Where the Baltic web actually lives: hosting and digital sovereignty

Ask where a country’s websites are hosted and the usual answer is a list of countries. The Baltic Web Audit, our near-census of the Latvian, Estonian and Lithuanian web in July and August 2026, also asked which company, and that question changes the picture. Two of the three national webs turn out to have a landlord. The third has a curtain.

In short

Estonia and Lithuania each have one domestic company serving 41.7% of the national web: Zone Media in Estonia, Interneto vizija in Lithuania. Latvia has no such host. Its largest domestic host serves 7.5% of living Latvian sites, only 40.8% of the Latvian sites that can be placed are served from Latvia, and 31.3% of the Latvian web hides its location behind a relay network, mostly Cloudflare. Hosting in another EU country does not change the rules, because EU data protection law applies across the whole European Economic Area. The sovereignty question that matters for a business is narrower: whether you know where your site lives, and how much of it depends on one company.

One company hosts a country

The audit counted 76,100 living Estonian websites, 95,014 Lithuanian and 49,258 Latvian. Here is who serves them. Every figure is from the report’s hosting chapter.

	Estonia	Lithuania	Latvia
Largest host, relays excluded	Zone Media	Interneto vizija	Nano IT
Its share of the living web	41.7% (31,707 sites)	41.7% (39,623 sites)	7.5% (3,717 sites)
Next host	Elkdata, 14.8%	Hostinger’s network, 15.3%	LeaseWeb, 3,438 sites
Top two together	56.5%	57.0%	under 15%

Estonia runs on Zone. Zone Media’s network serves 31,707 living .ee sites. Add Elkdata, the second Estonian host at 11,285 sites, and two Estonian companies serve 56.5% of the country’s web. The server software says the same thing: the most common server string on .ee is Apache/ZoneOS, Zone’s own stack, on 26,342 sites. Zone also runs the nameservers for 33,623 .ee domains.

Lithuania has the same shape with a different name on the door. Interneto vizija serves 39,623 living .lt sites, exactly the same 41.7%, and Hostinger’s network carries another 14,502. Cloudflare stands in front of 13,999 and Telia Lietuva serves 4,401. The DNS layer is even more concentrated: serveriai.lt, Interneto vizija’s nameserver brand, answers for 41,700 .lt domains. Hostinger’s technology was also detected behind 9,492 Lithuanian WordPress sites, so even a Lithuanian site served from abroad often runs on Lithuanian-built infrastructure.

Latvia has no landlord. The biggest name in front of the Latvian web is Cloudflare, standing before 11,181 sites, 22.7% of it. Cloudflare does not host those sites. It is a relay, and the real servers behind it are hidden. The largest true domestic host is Nano IT at 3,717 sites, then LeaseWeb in the Netherlands at 3,438, DELSKA, the former DEAC, at 2,307, and Hetzner at 2,281. No Latvian company serves even a tenth of the Latvian web. Cloudflare also runs the DNS for 11,915 .lv domains, 24% of the living Latvian web, against 7.6% in Estonia.

Where it physically lives

A site behind a relay network reports the relay’s location, not its own. So the honest map comes in two parts: how much of each web hides where it lives, and where the rest is. These figures are from the report’s geography chapter.

	Latvia	Estonia	Lithuania
Location hidden behind a CDN	31.3% (15,416 of 49,211)	12.2% (9,231 of 75,831)	18.6% (17,638 of 94,881)
Hosted at home, of placeable sites	40.8% (13,785 of 33,795)	81.2% (54,068 of 66,600)	68.1% (52,615 of 77,243)
Next countries	Netherlands 3,589, United States 3,438, Germany 3,435	Germany 4,007, United States 2,482	Germany 8,534, Ukraine 7,295

Estonia hosts its own web. Lithuania mostly does. Latvia does not, and much of what it does not host at home cannot be placed at all. The two findings are one story. Estonia and Lithuania each grew a company large enough to hold two-fifths of a national web, and Latvia never did, so its web went wherever hosting was cheapest or most convenient: abroad, or out of sight behind Cloudflare.

Concentration cuts both ways

Neither shape is simply good or bad, and the report says so without alarm.

