2. DDOS can be mitigated by:
- moving it to proper hosting provider with DDOS protection
- move entire web traffic behind cloud firewall (this would cause privacy issues, so rather not).
Both of them would cause severe privacy issues.
Unless you can 110% trust the cloud hoster (which really is impossible unless you run the entire hosting service as well), they shouldn't be used as they would be able to log virtually everything.
Eg. OVH deals very well with DDOS attempts and you do not pay anything and preserves privacy of customers.
OVH doesn't even allow tor software to be ran on it's hardware, and you're claiming they don't log anything, or won't do so if they're asked by a LE?........
Are you sure you know what you're talking about at all?