Privacy Policy

Last updated: 5 September 2026

Who we are and what this covers

viaGraph B.V. ("viaGraph", "we", "our", or "us") is a private limited company registered in the Netherlands. "Whisper Security" is the brand under which we offer our services. This Policy describes how we process personal data in connection with our website at whisper.security, our customer console at console.whisper.security, our query API at graph.whisper.security, and our Model Context Protocol server at mcp.whisper.security (the "MCP Server").

For the purposes of the EU General Data Protection Regulation (GDPR), viaGraph is the data controller for the personal data described here. Our contact details are at the end of this Policy.

At a glance

This summary is for orientation only and does not replace the detail below.

  • We do not sell personal data, and we do not use your queries, results, or conversation history to train models owned by us.
  • Every request to the MCP Server must be authenticated. The query API additionally offers a keyless anonymous tier, limited to short traversals, so that the documentation examples can be run without an account.
  • The MCP Server is read-only. Its tools query the graph and return results; none of them can create, modify, or delete anything, and none of them can reach outside the graph into your systems.
  • The MCP Server cannot read your AI assistant's chat history, memory, system instructions, or uploaded files. The Model Context Protocol does not expose them to us.
  • No tool on the MCP Server sends your data to an AI model provider. The console's optional natural-language query generator is the one feature that does: it sends your question — never your results — to OpenAI.
  • Our graph contains personal data about people who are not our customers, taken from public domain-registration records and similar sources. If that is you, see "Personal data in the graph" and "Your rights".
  • The query text we store has string literals removed, so the indicator values inside your query do not enter our logs.
  • Our marketing website uses analytics, advertising and visitor-identification tools. None of them loads until you accept the matching category in our consent banner, and none of them runs on the console, the query API, or the MCP Server.

Information we collect

From you directly

When you create an account, subscribe to a paid plan, contact us, or complete a form on our website, we collect your name and email address from your sign-up provider (and, where you authenticate through a third party such as Google or GitHub, the identifier that provider returns); your billing name, email address and payment method, where card details are submitted directly to Stripe and are never collected or stored by us; the contents of support requests and enquiries, including any attachments you choose to share; and the marketing and attribution identifiers associated with your visit.

When you use the query API or the MCP Server

The MCP Server lets you query our internet-infrastructure graph directly or through an AI assistant such as Claude Desktop, Claude Code, Cursor, or VS Code. Authentication is required on every endpoint, using OAuth 2.0 or a static API key issued from your account.

Some of its tools run prepared multi-step workflows. To do that, they pass the parameters you supply — which may include hostnames, addresses and other indicators — together with your API credential, to a workflow-execution endpoint we host at Vercel. See "Who we share information with" below.

For each request we record an audit entry containing:

  • an identifier for the calling account — or, on the keyless anonymous tier of the query API, your IP address, which is what that tier's rate limits are counted against;
  • the request path, method and time;
  • the response status, execution time and result size, and the outcome of our query-safety validator;
  • the plan under which the request ran; and
  • the Cypher query text with string literals replaced by a placeholder, so that the indicator values, hostnames and addresses inside your query do not enter our logs.

Where you call the query API directly, your IP address and user-agent string are also recorded. Where you reach it through the MCP Server, the address recorded is our own server's rather than yours.

We hold this because it is shown back to you in your usage dashboard, because we need it to investigate incidents, debug failed queries and detect abuse, and because it is how we measure and reconcile usage. We do not use it to train models owned by us, and we do not sell it.

On our website

See "Cookies, analytics and advertising" below.

What is in the graph

The graph aggregates internet-infrastructure data from public registries, open datasets and licensed feeds: DNS and domain-hierarchy records; BGP routing data, IP allocations, ASN ownership and RPKI data; domain-registration records obtained from WHOIS and RDAP; TLS certificate metadata and certificate-transparency observations; a web-link graph derived from the open Common Crawl dataset; GeoIP data licensed from MaxMind; public and licensed threat-intelligence feeds; and physical-infrastructure reference data such as facilities, internet exchanges, submarine cables, CDN points of presence and cloud regions.