A landlord is efficient. One company at 41.7% of a national web can roll out a fix, a certificate renewal or a security setting for two-fifths of a country at once. The certificate chapter shows the effect: Let’s Encrypt, the free automatic certificate authority, issues 79.4% of Estonian certificates against 64.4% in Latvia, and the report puts the Estonian extreme down to Zone: a host that automates certificates for two-fifths of a country moves the national figure by itself.

A landlord is also a single point of failure. An outage, a compromise or a business failure at one Estonian or one Lithuanian company is, on these numbers, a two-fifths outage of a country’s web.

A curtain is diversified, and opaque. Latvia’s spread across many small hosts and foreign data centres means no single failure takes down much of it. It also means that for nearly a third of the Latvian web, nobody outside can say where it lives.

What digital sovereignty means for one website

National webs and single websites are different questions. For a business choosing where to host, three things are worth separating.

Another EU country is not abroad, legally. The European Commission’s own summary is that EU data protection rules apply to the European Economic Area: every EU country plus Iceland, Liechtenstein and Norway. A Latvian site on a server in Frankfurt or Amsterdam sits under the same rules as one in Riga. Of Latvia’s three largest hosting destinations after home, the Netherlands and Germany are inside that area. The third is the United States.

Outside the EEA, the protection has to travel with the data. When personal data is transferred outside the EEA, the same page says, “special safeguards are foreseen to ensure that the protection travels with the data”. The GDPR’s toolkit for that includes adequacy decisions, standard contractual clauses and binding corporate rules. For the United States, the Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023, under which personal data can flow freely to US companies that participate in the framework. Whether your particular host or service participates is a question to put to them, not one to assume.

A relay is not a host, but it does see your traffic. Cloudflare is a San Francisco company. When it proxies a site, its own documentation says it “sits between your visitors and your server”, and it answers visitors with its own shared addresses instead of the server’s. That is why the audit cannot place 31.3% of the Latvian web: the hiding is deliberate, and it protects the server from direct attack. It also means visitors’ requests pass through Cloudflare’s network. For organisations that must keep that traffic in a region, Cloudflare offers a Data Localization Suite that controls where it decrypts, inspects and stores it.

So for most Baltic businesses the sovereignty question is not “is my server in my country”. It is whether you know where the site and its backups live, whether the contract with the host says so, and whether the domain, the DNS and the hosting account are in your company’s name rather than somebody else’s.

What you can check yourself, and what needs a developer

Four checks need no developer:

• Find out where your site lives. Look up your domain in any DNS lookup tool and check who owns the address it returns. If it belongs to Cloudflare or another CDN, the real host is behind it, and your hosting invoice or control panel names the host and the server’s country.
• Ask your host three questions in writing. Which country is the server in, which country are the backups in, and can they send you their data processing agreement. A good host answers all three in one email.
• Check whose name the accounts are in. The domain registration, the DNS and the hosting account should belong to your company, with logins someone on your side can use. If they sit in a former developer’s personal account, moving host later becomes a negotiation.
• Know whether your Cloudflare cloud is orange. Cloudflare’s documentation says proxying is on by default when you add a domain through its dashboard, shown as an orange cloud next to each record. That is usually the right setting. It is still worth knowing it is there, because it is the reason an outside lookup cannot see your host.

What needs a developer is moving. Changing host without downtime means copying the site and its database, lowering the DNS time-to-live in advance and carrying the mail records across, or the company’s email can stop when the website moves. Locking a server so it only accepts traffic through Cloudflare, so the hidden address stays useless to an attacker, is a server configuration job. And if a client contract requires data to stay in one country, setting up a CDN’s regional controls and checking every third-party script on the page against that contract is work for someone who can read both the contract and the server. That is part of what our care plans cover.

Why we can say any of this

The figures come from a near-census rather than a sample. We measured 293,806 of the 306,872 Baltic domains in our frame across July and August 2026, from one fixed location, with a crawler that identified itself honestly on every request. Everything is published as an aggregate and no individual site is named beside a weakness. Hosting companies are named because they are vendors, not because any site on them did something wrong. The country-level pictures are in the state of the Estonian web and the state of the Lithuanian web, and what “in the EU” means for an AI service rather than a website is in our piece on data residency.

If you want to know where your own site lives and who could switch it off, send us the address and we will tell you.