A Sweden VPS, KYC-free.
Under the world's oldest constitutional press-freedom regime.

For now, yes. NordBastion operates one bastion in Sweden — STO.001 — inside a tier-III carrier-neutral facility in the Stockholm metropolitan area. Stockholm is also the densest peering point in the country (IXSE, STHIX, Netnod), which is why we put the Swedish bastion there rather than in Gothenburg or Malmö. A second Swedish site is not on the published 18-month roadmap.

Tryckfrihetsförordningen (the Freedom of the Press Act, 1766) is one of four Swedish constitutional acts and ranks above ordinary statute. Together with Yttrandefrihetsgrundlagen (1991) it guarantees the right to publish, the right to remain an anonymous source, and — critically for an infrastructure operator — makes it a criminal offence to disclose the identity of an anonymous source, even on police request. That guarantee survives translation into the crypto-paid, no-identity hosting model NordBastion runs.

No — and arguably it strengthens it. GDPR, contrary to its reputation, is a friend of the privacy-conscious customer here. Article 5 binds NordBastion to minimal data collection by law, Article 17 gives every customer a right to erasure enforced by a regulator with real teeth (the IMY is one of the most assertive data-protection authorities in Europe). EU membership does mean Sweden is inside the e-Evidence framework — see the data-retention answer below.

Pionen is the Stockholm bunker famously used by Bahnhof to host WikiLeaks during the 2010 cable releases. It is widely cited as the canonical example of Sweden being willing to host politically inconvenient infrastructure under its constitutional press-freedom regime. NordBastion does not run inside Pionen — STO.001 is in a different tier-III facility in the metropolitan area — but the legal regime that protected Bahnhof and WikiLeaks is the same legal regime that protects a NordBastion customer today.

Only through a Swedish court order, on a named subject, for data we actually hold — and that intersection is narrow. By doctrine, NordBastion does not collect identity at signup, does not retain payment-card data, does not log application-level activity, and rotates infrastructure logs aggressively. What does not exist cannot be compelled. Anything that does exist is published in the monthly transparency report, in aggregate.

Sweden's former blanket data-retention regime was struck down by the CJEU (Tele2 Sverige, 2016) and replaced by a much narrower targeted retention statute. As a hosting provider — not a telecom — NordBastion is not subject to bulk retention obligations under that statute. We retain only what is operationally necessary, on the schedules published in the transparency report.

The NordBastion SLA is 99.99 percent per-bastion, computed independently for each of the four locations. The Stockholm STO.001 uptime is broken out on /status/ alongside the other three bastions. SLA credits are applied to your prepaid balance automatically — no ticket required.

Yes. Every VPS can be snapshot-redeployed to any other Nordic bastion through the panel — Stockholm to Helsinki, Helsinki to Reykjavík, anywhere. The snapshot transfer runs over the 100 Gbps private backbone, so even a Ravelin migration completes in a few minutes. You re-point DNS at the new IP; nothing else changes.