Hosting and cloud for Indonesian apps

For an app whose users are in Indonesia there are three realistic places to run it. The first is a local provider: a VPS from a company such as Biznet Gio, which says its data centres are in Indonesia, or a managed platform billed in rupiah. The second is a hyperscaler region in the country. Alibaba Cloud opened its first Indonesian data centre in March 2018, Google Cloud its Jakarta region in June 2020, AWS in December 2021 and Microsoft in April 2025, each with three Jakarta zones by its own launch note or documentation. The third is a region abroad, usually Singapore.

The choice is rarely about features. Three questions decide it, in order: does a rule require the data to stay in Indonesia, who will patch, back up and answer alerts, and how many uncached requests your users make. Government agencies have a fourth option, the Pusat Data Nasional, built for central and regional government rather than for private companies.

This site has not published a measured Jakarta-to-Singapore round-trip time, and any range quoted without a method and a date is a guess. The floor can be computed: fibre carries a signal at roughly 200,000 km per second and the two cities are about 900 km apart, so a perfectly straight path gives about 9 ms there and back. Real cable routes are longer, so real numbers sit higher.

The multiplier matters more than the floor. A cold HTTPS request crosses the path about four times, for DNS, TCP, TLS and the request itself. A CDN removes the gap for cacheable assets, so uncached API calls are the only traffic a region change actually moves. Measure them with curl's timing output from your users' networks, not from office fibre.

PP 71/2019 splits electronic system operators in two. A PSE Lingkup Publik, run by or for a state institution, must manage, process and store its systems and data in Indonesia (Article 20), unless the storage technology is unavailable domestically. A PSE Lingkup Privat may do so inside or outside Indonesia (Article 21), but abroad it must keep supervision effective and give the authorities access. On 12 October 2026, BPK's database listed PP 71/2019 as in force with no amendment recorded.

Sector rules sit on top. For commercial banks, Article 35 of POJK 11/POJK.03/2022 requires the data centre and the disaster recovery centre to be in Indonesia, with placement abroad only by OJK permission. Personal data sent abroad must meet Article 56 of UU 27/2022: equal or stronger protection at the destination, otherwise adequate binding safeguards, otherwise the data subject's consent. Hosting in Indonesia settles the location question, not every other duty.

The June 2024 attack hit the temporary national data centre, PDNS, not the permanent PDN. Telkom's disclosure to OJK says Brain Cipher ransomware encrypted the data in Data Center 2 in Surabaya after immigration autogates were reported down on 20 June, and that 239 tenants were affected as of 26 June. The same letter lists Backup as a Service as one of several services provided on tenant request. The lesson applies to any host: only a copy you hold elsewhere, and have restored, counts as a backup.

The permanent PDN now has an operator. Permenkomdigi 18/2025, in force from 29 December 2025, created the Balai Layanan PDN in Kabupaten Bekasi under the SPBE mandate of Perpres 95/2018. Antara reported on 26 January 2026 that PDN 1 had been cleared for limited operation for low-risk services only, with higher-risk services waiting on ISO certification and BSSN's recommendations. Building for an agency? Ask which environment it has been assigned first.

Local providers price in rupiah, and some take payment rails most Indonesian developers already have: Helipod's pricing page says it bills in rupiah, topped up by QRIS or bank virtual account with no credit card needed. Prices are left off this page because they change faster than it does.

The invoice is the easy half to compare. In my matched 2 vCPU and 2 GB comparison, in the PaaS vs VPS post updated on 4 September 2026, the managed tier listed at roughly four times my Jakarta VPS, while the VPS took about four and a half hours a month of upkeep by my own estimate. The FinOps Foundation frames the work in three phases, Inform, Optimize and Operate: read the cost data, find improvements, then act on them. In practice that means an owner tag on every resource, a budget alert, storage growth watched as closely as CPU, and non-production switched off when idle.

This site runs the pattern I recommend for one box: GitHub Actions builds a Docker image, pushes it to GitHub's container registry, and a deploy step pulls it onto a single VPS over SSH. A new server's first hour goes to a non-root user, key-only SSH, a firewall allowing only SSH, HTTP and HTTPS, fail2ban and automatic security updates. Then the app goes behind a reverse proxy such as Caddy or Nginx with automatically renewed TLS.

The rest is the work a managed platform would otherwise do. Back up off the box on a schedule, keep one copy with another provider, and rehearse the restore. Watch the server from outside with Uptime Kuma and from inside with Prometheus and Grafana, and prune old images before the disk fills. Design it so that losing the server costs an hour, not the business.