Personal data in the graph

The graph contains personal data about third parties — chiefly the names, email addresses, postal addresses and telephone numbers of people recorded as registrant, administrative, technical or abuse contacts in domain-registration records. This data is not collected from you, and it does not reach us from the individuals concerned; it comes from registries, registrars and feed providers. Most records of this kind relate to organizations and role mailboxes, but some relate to natural persons, and those are personal data.

Legal basis. We process this data under GDPR Article 6(1)(f), legitimate interests: providing cybersecurity, threat-intelligence and infrastructure-research capabilities to organizations that use them to defend networks. Recital 49 expressly recognizes the processing of personal data, to the extent strictly necessary and proportionate, for the purposes of ensuring network and information security as a legitimate interest. Recital 49 establishes the interest; it does not remove the necessity and balancing tests, and we have carried out both.

Our balancing assessment, in short. The interest is the detection and investigation of malicious internet infrastructure. The processing is necessary because attributing infrastructure depends on the registration and routing records that identify who operates it, and no less intrusive dataset answers the question. Against that we weigh the reasonable expectations of registrants: the records were published by registries under their own policies, we do not enrich them with data from unrelated contexts, we do not build behavioural profiles of individuals, we make no automated decisions producing legal or similarly significant effects about any individual, and access requires an authenticated account subject to contractual use restrictions. The full assessment is available on request.

Article 14 and the source of the data. Because we do not obtain this data from the individuals concerned, GDPR Article 14 applies, and we rely on the exemption in Article 14(5)(b) for individual notification: the records reach us in bulk and generally carry no verified link between a registration record and an identified natural person, so identifying and contacting each individual would require processing more data about them than we hold today, and directly mailing hundreds of millions of registration addresses would itself be a greater intrusion than the one it cures. Where individual notice is not given, Article 14(5)(b) requires that the information be made publicly available instead. This section, together with "Your rights" below, is that public notice.

Redacted records. Where a registry or registrar redacts registration data, we record it as redacted. We do not attempt to reconstruct redacted fields from other sources, and we do not treat the public availability of a record as evidence that its publication was lawful.

We do not knowingly include payment data, government identifiers, biometric data, or other special categories of personal data under Article 9 in the graph.

How we use information, and our legal bases

We process the personal data described above to:

  • provide, maintain and improve our website, console, query API and MCP Server;
  • authenticate requests and apply the plan and query-safety limits that apply to your account;
  • investigate incidents, abuse and security events;
  • reconcile billing and produce usage reports;
  • send technical notices and support communications;
  • send marketing communications, with your consent or where otherwise permitted by law; and
  • comply with our legal obligations.

Our legal bases are performance of our contract with you, for providing the service and billing for it; your consent, for marketing and for everything behind our consent banner; our legitimate interests, for security, abuse prevention, product improvement and the graph data described above; and compliance with legal obligations.

Providing the account and billing data described above is a contractual requirement: without it we cannot open an account for you or bill you, so we could not provide the service. Everything else is optional, and declining it costs you nothing beyond the feature it supports.

AI model providers

No tool on the MCP Server calls a language model, and neither does the query API. When you use the connector, the AI assistant you already run is the only model in the loop, and your relationship with that assistant's provider is governed by your agreement with them, not by us.

Our customer console offers one optional feature that does use a model: a natural-language query generator. You describe what you want in plain English, and we send your question — together with a description of the graph schema and, in a multi-turn conversation, the recent messages of that conversation — to OpenAI, which returns a candidate Cypher query for you to review and run. Where you ask it to fix a query you have already written, the query and the error it produced are sent as well.

OpenAI never receives your results. Generating a query and running it are separate steps: the query is returned to you first, and we validate and execute it afterwards, against the graph. No rows are sent to the provider at any point, and your question is not written to our logs. We use OpenAI through their API, which under their published terms does not train their models on data submitted that way. Conversation context is discarded shortly after you stop using it.

