Trust and compliance

Where your data lives

• In the Netherlands. Storage, transcoding, log processing and statistics run on our own infrastructure in Dutch data centres.
• Managed from the Netherlands. Administrative access to production takes place only from the Netherlands, by our own staff, with multi-factor authentication. No follow-the-sun support, no support desk or subcontractor outside the EEA.
• No transfer outside the EEA. Viewers worldwide get fast playback through our European CDN, while your data stays under European law.
• Encrypted. Encrypted transport and encrypted storage, with separate production and test environments.

Two sub-processors. That is all.

Most video platforms rely on a long chain of cloud, analytics and advertising partners. StreamZilla works with exactly two, both European:

• Leaseweb (the Netherlands): data centre and hosting. Leaseweb has no access to your data.
• BunnyCDN (European content delivery network): temporary caching of media fragments and metadata, and temporary access logs, so your videos play fast everywhere.

No trackers, no advertising networks, no American cloud. We inform customers at least 30 days before any new sub-processor would start processing personal data.

Data processing agreement

For the personal data we process on your behalf, StreamZilla is a processor under the GDPR. Every customer gets a data processing agreement. In short:

• We process only on your instructions, never for our own purposes.
• Access logs are cleaned automatically after 30 days.
• You set retention periods per account and collection; deletion covers originals, streams, transcripts, subtitles and metadata.
• At the end of the contract you choose: your data back in open formats, deleted, or both.
• A personal data breach is reported to you within 48 hours, so you can meet your own 72-hour obligation.

Security

• ISO 27001 in practice. We already work according to ISO/IEC 27001:2022, with an operational information security management system. Formal certification is in progress; we do not present ourselves as certified until it is done.
• Penetration tests. We run internal penetration tests. An external penetration test follows, as fits the private beta phase.
• People. Screening of staff, including a certificate of conduct, and mandatory security awareness training.
• Access. Least privilege, multi-factor authentication and logging of administrative actions.
• Monitoring. Infrastructure and streams are monitored around the clock.
• Vulnerability disclosure. Found a vulnerability? Our coordinated vulnerability disclosure policy, based on the guidelines of the Dutch National Cyber Security Centre, explains how to report it. We confirm within two working days and never respond with legal action to a reporter who follows our policy.

Laws and standards

• GDPR: privacy by design, no transfer outside the EEA, no individual viewer tracking by default. See GDPR-compliant video hosting.
• AI Act: no prohibited practices, no high-risk AI systems, no general-purpose AI models. Your videos are never used to train AI. See your videos and AI training.
• Data Act: switch without lock-in, export everything in open formats, no exit fees. See the Data Act guide.
• NIS2 and the Dutch Cyberbeveiligingswet: Jet-Stream is below the size thresholds, but voluntarily meets the duty-of-care measures, because many of our customers are in scope themselves. See NIS2 and video platforms.
• Accessibility: player and publication pages built to WCAG 2.2 AA and EN 301 549, based on internal assessment. See accessible video player.
• Records management: a self-assessment against ISO 16175, including export to an e-depot or archive.
• Quality management: equivalent measures to ISO 9001 within our ISMS, documented for public tenders.
• Sustainability: certified green data centres and energy-efficient software. See green video hosting.

Documents you can request

Customers, purchasers and tendering authorities can request the following documents:

• Information security statement and ISO 27001 certification status
• GDPR compliance statement and data processing agreement
• Sub-processor list
• AI Act compliance statement
• Data Act compliance statement
• Cyberbeveiligingswet (NIS2) scope analysis and statement
• Accessibility statement (WCAG 2.2 AA, EN 301 549)
• Digital sovereignty self-assessment (EU Cloud Sovereignty Framework)
• Substantiation of digital sovereignty, with sources
• Technical compliance and commitment statement on streaming output
• ISO 9001 equivalence statement and ISO 16175 records management statement
• Open source and closed source development statement
• Sustainability statement
• Coordinated vulnerability disclosure policy

On request and under a non-disclosure agreement, you can also inspect the Statement of Applicability and our core policy documents, or arrange a supplier audit.