An Iceland VPS, KYC-free.
Under IMMI — written from the ground up for digital publishers.

For now, yes. NordBastion operates one bastion in Iceland — RKV.001 — inside a tier-III carrier-neutral facility in the greater Reykjavík area. Reykjavík is the densest peering point in Iceland (RIX) and sits next to the FARICE / DANICE / IRIS submarine cables landing on the south-west coast, which is why we put the Icelandic bastion there rather than in Akureyri. A second Icelandic site is not on the published 18-month roadmap.

The Icelandic Modern Media Initiative (IMMI) was passed unanimously by the Althingi in June 2010 as a parliamentary resolution mandating the government to implement, by statute, the world's strongest press and source-protection framework. It explicitly bundles source protection, intermediary immunity (so a hosting provider is not liable for the speech of its customers), whistleblower protection, prior-restraint limits, and a strong libel-tourism shield. It was championed in the wake of the Wikileaks cable releases and is the only national legal framework written from the ground up for digital publishers. A NordBastion VPS pinned to RKV.001 sits inside that framework.

Section 73 of the Constitution of the Republic of Iceland entrenches freedom of expression as a fundamental right, forbids censorship and other comparable obstacles to expression, and limits restrictions to those necessary in a democratic society. It is the constitutional anchor on which IMMI is built — Section 73 sets the floor, IMMI raises the ceiling.

Iceland's electricity grid is essentially 100 percent renewable — roughly 70 percent hydro and 30 percent geothermal, with negligible fossil-fuel generation. A NordBastion VPS in RKV.001 therefore runs on grid power that is among the lowest-carbon in the world, without buying offsets or relying on accounting tricks. For workloads where carbon footprint is a procurement criterion, Iceland is the right answer.

No. Iceland is in the EEA but not the EU. GDPR applies via EEA incorporation (enforced by Persónuvernd, the Icelandic DPA), so customers get the same Article 5 minimisation and Article 17 erasure rights as in any EU country — but the EU e-Evidence regulation and direct ECJ jurisdiction do not apply. Combined with IMMI, this gives Iceland an unusually deep stack of overlapping protections.

Only through an Icelandic court order, on a named subject, for data we actually hold — and the IMMI framework explicitly narrows what an intermediary can be compelled to disclose about its users' speech. By doctrine, NordBastion does not collect identity at signup, does not retain payment-card data, does not log application-level activity, and rotates infrastructure logs aggressively. What does not exist cannot be compelled. Anything we do hold is published in aggregate in the monthly transparency report.

The NordBastion SLA is 99.99 percent per-bastion, computed independently for each of the four locations. The Reykjavík RKV.001 uptime is broken out on /status/ alongside the other three bastions. SLA credits are applied to your prepaid balance automatically — no ticket required.

Yes. Every VPS can be snapshot-redeployed to any other Nordic bastion through the panel — Reykjavík to Stockholm, Stockholm to Helsinki, anywhere. The snapshot transfer runs over the 100 Gbps private backbone (Iceland connects via the FARICE / DANICE / IRIS submarine cables), so even a Ravelin migration completes in a few minutes. You re-point DNS at the new IP; nothing else changes.