The generator is optional and nothing else in the product depends on it. Treat the field as you would any other input you send us: your question is transmitted verbatim, so if you would rather no third party saw it, write the Cypher yourself.

If we introduce a further feature that sends your input to a third-party model provider, we will name that provider below and describe the data flow here before the feature is made available to you.

Cookies, analytics and advertising

This section applies to our marketing website and, for analytics and CRM, to the customer console. None of these tools runs on the query API or the MCP Server, none of them plays any part in the graph, and none of them is used to make an automated decision about you.

Everything described here loads only after you accept the matching category in our consent banner, and you can change or withdraw that choice at any time from the cookie settings on our website. Nothing in this section runs if you decline. Strictly necessary cookies — those that authenticate you, remember your preferences and secure our forms — are the exception, and always load.

  • Analytics. Google Analytics via Google Tag Manager, and Microsoft Clarity, which records how pages are used — including mouse movement, clicks, scrolling and a replay of the page interaction — so that we can see where the site is confusing. We do not use it to identify individuals.
  • CRM and marketing. HubSpot, for enquiry forms and to understand which content leads to a conversation.
  • Advertising. Google Ads and Reddit Ads conversion tracking and remarketing. Where you submit a form we also send Google a cryptographic hash of your email address, so that a conversion can be matched to the advertisement that produced it — we send the hash, never the address.
  • Visitor identification. RB2B, Vector and Apollo.io, business-to-business services that match network and device signals against their own and third-party datasets in order to tell us which organization is visiting and, for some visitors in the United States, which individual. A coarse geographic lookup of your IP address (ip-api.com) is used for the same purpose.

If you would prefer not to be identified this way, decline the marketing category — RB2B does not load at all if you do. You can additionally write to privacy@whisper.security and we will add you to the provider's exclusion list.

The cookie declaration published on this page lists the individual cookies in use and their purposes.

Who we share information with

We share personal data with the service providers below, each of which processes it on our behalf under written terms. We may update this list from time to time as our providers change, and we will publish an update at least 30 days before it takes effect for existing customers.

  • Clerk, Inc. (US) — sign-up, sign-in, OAuth and account management.
  • Stripe (IE/US) — payment processing and subscription billing.
  • Hetzner Online GmbH (DE) — hosting of our application servers and data stores.
  • Vercel Inc. (US/EU) — hosting of our website and console, and of the workflow-execution endpoint that your workflow parameters and API credential pass through.
  • Cloudflare, Inc. (US/EU) — edge proxy, TLS termination, DDoS protection and bot detection on sign-in.
  • Better Stack (EU) — observability and log storage.
  • OpenAI, L.L.C. (US) — natural-language query generation in the console, as described above.
  • HubSpot, Inc. (US) — customer-relationship management and website forms.
  • Intercom Inc. (US/EU) — customer support and ticketing.
  • Prismic SAS (FR) — the content management system behind our website and documentation.
  • Cybot A/S (DK) — Cookiebot, our consent management platform.
  • Google Ireland Limited / Google LLC (IE/US) — website analytics and advertising.
  • Reddit, Inc. (US) — advertising conversion tracking and remarketing on our website.
  • Microsoft Corporation (US/EU) — Microsoft Clarity, website analytics and session replay; and, where you subscribe through the Azure Marketplace, subscription fulfilment.
  • RB2B (US), Vector (US) and Apollo.io (US) — website visitor identification, together with the identity-resolution providers they load in the browser, principally LiveIntent, Inc. (US).
  • ip-api.com — coarse geographic lookup of a visitor's IP address on our website.
  • MaxMind, Inc. (US) — GeoIP data licensor. No customer data is sent to MaxMind.

We also disclose personal data where we are legally required to do so, and to our professional advisers where necessary. We do not sell personal data.

