Sovereignty you can point to. Data residency you can name.
Security telemetry is some of the most sensitive data you hold: it is a map of your fleet. Where it lives, and whose laws reach it, is a security property, not a footnote. Whisper Endpoint runs from the European Union on our own address space, operated by viaGraph B.V. in Amsterdam, by people who used to run a regional internet registry and a root DNS server. This page is how we treat your data. The full GDPR policy is at whisper.online/privacy.
Run from the EU, on address space we hold.
The infrastructure and its jurisdiction are one and the same, and both sit inside the European Union.
Whisper Endpoint is operated by viaGraph B.V., an EU company in Amsterdam, on our own routable address space (AS219419 · 2a04:2a01::/32). We are not a US company renting cloud, and we are not subject to the US CLOUD Act reach that follows US providers wherever their servers physically sit. When your data lives inside the EU under an EU operator, its home jurisdiction is one you can actually point to, and one your own regulators recognise.
Operator viaGraph B.V. (dba Whisper Security), Amsterdam, NL
Network AS219419 · announces 2a04:2a01::/32 · RPKI-signed, MANRS
Basis EU jurisdiction · GDPR · outside US CLOUD Act reach
People an ex-RIPE NCC CIO and a K-root architect
Your telemetry stays where you can name it.
The signal your sensor produces is stored locally to the service, per tenant, on infrastructure you can identify, not scattered across a chain of subprocessors.
No external store on the hot path
Logs spool to a node-local hot store and a local analytics store. There is no third-party data lake in the path, and no external telemetry vendor holding your fleet map.
Isolated by tenant
Each customer's signal is isolated. Your data is yours; it is never pooled into a shared model that another customer benefits from.
Resident in the Union
Storage stays on EU infrastructure under the EU operator above. Residency you can put in a data-processing agreement and defend to an auditor.
Only what the security job needs.
The minimum to do the work
The security signal needed to show you your own posture, map it to ATT&CK, and enforce the policy you set. Identity and control events for the tamper-evident ledger. That is the set, and it is scoped to the job.
No ad-tech, no data broker
We do not feed your telemetry to ad-tech, sell it to a data broker, or profile you. There is no "we may share with partners" clause doing the real work. Whisper is infrastructure, not an ad market.
A ledger you can check, and a right to erase.
A ledger an auditor checks keyless
Every identity and control event is written to an independently-witnessed, tamper-evident ledger. Your auditor verifies it themselves, with no account and no trust in our API. The record is not something you have to take on faith.
Revoke, then crypto-shred
Revoke a host or agent and its resolution and egress stop worldwide at DNS-TTL. Removing it erases its retained signal by crypto-shred. Your GDPR rights of access and erasure are exercised through the full policy at whisper.online/privacy.
Security that keeps your data where you can name it.
EU sovereignty, real data residency, and a ledger anyone can verify. Install with one command, and audit the identity in the same breath.