP. Under the CERT-In directions of 2022, VPS, cloud and VPN providers serving India must keep validated customer details for 5 years, and police can demand records under BNSS Section 94. Every website leaves a trail: domain, hosting account, payments, code and logins all lead back to a real person.

Last updated: October 2026

Every developer knows how easy deployment has become. Push to GitHub, connect Vercel or Render, add a domain, put Cloudflare in front, and your site is live in minutes. That ease creates a dangerous illusion for some people:

"The server is in America. The domain has privacy protection. Cloudflare hides my IP. Nobody in India can touch me."

Every part of that sentence is wrong. This article explains, step by step, why hosting location does not protect you, what trail every website leaves, and how Indian police legally obtain that information.

This article is not a guide to hiding. It is the opposite: a clear explanation of why hiding does not work, so that no developer ruins their life believing it does.

This article is part of our series Running an Adult Website in India as a Developer: Laws, Punishments, Real Arrests and Why You Will Get Caught.

Does Hosting Outside India Avoid Indian Law?

No. Indian criminal law follows the person and the effect, not the server.

You are in India, so the offence is committed in India

If you build, upload to, manage or earn from a website while sitting in India, the acts of publishing and transmitting happen from India. The server's location is irrelevant. The offences under IT Act 67, 67A and 67B are about who publishes, transmits or causes content to be published, and that is you.

The IT Act reaches beyond India's borders

Section 75 of the IT Act extends the Act to offences committed outside India by any person, if the act involves a computer, computer system or computer network located in India. A porn site that serves Indian users runs straight into that.

The Bharatiya Nyaya Sanhita (BNS) also applies to offences committed by Indian citizens outside India.

The "foreign company" trick has already failed

In the 2021 Hotshots app case, the app had been transferred to a London-based company. That did not stop the Mumbai Crime Branch from arresting the people running it in India, or the Enforcement Directorate from later raiding around 15 locations in a money laundering probe. Read the full story in Real Arrests in India for Running Porn Websites and Sharing Illegal Content.

What Vercel, Render and Cloudflare Actually Allow

Many developers have never read the policies of the platforms they deploy on every day. Here is what they say.

Vercel

Vercel's Acceptable Use Policy prohibits using its services for any unlawful purpose, and specifically bans content that is sexually exploitative, abusive or otherwise illegal, as well as child sexual exploitation or abuse. Vercel says it can restrict, suspend or terminate your access immediately on notice.

Render

Render's Acceptable Use Policy prohibits unlawful, abusive or objectionable content, specifically including anything that promotes or depicts child sexual exploitation or abuse. Render says it can investigate suspected violations, remove content, and suspend or terminate accounts.

Cloudflare

Many people believe Cloudflare "hides" their server. In reality, Cloudflare publicly states that when it receives an abuse complaint about a site using its proxy, it forwards the complaint to the website operator and the hosting provider, and shares the origin IP address with them so the content can be located. Cloudflare also lists child sexual abuse material among the content it may block.

In short: the tools developers love are not neutral hiding places. Your hosting account is a contract, and illegal content breaks it. Since Indian law already makes publishing sexually explicit content an offence under IT Act 67A, a porn website hosted from India is illegal regardless of which provider you choose.

Every Website Leaves a Trail

A website is not one thing. It is a chain of accounts, payments and records, and every link in that chain is tied to a real person.

Trail point	What it records
Domain registrar	Registrant details, the payment method used, the IP address and time of purchase. "Privacy protection" hides this from the public, not from legal requests.
Hosting / deployment account (Vercel, Render, a VPS)	Login email, login IP addresses and times, linked GitHub account, payment card or billing details, deploy history.
Code repository	Commit history with names and email addresses, linked accounts and access logs.
CDN / DNS provider	The origin server IP and the account that controls the domain.
Payment gateway, ad network or crypto exchange	Bank account, PAN and KYC details. Money always has to land somewhere.
Email provider	Account creation details, recovery phone number, login IPs.
Telecom operator	Every Indian SIM is issued against identity documents.
Internet service provider	Which subscriber was using which IP address at a given time.
The website's own users	Complaints, screenshots, payment receipts and chats that end up with police.

You do not need to make a mistake in all of these. One is enough. Investigators only need to connect one point in the chain to a real identity, and then they can follow the rest.

Developers leave more trail than anyone else. The same habits that make you productive, such as a GitHub account, reused code, your usual email, your usual payment method and your usual laptop, are exactly what link an "anonymous" project back to you.

How Indian Police Legally Get This Information

Tracing is not hacking. It is a legal process that police use every day in cybercrime cases.

1. Orders to produce records: BNSS Section 94

Under Section 94 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), which replaced Section 91 of the old CrPC, a court or the officer in charge of a police station can order any person or company to produce documents or other things needed for an investigation. The section explicitly covers electronic communication and devices likely to contain digital evidence, and the order itself can be sent in electronic form.

