Virtual Zone Technical Infrastructure Requirements, Deloryen

Technical Infrastructure Requirements to Secure Your Virtual Zone Status

Last month, our client's Virtual Zone status was at risk. The reason? All systems running on AWS and administrators accessing from Germany. During the Revenue Service of Georgia (RS.ge) audit, no "economic substance" evidence could be found.

Protecting Virtual Zone status is not just a legal matter but a technical one. This guide translates the ambiguous legal concept of "economic substance" into concrete infrastructure requirements: local hardware in Georgia, IP management, and audit trails.

Direct Answer: To maintain Virtual Zone status, companies must prove economic substance through technical means: hybrid cloud infrastructure with Georgian IPs, management access from within the country, and detailed access records stored as digital evidence.

Digital Economic Substance: Definition for IT Companies

The Revenue Service doesn't just look at addresses on paper when evaluating economic substance. Based on our project observations, auditors examine server logs, IP addresses, and system management records.

Why Does RS.ge Examine Your Technology Infrastructure?

Under Base Erosion and Profit Shifting (BEPS) standards, the "Place of Effective Management" (POEM) concept is now proven through digital traces. Where is your company's real management center? The answer is hidden in server logs.

While working with a client last year, we noticed this: All critical decisions were made from London, servers were in Frankfurt, only accounting was in Tbilisi. This fits the "shell company" profile.

Operational Technology Center vs. Shell Company

Minimum technical requirements needed to prove economic substance:

• Local server infrastructure (bare metal or hybrid)
• System management from Georgian IP addresses
• SSH access logs with local timezone
• Git commits and code deployments from Georgia

This list isn't theoretical. These are the documents requested in RS.ge audits.

Pro Tip: Virtual office isn't enough. Auditors are looking for "digital footprint."

Server Dilemma: Local Hardware vs. Global Cloud

Running 100% on AWS/Azure is risky for Virtual Zone. But going completely local isn't practical either.

Risk of 100% Foreign Cloud Usage

The biggest mistake we've seen in Deloryen's 15 years of experience: Running all infrastructure in Frankfurt or Ireland data centers.

Why is this problematic?

• Server management from abroad
• Data processing outside Georgia
• Critical systems not under local control

Bare Metal Server in Tbilisi: Anchor Function

Physical servers are the strongest evidence of economic substance. But you don't have to run everything locally.

Hybrid Strategy:

1. Management Server → In Tbilisi (bare metal)
2. Production Workloads → AWS/Azure (hybrid)
3. Database Backups → Local storage
4. Monitoring & Logs → Stored in Georgia

With this approach, you achieve both operational efficiency and compliance.

Practical Implementation: Hybrid Architecture

Example setup:

• Tbilisi Data Center: Management, monitoring, backup
• AWS Europe: Production applications
• Georgian IP: For all admin operations

Does it increase costs? Yes. But losing Virtual Zone status is much more expensive.

Network Hygiene: VPNs, IPs, and Location Management

Digital nomad VPN habits are deadly for Virtual Zone.

The Danger of Digital Nomad VPN Habits

One of our clients was managing the company from Bali. They used VPN with Georgian IP. It came out during the audit: All banking operations were from Indonesian IP.

Result? "Permanent Establishment" risk and Virtual Zone status was questioned.

Static Georgian IP: Necessity

Dedicated Georgian IP required for administrative operations:

• Banking logins
• Government portals (rs.ge, house.gov.ge)
• Company management systems
• Critical business decisions

Not VPN, but real IP from Georgian ISP.

Remote Team Management: Preventing PE Risk

Be careful if you have a remote team:

Safe Approach:

• Critical decisions → Only from Georgia
• Code development → From anywhere (but deployment from Georgia)
• Client meetings → In Georgian timezone
• Financial operations → Only from local IP

Dangerous Approach:

• CTO managing entire system from Germany
• CFO making financial decisions from UK
• CEO determining company strategy from Dubai

This situation draws a "shell company" profile, not "substance."

Warning: Use geo-fencing. Access to critical systems only from Georgian IPs.

Creating Audit-Proof Digital Traces

Which logs will RS.ge request during audit? Be prepared.

