Can they though? If all of the money is kept in Estonia for example, and none actually goes through your identity or a business elsewhere - then that company wouldn't have any right to it from my understanding. Until you pay someone in another country - then the other one can't dip their hand in it. Isn't this why so many companies are based out of random countries to begin with?