Trust, sovereignty & live status
What runs where, who can see what, and the exact mechanics behind our zero-tracking commitment — with live node health below, not marketing PDFs.
Regional nodes
Live GET /health against each enclave — auto-refreshes.
Live status only — we publish no fabricated uptime percentages. Each node answers for its own sovereign Firestore partition.
Zero third-party tracking
No analytics pixels, no ad tech, no data brokers, no session-replay tooling. The only telemetry is a first-party heartbeat to our own API — nothing ever leaves our infrastructure.
Strictly functional sessions
Sign-in state lives in session storage only — no tracking cookies, no marketing pixels, nothing that requires a consent banner under ePrivacy.
Ephemeral presence signal
The visitor heartbeat stores a daily-rotating HMAC-SHA256 hash of the IP — never the address itself — in a 3-minute live window. Documents auto-expire within 24 hours; no per-visitor history exists.
No per-visitor history
Heartbeats overwrite one document per visitor per day. There is no timeline, no path history, no profile — only an aggregate "who is here right now" window that platform operators can see.
Sovereign partitions
Each regional enclave reads and writes only its own Firestore database — europe-west1 (Belgium) and europe-west2 (London). Regional traffic never crosses partitions.
Tamper-evident audit vault
Every compliance event is hash-chained into an append-only Firestore vault and independently verifiable via signed export — the same chain our own telemetry refuses to bypass.
Every claim on this page executes live against production — run the interactive proof in your browser.
Run the live proof