Compliance & Legal

Compliance statement

Compliance is not the reason we built StreamZilla. It is the proof that we built it right. Below is a summary of how we relate to the European rules that matter for a video platform. For each topic, a detailed self-declaration is available on request for customers, auditors and contracting authorities.

1. Digital sovereignty compliance

StreamZilla is fully European in ownership, control, operation and infrastructure. There is no American parent company, shareholder or hyperscaler underneath, so there is no route through which the US CLOUD Act or FISA Section 702 could force access to your data. Engineering, operations and support are carried out by our own staff in the Netherlands. We route delivery from our own IP address space, registered with RIPE since 2004.

We have assessed our platform against the European Commission’s Cloud Sovereignty Framework (SEAL). In our self-assessment, StreamZilla reaches the highest level, SEAL-4, on seven of the eight sovereignty objectives, and SEAL-3 on the remaining one. This is a self-assessment, not a certification: the framework has no certification scheme, and an official SEAL level is only established by a contracting authority in a tender. That is why we provide the full, verifiable substantiation, so you can assess it yourself.

2. GDPR compliance

StreamZilla acts as processor for the personal data in your account, under a data processing agreement within the meaning of article 28 GDPR. All processing takes place in the EEA by default. Access logs are deleted within three months, analytics are pseudonymised by removing the last part of every IP address, and the player places no cookies and loads no advertising or tracking scripts; Chromecast support can be switched off per player. Data breaches affecting your data are reported to you within 48 hours of discovery.

3. Data Act compliance

StreamZilla is a data processing service within the meaning of the Data Act (Regulation (EU) 2023/2854), and we comply fully with its switching rules. You can switch provider, use several providers in parallel or move to your own infrastructure without contractual, technical or financial obstacles. We do not charge switching or egress fees, already meeting the rule that applies to all providers from 12 January 2027. Your media, metadata and configurations can be exported in common, machine-readable formats, and videos are delivered in open standards (HLS, CMAF) that work outside StreamZilla too.

4. AI Act compliance

We apply none of the practices prohibited by the AI Act (Regulation (EU) 2024/1689) and ensure AI literacy among our staff. StreamZilla’s automatic subtitles and translations use AI for speech recognition and machine translation. These are minimal-risk applications under the AI Act. The models run locally on our own infrastructure in the EU, without external AI services, and your media is never used to train them. You can review and edit every generated subtitle. StreamZilla does not offer high-risk AI systems and is not a provider of general-purpose AI models.

5. Cybersecurity compliance (NIS2 and the Dutch Cyberbeveiligingswet)

As a small enterprise, Jet-Stream falls below the size thresholds of the Dutch Cyberbeveiligingswet, the implementation of NIS2. We nevertheless voluntarily comply with its duty-of-care measures, because many of our customers do fall under the law and need to demonstrate the security of their supply chain. Our information security management system (ISMS) is set up in accordance with ISO/IEC 27001 and covers risk management, incident handling, business continuity, supply chain security, encryption, access control and mandatory security awareness training. ISO 27001 certification is in progress; we are not yet certified and do not present ourselves as such.

6. Cyber Resilience Act and open source compliance

StreamZilla is built on proven open source components (including Linux, NGINX, Kubernetes, FFmpeg and Video.js), combined with our own streaming engineering. We maintain a software bill of materials (SBOM), monitor components for published vulnerabilities and phase out end-of-life versions in a planned way. A full SBOM is available to customers and auditors on request.

7. Digital Services Act compliance

As a hosting service, we have a notice and action procedure for illegal content (see Terms & Conditions below) and a single point of contact for authorities and users. We do not scan your content for commercial purposes, third-party rights enforcement or censorship. We do reserve the right, as a voluntary own-initiative measure under article 7 of the DSA, to use targeted detection of clearly illegal material at upload.

8. Accessibility compliance

Subtitles are delivered as segmented WebVTT in accordance with the specification, in line with the European Accessibility Act. Automatic subtitles and translations make it easy to make every video accessible. The StreamZilla website, player and pages are built to WCAG 2.2 level AA.

9. Streaming standards compliance

Our encoding and packaging output follows the formal specifications, including RFC 8216 (HLS), CMAF (ISO/IEC 23000-19) and the Apple HLS Authoring Specification. Compliance is enforced automatically in our development pipeline: a release that deviates from the specification does not reach the platform. Correct streams play on every device, without surprises, and without wasted bits.