Logs That Must Be Retained

Documents requested in our audit experience:

1. SSH Access Logs

   • Timestamp (Georgian timezone)
   • Source IP addresses
   • User authentication records
   • Command history

2. Git Repository Activity

   • Commit timestamps
   • Author locations
   • Deployment logs
   • Code review activities

3. Banking & Financial System Access

   • Login locations
   • Transaction approval IPs
   • Multi-factor authentication logs

4. Business Communication

   • Email server logs
   • Video conference participation
   • Document access patterns

Timestamp and Location Verification Tools

Recommendations for Log Management Systems:

• ELK Stack (Elasticsearch, Logstash, Kibana)
• Splunk enterprise logging
• Prometheus + Grafana monitoring
• Audit trail with immutable storage

Important: Don't manipulate logs. Auditors can detect changes.

Deloryen's Infrastructure Compliance Checklist

Technical Requirements:

• At least 1 bare metal server in Tbilisi
• Dedicated Georgian IP range
• SSH key management from Georgia
• Database backups on local storage
• Monitoring dashboard in Georgian timezone

Operational Requirements:

• Critical system access only from local IP
• Financial operations geo-fenced
• Log retention minimum 7 years
• Audit trail immutable
• Regular backup verification

Compliance Documents:

• Data center contracts (Tbilisi)
• ISP agreements (Georgian IP)
• Server maintenance records
• Employee access logs
• Third-party service agreements

This list isn't theoretical. It's derived from our real audit experiences.

Frequently Asked Questions

Is virtual office sufficient for Virtual Zone substance?

No, absolutely not sufficient. Virtual office only provides legal address. RS.ge looks for "real operational activity" for economic substance. This means technical infrastructure, personnel, and operational decisions being made in Georgia. Based on our project observations, companies with virtual offices but technical infrastructure abroad face problems during audits.

Can I use VPN to show I'm in Georgia?

This is extremely risky and illegal. VPN usage falls into the "deception" category, not "substance." RS.ge auditors can detect real location using IP geolocation, timezone patterns, and network forensics. Additionally, banking systems and government portals detect VPN traffic. When caught, you face not only Virtual Zone loss but also tax fraud risk.

Do I have to host customer data in Georgia?

Not mandatory, but we recommend a hybrid approach. Customer production data can remain on AWS/Azure, but management, monitoring, and backup systems should be in Georgia. This approach ensures both GDPR compliance and Virtual Zone substance. What matters is that "control and management" activities are conducted from Georgia.

What happens if RS.ge audits my server logs?

Audit isn't inevitable but being prepared is necessary. RS.ge can examine SSH logs, database access patterns, and system administration activities. That's why all critical operations should be performed from Georgian IPs. If log manipulation is detected, there are serious legal consequences. Best strategy: Create real substance, not fake logs.

How much does hybrid cloud strategy increase costs?

15-25% cost increase compared to fully foreign cloud is normal. But the cost of losing Virtual Zone status is much higher: retroactive tax, penalties, legal fees. ROI observed in Deloryen clients: 3-5 times tax savings compared to compliance investment. Plus there are data sovereignty and security benefits.

Conclusion: Technical Substance Framework

Maintaining Virtual Zone status requires not just legal but technical discipline. We've concretized the "Digital Economic Substance" concept:

Core Principles:

• Hybrid infrastructure: Local + global cloud
• IP hygiene: Dedicated Georgian IPs
• Audit trail: Comprehensive logging
• Operational control: Critical decisions from Georgia

This framework isn't theoretical. It's derived from our real audit experiences.

Next step: Evaluate your current infrastructure's Virtual Zone compliance. As the Deloryen team, we offer technical substance audits. We identify risk areas and create compliance roadmaps.

Time is critical. RS.ge audits are increasing, standards are tightening. Act proactively.

Note: This guide focuses on technical implementation. For legal advice, definitely consult a Georgian tax law specialist.

Virtual Zone Georgia technical requirements. Virtual Zone statüsünü korumak için şirketler teknik yollarla ekonomik öz kanıtlamalı: Gürcistan IP'leriyle hibrit.

Virtual Zone Technical Infrastructure Requirements, Deloryen. Virtual Zone statüsünü korumak için şirketler teknik yollarla ekonomik öz kanıtlamalı: Gürcistan IP'leriyle hibrit bulut altyapısı, ülke içinden yönetim girişleri ve detaylı