Hosting in Malaysia: research for the host decision
As of: 2026-09-28. Sources were fetched 2026-09-27/28. Anything dated before about 2025-09 is
marked [stale]. “Not found” means it could not be confirmed. It does not mean the answer is no.
For: the host decision that blocks the infrastructure items I1–I15 in
2026-09-25-operator-console-progress.md §4.1, and
RUNBOOK §1 (records and backups stay in Malaysia, ITA s.82(8)).
Status: research, not a decision. The open questions at the end go to the tax agent review
the roadmap already requires.
1. Comparison
Section titled “1. Comparison”Price is for roughly 4 vCPU / 16 GB, one server.
| Provider | MY region / DC | 2nd MY site | Object lock in MY | Managed Postgres in MY | Residency wording | ~Monthly |
|---|---|---|---|---|---|---|
| AWS | ap-southeast-5 Kuala Lumpur, 3 AZs, since 2024-08 (blog) |
Yes: S3 keeps data in ≥3 AZs (S3) | S3 Object Lock, governance and compliance (docs). Not confirmed for this region specifically | RDS PostgreSQL yes (2024-12) [stale]; PG 17 not verified | “will not move or replicate your content outside of your chosen AWS Region(s)”, with an exception for what is “necessary to provide the services” (FAQ). DPA applies automatically | Lightsail 4 vCPU/16 GB/320 GB $84 (pricing); EC2 about $111–127 |
| Azure | Malaysia West, 3 AZs, no paired region (list) | Yes (ZRS) | Immutable Blob, locked policy cannot be shortened (docs). Not the S3 API | PG Flexible Server yes; geo-backup not offered there, so backups stay in region (overview) | “store Customer Data at rest within the specified Geo”, but some services “may store backups in other locations” (terms) | About $164 (estimate) |
| Alibaba | ap-southeast-3 Kuala Lumpur |
Probably (zone count from a third party only) | OSS WORM, compliance-like, up to 25,550 days (docs) | ApsaraDB RDS PG since 2017 [stale]; PG 17 in MY not confirmed | DPA §6.1 contemplates “a transfer outside Selected Region” (DPA) [stale] | Not found |
| Huawei | my-kualalumpur-1, access by application |
Not found | OBS WORM, compliance only (docs) [stale] | RDS PG 9.5–13 only, no 17 [stale] | “will not move or share Your Content without consent” (paraphrase) | Not found |
| Oracle | Malaysia West 2 (Kulai), 1 AD, since 2026-02 (note) | No | Retention rules, but not together with versioning (docs) | Not found | Not found | Not found |
| Google Cloud | No MY region live yet (locations) | — | — | — | — | Excluded |
| IP ServerOne (local) | NovaCloud; DCs in Cyberjaya ×2 and AIMS KL (page) | Likely: object storage “runs across 2 different data centers”, not stated both in MY | S3 API; object lock not found | No | Not found | NovaCloud C4 4 vCPU/15 GB RM161 + disk (KB) |
| Exabytes (local) | Tier III DC in MY (page) | Not found | No object storage | No | Not found | NVMe C5 4 vCPU/16 GB/200 GB RM153 (plans) |
| Shinjiru (local) | Menara AIMS KL, CX2 Cyberjaya (page) | Possibly (VPS in each DC) | No object storage | No | Not found | 8 vCPU/8 GB RM122.90 on 36 months; no 16 GB plan |
| TM ONE / VADS | Twin cores: Klang Valley and Iskandar Puteri (page) | Yes | Not found | Not found | Marketing claim only, no contract wording | Enterprise sales |
Tencent Cloud opened a Johor region in 2026 (CRN Asia). It was not researched.
2. Traps: data leaving Malaysia without anyone deciding it
Section titled “2. Traps: data leaving Malaysia without anyone deciding it”- Azure Backup vaults default to GRS, and the choice is locked after the first backup (FAQ). Set LRS or ZRS explicitly.
- AWS’s exception (“necessary to provide the services”) leaves global services outside the promise. Lightsail DNS zones and CDN distributions live in us-east-1 (docs). Never put record content behind them.
- Local VPS “off-server” or Acronis backups (Exabytes, Shinjiru) do not say where they are stored. Treat them as non-compliant until the provider confirms in writing.
- IP ServerOne also runs SG and HK regions. Get written confirmation that both object-storage DCs are in MY.
- The app creates the bucket itself, without a lock.
cmd/apiandcmd/workercallEnsureBucketat startup (internal/platform/documents/s3store/s3store.go:60). If the bucket does not exist yet, they create it with no object lock and no versioning. MinIO cannot add the lock afterwards (RUNBOOK §1.1). Create the locked bucket by hand before the first start; the app then finds it and does nothing. Whether S3 can add a lock to an existing bucket was not checked. - Hosted logging, APM, error tracking, email and CDN SaaS would receive record data abroad. This is an inference, not researched. It matches RUNBOOK §1.2: self-host monitoring, as the console design already plans.
3. Recommendation (to confirm, not decided)
Section titled “3. Recommendation (to confirm, not decided)”Start with AWS ap-southeast-5: Lightsail (4 vCPU / 16 GB, $84) for api, worker and Postgres,
plus an S3 bucket in the same region with Object Lock in compliance mode, 8-year default
retention, for documents and backups.
- It has the strongest contract wording on location found, and S3’s ≥3 AZs covers “a second site” at availability-zone level.
- The app already talks to any S3-compatible store through
OBJECT_STORE_ENDPOINT, so it can point at S3 instead of a self-hosted MinIO. That removes one service to run. This has not been tested against S3. - Compliance mode settles the governance-vs-compliance question from the progress doc §3, and it is chosen when the bucket is created.
Lower-ops variant: the same, with RDS PostgreSQL Multi-AZ instead of Postgres on the
server. RDS automated backups keep at most 35 days, so the 8-year copies are still
pg_dump or base backups written to the object-locked bucket.
Cheaper local route: Exabytes or IP ServerOne at about RM150–160. These have no object lock and no contract wording on location found, so MinIO must be self-hosted, and a second MY provider is needed for the second site. That costs more work than it saves at this size.
4. Questions for the tax agent / lawyer
Section titled “4. Questions for the tax agent / lawyer”- Does AWS’s “necessary to provide the services” exception satisfy ITA s.82(8)?
- Is a second availability zone in the same region a sufficient second site for backups?
- Does keeping records with a foreign-owned provider in MY need LHDN approval or notice?
- Is the provider’s standard DPA adequate for our PDPA 2024 processor obligations?
- Must backups be encrypted with keys only we hold?
5. Not verified
Section titled “5. Not verified”- S3 Object Lock and RDS PostgreSQL 17 named explicitly for
ap-southeast-5 - Azure immutable Blob and VM prices in Malaysia West
- Alibaba zone count, ECS price, PG 17 in MY
- Huawei zone count, prices, PostgreSQL newer than 13
- Oracle PostgreSQL and retention rules in Kulai
- IP ServerOne object lock, versioning, DPA
- Exabytes / Shinjiru backup location and DPA
- TM ONE / VADS object storage, pricing, contract wording
- Any Malaysian cloud certification (only IP ServerOne’s MySTI found)
- The exact AWS DPA clause text (taken from AWS’s FAQ and whitepaper, not the PDF)
- The wording of ITA s.82(8) itself (taken from RUNBOOK)