# Whisper Endpoint privacy - EU sovereignty and data residency

Security telemetry is some of the most sensitive data you hold: it is a map of your
fleet. Where it lives, and whose laws reach it, is a security property, not a
footnote. This page is how Whisper Endpoint treats your data. The binding GDPR
policy is at https://whisper.online/privacy.

## EU sovereignty

Whisper Endpoint is operated by viaGraph B.V., an EU company in Amsterdam, on our
own routable address space (AS219419, 2a04:2a01::/32). We are not a US company
renting cloud, and we are not subject to the US CLOUD Act reach that follows US
providers wherever their servers physically sit. When your data lives inside the
European Union under an EU operator, its home jurisdiction is one you can point to.

- Operator: viaGraph B.V. (dba Whisper Security), Amsterdam, NL
- Network: AS219419, announces 2a04:2a01::/32, RPKI-signed, MANRS
- Basis: EU jurisdiction, GDPR, outside US CLOUD Act reach
- People: an ex-RIPE NCC CIO and a K-root architect

## Data residency

The signal your sensor produces is stored locally to the service, per tenant, on
infrastructure you can identify, not scattered across a chain of subprocessors.

- Local: logs spool to a node-local hot store and a local analytics store. There is
  no third-party data lake in the path and no external telemetry vendor holding your
  fleet map.
- Per-tenant: each customer's signal is isolated; your data is never pooled into a
  shared model another customer benefits from.
- EU-resident: storage stays on EU infrastructure under the EU operator above.
  Residency you can put in a data-processing agreement and defend to an auditor.

## What we keep, and why

- What we keep: the minimum the security job needs. The signal to show you your own
  posture, map it to ATT&CK, and enforce the policy you set, plus identity and
  control events for the tamper-evident ledger.
- What we never do: no ad-tech, no data broker, no profiling. There is no "we may
  share with partners" clause doing the real work. Whisper is infrastructure, not an
  ad market.

## Evidence and erasure

- Verifiable: every identity and control event is written to an
  independently-witnessed, tamper-evident ledger your auditor checks themselves,
  keyless, with no trust in our API.
- Erasable: revoke a host or agent and its resolution and egress stop worldwide at
  DNS-TTL; removing it erases its retained signal by crypto-shred. Your GDPR rights
  of access and erasure are exercised through the full policy.

The honest framing: this page describes how Whisper Endpoint treats data as a
security product. The binding privacy policy and data-processing terms are the
GDPR-based documents at https://whisper.online/privacy and
https://whisper.online/terms.