Jurisdiction.
Where NordBastion is registered, where your server physically sits, and which law actually reaches it. On a privacy host, this is part of the product — not fine print.
No single legal regime covers the whole network — and that is the design, not an accident. Where your workload sits is a choice you make, and it decides which law can reach it.
Full site detail lives on the network page.
Where the company sits
NordBastion is operated by NordBastion OÜ, a company registered in Estonia. As a company, it answers to Estonian and EU law — that is the legal home of the business itself.
Where your server sits
You choose the bastion at order time — Stockholm, Helsinki, Oslo or Reykjavík — and the server is pinned there. It does not roam. The panel always shows you which site each of your servers lives in.
The law that reaches your server is, first and foremost, the law of the bastion you placed it in. Choosing the location is choosing the legal environment.
Why these four
Each bastion is chosen on its merits as a jurisdiction. Sweden and Finland bring strong privacy law from inside the EU. Norway sits inside the EEA but outside the EU — a deliberate hedge. Iceland adds its own legal tradition and physical distance from the mainland.
Taken together, they let you place a workload where its jurisdiction actually fits — and they mean no single legal regime has reach over the whole network at once.
What this means for legal process
A request or an order only carries force where it has jurisdiction. A demand aimed at one bastion’s legal environment does not, by itself, reach a server placed in another.
When process does land validly within jurisdiction, it is logged, reviewed by counsel, challenged where overbroad, and answered with the minimum we are genuinely compelled to disclose — which, by design, is almost nothing. The full procedure is in the Transparency report.
What we do not do with jurisdiction
We do not quietly move your server between jurisdictions to dodge a law, and we do not pretend a bastion is somewhere it is not. The hedge only works because it is real — four genuine locations, each honestly what it says it is.
Equally, we will not voluntarily relocate that boundary against you. Where you placed your server is where it stays, unless you move it yourself.
The one exception
Jurisdiction is a real protection, but it is not a shield for the one thing NordBastion acts on regardless. Child sexual abuse material is governed entirely by the Acceptable Use policy — that is the single case where a server is terminated outright, and the single case where a valid seizure order is met with cooperation, in whatever jurisdiction the server sits.
Data between the bastions
The four bastions are joined by a private backbone — our own spine, not the public internet. Inter-bastion traffic, snapshots and migrations stay on it, so data crossing between sites is not exposed in transit.
Jurisdiction by design.
Where your workload lives is a decision, and it is yours to make. The pages below show the network it lives on and how its protections actually hold.