2. Platforms must cooperate under the IT Act and IT Rules

Intermediaries operating in India must follow the due diligence duties in the IT Rules, 2021, which include providing information and assistance to authorised government agencies for investigating offences. A platform that refuses risks losing its safe harbour protection under Section 79 of the IT Act.

3. Hosting and VPN providers must keep your details for 5 years

On 28 April 2022, CERT-In issued directions under Section 70B(6) of the IT Act requiring:

All service providers, intermediaries and data centres to keep logs for 180 days within India
Data centres, VPS providers, cloud service providers and VPN providers to keep validated names, addresses, contact numbers, email addresses, IP addresses used, registration timestamps and the purpose of subscription of their customers for at least 5 years, even after the account is closed

Read that again: even if you close the account, the record stays for 5 years.

4. Foreign companies and international channels

For companies based outside India, investigators use mutual legal assistance treaties (MLATs), Interpol channels, and the platforms' own law enforcement request processes. For child sexual abuse material, US-based platforms report automatically to NCMEC, which shares reports with India through an MoU with the NCRB signed in 2019. In 2022, the CBI's Operation Megh Chakra raided 59 locations across India based on a lead that came from New Zealand Police via Interpol.

5. Device seizure and forensics

Once police identify a suspect, they seize phones, laptops and storage devices. Forensics recovers deleted files, browser history, saved logins, deployment keys and chat histories. The Supreme Court has made clear in child sexual abuse material cases that deleting files does not erase liability.

"Offshore" and "Bulletproof" Hosting: Why They Make Things Worse

Some people think the answer is a server in a country with loose rules. Here is why that fails for someone living in India:

You are still the operator. Indian law punishes the person who publishes. Your location, not the server's, decides that.
You still have to pay for it. Paying a foreign host creates a foreign payment trail from your bank, card or crypto account. Money leaving India for an illegal business can also bring in foreign exchange and money laundering investigations, as the ED probe in the Hotshots case shows.
The site gets blocked in India anyway. The government can block websites under Section 69A of the IT Act, and the Department of Telecommunications orders ISPs to block them. In 2018, 827 porn websites were blocked after an Uttarakhand High Court order, and 67 more in 2022.
"Switching domains" is noticed. When the Ministry of Information and Broadcasting blocked 25 OTT apps including Ullu and ALTT in July 2025, it specifically noted that some platforms had come back under new domains after earlier action.
It shows intent. Choosing a host specifically because it ignores complaints is strong evidence that you knew what you were doing was illegal.

Common Myths

Myth	Reality
"My site is on Vercel or Render, so Indian law doesn't apply."	Indian law applies to you. Vercel and Render also ban illegal and exploitative content in their own policies.
"Cloudflare hides my server IP."	Cloudflare forwards abuse complaints to your host and shares your origin IP with them.
"Domain privacy protects my identity."	Privacy hides you from the public, not from legal requests to the registrar.
"I'll close the account after a few months."	Under CERT-In 2022, cloud, VPS and VPN providers must keep your details for 5 years after closure.
"A foreign company owns the app, not me."	The Hotshots app was owned by a London company. People in India were still arrested.
"If they block it, I'll just change the domain."	The I&B Ministry flagged exactly this when blocking 25 OTT apps in 2025.
"I'll host in a country that ignores complaints."	You still pay for it from India, the site still gets blocked in India, and it proves you knew it was illegal.

For the identity side of this myth (foreign Gmail, US numbers, VPNs), read Using a Foreign Gmail, US Phone Number or VPN to Run a Porn Website From India? Why You Will Still Be Caught.

Key Takeaways

Server location does not matter. Your location does. If you run the site from India, the offence happens in India.
IT Act Section 75 extends the Act to offences outside India that involve computer systems in India.
Vercel and Render prohibit illegal and sexually exploitative content and can terminate accounts instantly.
Cloudflare forwards complaints and shares your origin IP with your host.
Every website leaves a trail: domain, hosting, code, payments, email, SIM and ISP records. Police need only one link.
BNSS Section 94 lets police order companies to hand over electronic records.
CERT-In 2022 requires cloud, VPS and VPN providers to keep customer details for 5 years.
Offshore hosting adds a foreign money trail, gets blocked in India anyway, and proves intent.

Use your deployment skills to ship products you can put your name on. Anything you have to hide from the law will eventually be found by it.

Read the full series

Disclaimer: This article is for general awareness and educational purposes only and does not constitute legal advice. Platform policies change over time; refer to each provider's current terms. For advice on a specific situation, consult a qualified lawyer.

Sources

#porn website hosting india
#vercel acceptable use policy
#offshore hosting india law
#how police trace website owner
#cert-in directions 2022
#bnss section 94
#it act section 75
#cyber law india
#developer legal guide
#website tracing india