Data sovereignty
Where your security data is held, who can reach it, and how that will change as our Portugal-based team grows. We set all of this out in writing before any engagement begins.
Held in the EU, under EU jurisdiction
This website, and the monitoring platform we are building, run on infrastructure of Hetzner Online GmbH in Germany or Finland, a provider headquartered in the EU. Client security telemetry will be stored and processed there from the first day of service.
This is different from using the EU region of a provider headquartered outside the EU. A region settles where data sits, not who can lawfully compel access to it. The US CLOUD Act, for example, allows US authorities to require US providers to disclose data in their possession, custody or control, wherever that data is stored.
Choosing an EU-owned provider, under EU jurisdiction, avoids that conflict at the infrastructure level.
Who can reach your data, and how
Role-based access
People can reach only the data their role requires.
Logged access
Every access to client data is logged.
No bulk export
Client data cannot be exported in bulk.
Just-in-time privileges
Privileged access is granted for a specific task and withdrawn afterwards. Nobody holds standing privileged access.
Jump hosts
Remote access goes through jump hosts in the EU, never directly to your systems or data.
Recorded sessions
Privileged sessions are recorded, so that every action can be reviewed.
Analyst coverage today
Our Portugal-based security operations centre is planned and not yet operating. Until it is, monitoring capacity is provided by our affiliated US practice, Cyberuptive LLC, as a contracted supplier.
Its analysts work only through the controls above. Under the GDPR, remote access from outside the EU counts as an international transfer, so standard contractual clauses and a sub-processor agreement will be in place before any client data is processed.
Our coverage roadmap
Analyst coverage moves to Portugal in three phases. Client data stays on EU infrastructure throughout.
Clients receive written disclosure of the transition and the committed date for the third phase.
Phase 1 From launch
EU-hosted data; contracted US analyst capacity under documented safeguards.
Phase 2 Planned for 2028
Portugal L1 and L2 analysts, with escalation support.
Phase 3 Planned for 2030
Fully EU-based analyst coverage.
In writing, before we start
Before any engagement begins, you receive a written description of:
- where your data is stored and processed, and by which provider;
- who can reach it, from where, and under which controls;
- the current coverage phase and the dates of the next;
- how we will tell you about any change.
Questions about your data?
We are glad to walk your security, legal or procurement team through these arrangements in detail.
Arrange a conversation