Good question! I will write a more detailed blog post in the next week or two. In short, it's hosted on Fly.io - with instances distributed across Australia, US and EU, with a clustered Postgres in those regions too.
There are also other relevant laws like COPPA, FOSTA-SESTA and GDPR, but the timeframe for those is not particularly urgent. Additionally, if you aren't retaining legal counsel and are handling things yourself, the Australian Communications Alliance has some handy explainers on compliance with these other laws for site owners.