Vaultwarden in Iceland on Anubiz Host VPS
Iceland is the strongest western jurisdiction for hosting a personal or small team password vault. Section 73 of the constitution prohibits prior restraint, the country has no domestic surveillance budget that touches private servers, there is no compelled key disclosure law, and the submarine cable map gives you sub 30 ms latency to London, Amsterdam and New York. Vaultwarden is a tiny Rust binary that idles around 256 MB and serves the full Bitwarden client API surface, so a 1 GB Anubiz Host Iceland VPS can run a vault for a household or a small editorial team without any tuning. This page covers picking the plan, deploying through Docker compose, hardening with Argon2id KDF, fail2ban for the admin panel, and restic snapshots to a second offshore region.
Need this done for your project?
We implement, you ship. Async, documented, done in days.
Why Iceland for a Vault
Icelandic data protection is governed by Act 90/2018 plus the GDPR. The Persónuvernd is the supervisory authority. The country is outside the Fourteen Eyes arrangement and the Modern Media Initiative (IMMI) shapes case law around source protection, which matters to journalists who store source contact passwords in their vault. There is no key escrow statute. The practical compulsion path is a court order from Reykjavik District Court; we comply with that but nothing else. For latency, Reykjavik to London is around 25 ms and to New York around 40 ms, both fine for the open-and-search workflow of a password manager.
Plan Sizing
Vaultwarden itself fits in 256 MB RAM and uses well under 1 percent of a vCPU at the load of a small team. The bottleneck is the reverse proxy plus TLS overhead plus restic during backup windows. Our Anonymous Iceland VPS entry tier (1 vCPU, 1 GB RAM, 25 GB NVMe) is enough for up to about 15 active users; jump to the 2 GB tier if you also want to colocate matrix-synapse, fail2ban with large bantime, or Caddy with on demand TLS for many subdomains.
Deployment
Pull vaultwarden/server:latest in a compose file. Bind ./data:/data, expose only on localhost (127.0.0.1:8080), let Caddy terminate TLS. Set DOMAIN=https://vault.example.is, SIGNUPS_ALLOWED=false as soon as you create your account, ADMIN_TOKEN as an Argon2 hash. Force every account to Argon2id KDF with 64 MiB memory after first login. PBKDF2 is the legacy default and is brute forceable on consumer GPUs at six figure rates per second; Argon2id with 64 MiB pushes that to single digits.
Encryption Truth
The vault items are end to end encrypted with a key derived from the master password. We cannot read them. We can read metadata: which Bitwarden organisations and collections exist, attachment sizes, item timestamps, your email, your 2FA configuration. Treat that metadata as sensitive. The admin panel is a separate authentication and is what fail2ban watches; brute force attempts there give an attacker an empty admin surface, not access to your ciphers.
Backups Off Iceland
Snapshot /data with restic to a second Anubiz Host region (Romania or Finland) twice a day. Encrypt with a separate restic repository password that is not stored in the vault itself (otherwise a compromised vault loses the recovery path). Keep 14 daily, 8 weekly, 12 monthly. Restore drills monthly; a backup you never restored is a guess.
Linking Clients
Official Bitwarden mobile and desktop clients connect through a single self hosted URL field. Set it to your vault hostname, log in once, and the encrypted vault syncs to local storage. You do not pay a Bitwarden licence; Vaultwarden serves the API. Premium features (TOTP, attachments, send, emergency access) all work because the server implements them.
Related Services
Why Anubiz Host
Ready to get started?
Skip the research. Tell us what you need, and we'll scope it, implement it, and hand it back — fully documented and production-ready.