The US has no single federal privacy law; sector rules such as HIPAA and GLBA apply alongside state laws. Virginia's Consumer Data Protection Act has applied since January 2023 to businesses that meet its thresholds for processing data about Virginia residents, and a growing number of states have similar laws. These obligations depend on whose data you process, not on where the server is located.
If you are subject to the GDPR and store personal data of EU residents here, check how its rules on international transfers apply to your setup. Servers are single-tenant and unmanaged, so encryption, access control and backups are yours to configure.