Sweden is, by a wide margin, the country with the longest continuous constitutional protection of free expression. The Tryckfrihetsförordningen dates from 1766 — older than the United States. It is one of four constitutional acts and ranks above ordinary statute. Together with the Yttrandefrihetsgrundlagen from 1991, it gives publishers, journalists and the sources who feed them a written, judicially enforced shield against state interference.
For an operator of communication infrastructure that matters in two specific ways. First, the disclosure of an anonymous source is itself a criminal offence under Swedish law — even when the source is being asked about by the police. Second, the threshold the state must meet to demand operational data from a network operator is set by the constitution, not by the discretion of an investigator. Both of those constraints survive translation into the crypto-paid, no-identity hosting model NordBastion runs.
Sweden is an EU member and subject to GDPR — but GDPR, contrary to its reputation, is a friend of the privacy-conscious customer here. Article 5 binds NordBastion to minimal data collection by law, on top of the doctrinal commitment that already does so. Article 17 gives every customer a right to erasure that is enforced by a regulator with real teeth — the IMY is one of the most assertive data-protection authorities in Europe.
A Stockholm VPS therefore sits inside a legal regime that is unusual on three axes simultaneously: a constitutional press-freedom guarantee, source secrecy by criminal statute, and one of the most assertive data-protection regulators in Europe. None of those three is rhetoric. All three are written law.