10. Sustainability compliance

StreamZilla runs in data centres which run on 100% renewable energy, use adiabatic cooling, are ISO 14001 certified and have signed the Climate Neutral Data Centre Pact. We have hosted there since 2004. Beyond green hosting, we reduce energy at the source: energy-efficient hardware, efficient encoding that sends no unnecessary bits, short European delivery routes, and data minimisation. Every byte we do not collect, store or send also saves energy.

Documentation on request

The following self-declarations are available on request via e-mail:

• Sovereignty self-assessment (EU Cloud Sovereignty Framework)
• Data Act compliance statement
• AI Act compliance statement
• Cyberbeveiligingswet (NIS2) scope analysis and statement
• Open source and closed source compliance statement
• Technical compliance and commitment statement
• Sustainability statement

Impressum

StreamZilla is a service of:

Jet-Stream Services B.V.
Hoge der A 12
9712 AC Groningen
The Netherlands

Chamber of Commerce (KvK): 56794223
EU VAT number: NL8523.04.778.B.01
Phone: +31 50 800 3300
Email: e-mail
Web: streamzilla.eu

Managing director: Stef van der Ziel

Corporate group: Jet-Stream Services B.V. is part of the Jet-Stream group, whose parent company is Stream Holding B.V. (KvK 02081685). All group companies are Dutch private limited companies, established and managed in the Netherlands. There are no shareholders, parent companies or subsidiaries outside the European Union.

Contact points

Terms & Conditions

StreamZilla is offered exclusively to businesses and organisations. The following documents together form the contractual framework for our services. In the event of a conflict, the order of precedence in the Supplementary Terms applies.

In short: your plan grows with you. If you use more than your plan includes, your account automatically moves up to the next plan, with more volume and more features. Your videos never stop. Only in the highest plan do you pay for additional usage per GB of storage, per GB of traffic, per minute of transcoding and per minute of subtitles and translations. We warn you at 80% and at 100% of your included volume, and before every upgrade.

No lock-in. Your content and data remain yours. You can export them in open, standard formats at any time, and we do not charge switching or egress fees.

Reporting illegal content. Anyone can report content on StreamZilla that they believe is illegal via e-mail. Please include the exact URL, a reasoned explanation, your name and email address (not required for material related to child sexual abuse), and a statement that your report is accurate and complete. Clearly criminal material is removed immediately and reported to the authorities.

Reporting vulnerabilities. Found a security vulnerability? Report it to e-mail before sharing it with others. We respond within one working day and take no legal action against anyone who reports in good faith and causes no damage.

Privacy

We are a European company with our own platform in the EU, and privacy by design is how we build. We do not monetise your content or data, we do not use it to train AI models, and we do not share it with third parties except where necessary to deliver our services.

Two roles

For the videos and viewer data in your account, you are in charge. You are the controller and we are the processor. The Privacy and Data Processing Agreement sets out exactly what we process on your behalf and how we protect it.

For the data we need about you as a customer, we are responsible. This privacy statement explains how Jet-Stream Services B.V. handles that data as controller.

What we process about you, and why

You can object to receiving news at any time, via the unsubscribe link in each message or by emailing e-mail.

How we protect it

• All data is processed and stored in the EU, on our own platform in two independent data centres in the Netherlands.
• We do not use third-party analytics, tracking cookies or advertising cookies. Our statistics are server-side, cookieless and pseudonymised, and not shared with any third party.
• Payments are handled by our payment service provider Mollie B.V. (the Netherlands). We do not store your card or bank account details.
• Our email is handled by a European email provider, under European law.
• Access to data is limited to employees who need it for their work, all bound by confidentiality.

How long we keep it

We do not keep personal data longer than necessary for the purpose for which it was collected. Invoices and related administrative records are kept for seven years, as required by Dutch tax law. Access logs are deleted no later than three months after registration.

Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. Send your request to e-mail; we respond within one month. If you are not satisfied with how we handle your data, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Cookies

Our website does not use cookies, and our player places none. That is why there is no cookie banner.

Sub-processors

In our standard service, all sub-processors are established in the EEA and none is subject to the jurisdiction of a third country.

We inform customers at least thirty days before a new sub-processor starts processing personal data.