Sweden.
Press freedom as constitutional law, source secrecy as criminal statute.

Yes — in the strict Swedish sense. The Kingdom of Sweden has four constitutional acts (grundlagar): the Instrument of Government (Regeringsformen), the Act of Succession, Tryckfrihetsförordningen (TF, 1766, last comprehensive revision 2018) and Yttrandefrihetsgrundlagen (YGL, 1991). Together they rank above ordinary statute and can only be amended by two consecutive Riksdag votes with an intervening general election. TF and YGL are the two that matter for a hosting provider — they encode press freedom, source secrecy and the prohibition on prior restraint as constitutional rights, not statutory grants.

TF Chapter 3 § 1 codifies källskydd — source protection — as a positive duty on anyone who receives information for publication. § 3 forbids the recipient from disclosing the source's identity without consent, except in narrow enumerated cases (typically grave crimes against the realm). § 5 makes such unauthorised disclosure a criminal offence punishable by fine or imprisonment. § 4 separately prohibits public authorities from investigating who a source was. The combined effect is rare in European law: the operator is criminally liable for breaking source secrecy, and the state is criminally constrained from even asking.

Yes, with a procedural step. YGL extends TF-grade protection to "technical recordings" and electronic publications, including websites — but the strongest tier (a formal utgivningsbevis, a publication certificate issued by the Myndigheten för press, radio och tv) requires a designated responsible publisher and an application. Sites without a certificate still benefit from baseline YGL principles and from general European press-freedom case law, but the certificated regime is the strongest available. NordBastion does not issue certificates for customer workloads; the customer applies in their own name where it makes sense for the project.

Integritetsskyddsmyndigheten (IMY) is among the more active GDPR regulators in the EU. Recent enforcement includes fines against Swedish public-sector bodies for unlawful Google Analytics transfers (2023), against credit-reference agencies for excessive retention, and a series of targeted investigations into school facial-recognition pilots. For a hosting customer this matters in two directions: IMY backs your Article 17 erasure rights with real penalties, and it constrains NordBastion — by external regulator, not just internal policy — to the Article 5 minimisation that we ship under by choice.

From 2010 onwards Bahnhof, operating from the Pionen bunker in Stockholm, hosted WikiLeaks through the diplomatic-cable releases and continued to host the organisation's public-facing infrastructure into 2018. Throughout that window — under significant US and allied diplomatic pressure — the Swedish constitutional regime kept the infrastructure online. No Swedish court ordered Bahnhof to disclose source material or to take down the site. NordBastion does not run inside Pionen — STO.001 is in a different tier-III facility in the Stockholm metropolitan area — but the legal regime that protected Bahnhof and WikiLeaks then is the legal regime that reaches a NordBastion bastion now.

This is the honest weak spot. The EU's e-Evidence package (Regulation (EU) 2023/1543 and the accompanying directive) creates European Production Orders and European Preservation Orders that a competent authority in one Member State can serve directly on a service provider in another, with comparatively short response windows. It enters full application in 2026. Sweden is in scope as an EU Member State. Two structural points mitigate but do not eliminate the exposure: (a) e-Evidence still requires a valid order from a judicial or equivalent authority on a named subject for specified data, not bulk; (b) NordBastion does not collect identity, does not retain payment-card data and rotates infrastructure logs aggressively — orders intersect only with the narrow set we actually hold, which is published in the transparency report.

Säkerhetspolisen (SÄPO) is Sweden's domestic security service and is a documented participant in cooperation with US, UK and other allied intelligence services — the FRA signals-intelligence cooperation revealed in the 2013 Snowden documents is the most-cited public example. That cooperation operates at the signals-intelligence and counter-terrorism layer, not as ordinary legal process against a hosting customer, and is constrained by Swedish statute (Lag (2008:717) om signalspaning i försvarsunderrättelseverksamhet, plus parliamentary oversight by SIUN). For an ordinary hosting workload it is not the day-to-day risk; for a workload that genuinely attracts state-actor adversaries, no hosting jurisdiction on earth is a substitute for application-layer encryption and operational hygiene.

Only through a Swedish court order, on a named subject, for data we actually hold — and that intersection is narrow by design. We do not collect identity at signup. We do not retain payment-card data (crypto only, with no KYC). We do not log application-level activity inside customer VMs (we cannot — we do not have access). Infrastructure logs are kept on the rotation schedule published in the transparency report. What does not exist cannot be compelled. What does exist is answered to the minimum we are genuinely required to disclose, and the aggregate of those answers is published monthly.

Yes. Tele2 Sverige AB v. Post- och telestyrelsen (CJEU C-203/15, 2016) struck down the Swedish blanket data-retention regime as incompatible with EU fundamental rights. The replacement statute — Lag (2003:389) om elektronisk kommunikation, as amended — is much narrower and targeted, and applies to providers of electronic communications networks (telcos), not to hosting providers. NordBastion is not subject to bulk retention obligations under that regime. Subsequent CJEU decisions (La Quadrature du Net, 2020; SpaceNet, 2022) have reaffirmed the principle.