Sovereignty & security
European by design.
Critical decisions should not depend on infrastructure, owners or rules outside Europe’s reach. Here is what we control, how you can check it — and where we still depend on others.
01
Owned in Europe
Independent of any government, military or political group.
02
Hosted in the EU
Data and infrastructure in the European Union.
03
Accountable models
Every model decision logged, attributed, reversible.
04
Open about limits
We say how precise we are. We never forecast attacks.
What we control
Ownership, infrastructure, records.
The parts of the system that decide who can see, change or switch off your data.
Ownership
A European company. No government, military or political group owns, funds or directs us.
Infrastructure
Servers, databases and encrypted backups in the European Union. Maps and fonts are served from our own servers.
Your data
Name, work email, organisation and usage — kept to run the service, never sold.
Every record
Each change to an event keeps who made it — an editor or the model policy — when, and why.
revision history · actor · reason
Where we depend on others
We say it before you ask.
No intelligence company is fully independent. These are our dependencies today, and what we do about them.
Language models
We use a third-party model provider under contract to read reports and propose groupings. We are evaluating European providers.
Under the provider’s commercial terms, what we send may not be used to train its models. We send public reports only — never customer data.
Source material
We read public news, official feeds and public channels we do not own. We keep each report as published and link back to it.
Service providers
Hosting, network, email, payments and language-model providers are listed below by type, with where the data is.
Provider types · below
Workspace security
Access, keys and logs.
The controls your security team will ask about, in plain words.
Access by role
Owner, admin, developer or viewer. Only owners and admins manage people and keys.
Sign-in protection
Repeated failed sign-ins are slowed down, then blocked. Invitations expire.
API keys
Shown once, stored only as a hash, revoked instantly. Separate test and live keys.
wsk_<env>_<key id>_<secret>
Activity log
Changes to members, keys and plan are recorded with who and when.
Editorial integrity
How a record earns trust.
Every source labelled
News outlet, official feed or public channel — the label stays with the report.
Every change attributed
Editors can correct any record the model creates.
No forecasts
We record and assess what was reported. We never predict attacks or targets.
Corrections in public
Withdrawn and merged events stay visible, with date and reason.
Documents
For your vendor review.
Data processing agreement
Standard EU terms for workspace customers.
On requestSub-processor list
Every company that processes data for us, by name, and where.
On requestSecurity overview
Architecture, access control, backups and incident response.
On requestCertifications
Listed here only once we hold them.
None yetWho processes data for us
As of 3 November 2026 · changes announced here 30 days ahead
| Type of provider | What they do for us | Where the data is | Data involved |
|---|---|---|---|
| Hosting | Servers and databases for this site, WarStrikes, the workspace and the API | Germany (EU) | All service data |
| Network and backups | DNS, network protection and encrypted off-site backups | Backups in the EU · traffic passes through a global network | Connection data; backups are encrypted before upload |
| Our @tellurial.com mailboxes | Italy (EU) | Messages you send us by email or through the contact form, and our replies | |
| Payments | Payments and invoices for WarStrikes plans | EU and United States | Billing contact and payment details — customers only |
| Website analytics | Google Analytics on tellurial.com, only for visitors who allow it | EU and United States | Pages viewed, device data and online identifiers |
| Language model | Reads public source reports and proposes groupings | United States | Public reports only — no customer data |
Transfers outside the EEA rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. Every provider is bound by a data processing agreement. Customers and teams reviewing us can ask for the full list with company names.
Found a security issue?
Write to [email protected] with steps to reproduce. We acknowledge within 2 working days and keep you updated until it is fixed. Please do not access other customers’ data while testing.