Where data is processed

The graph, the query API, the MCP Server and our data stores run on servers located in the European Union. Our website and console front ends run on Vercel's global platform and may be served from outside it. The providers listed above process data in the regions indicated alongside each entry.

Where a provider processes personal data outside the European Economic Area, we rely primarily on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supported by a transfer impact assessment and, where relevant, additional technical and organizational measures. For transfers to the United Kingdom and Switzerland we use the UK International Data Transfer Addendum and the Swiss-recognized version of the Clauses respectively. Where a recipient additionally certifies under an adequacy decision, that adequacy may apply alongside the Clauses; we do not rely on it as our sole mechanism. A copy of the Clauses relevant to a given transfer is available on request.

Security

We apply technical and organizational measures designed to protect personal data, including TLS encryption in transit on all customer-facing endpoints, restricted and audited access to operational systems for personnel with a need to know, authentication enforced on every MCP Server endpoint, and a query validator that rejects write and administrative statements before they reach the database.

API keys are never written to our application logs. If you believe a key has been exposed, revoke it from your console immediately; revocation takes effect on the next request.

We publish a vulnerability-disclosure channel at /.well-known/security.txt and at security@whisper.security.

No method of transmission over the internet is fully secure, and we cannot guarantee absolute security.

Retention

  • Operational and audit logs: generally up to 90 days.
  • Query-audit records — the per-request history behind your usage dashboard: up to 12 months.
  • Account, billing and support records: for the life of your account, and afterwards for as long as we need them for tax, accounting and legal-claim purposes. If you close your account, your identity data is deleted within 30 days, during which you may ask us to reactivate it.
  • Aggregate usage counts containing no query content: up to 13 months, to support year-over-year reporting and tax-audit windows.
  • Website analytics, advertising and visitor-identification records: under the providers' own retention settings, and by us for no longer than 26 months.

When we no longer have an ongoing legitimate business need to process your information, we delete or anonymize it.

Your rights

Depending on your location, you may have rights under the GDPR or other applicable laws, including the rights of access, rectification, erasure, restriction of processing, data portability, and objection. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Write to privacy@whisper.security to exercise any of these. We will respond within one month, extendable by two further months for complex or numerous requests, and we will tell you if we need the extension.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. In the Netherlands this is the Autoriteit Persoonsgegevens. We would appreciate the chance to address your concern first.

If your personal data appears in the graph

If you are not a customer and your details appear in the graph because they were published in a domain-registration record or a similar source, write to privacy@whisper.security with the identifier concerned — for example the domain name, email address, or telephone number. We do not require you to create an account, and we will not ask you for identity documents where control of the identifier can be demonstrated more simply.

  • Objection (Article 21(1)). We assess every objection on its own facts. The burden is on us to demonstrate compelling legitimate grounds that override your interests, rights and freedoms. We do not refuse an objection on the ground that the data was already public.
  • Restriction while we assess (Article 18(1)(d)). On request we restrict processing of the records concerned for the duration of our assessment.
  • Erasure (Article 17(1)(c)). Where we cannot demonstrate overriding grounds, we erase the records and add the identifier to a suppression list, so that it is not reingested from the same source.
  • Where we may decline. We may decline erasure in the narrow case where the record is itself an active indicator of malicious activity, or where retention is necessary for the establishment, exercise or defence of legal claims. We will tell you which applies and why, and you may challenge that decision.

Regional notices

United Kingdom. Where the UK GDPR applies to our processing, the descriptions in this Policy apply equally, and the Information Commissioner's Office is the relevant supervisory authority. You may complain to us at privacy@whisper.security with "Data protection complaint" in the subject line, and we will acknowledge within 30 days. You may complain to the ICO at any time, and you do not have to come to us first.

United States. We provide these disclosures to the extent the laws referred to apply to us; we do not represent that any particular state privacy statute currently applies to viaGraph. The categories of personal information we collect, their sources, the purposes we use them for, and the categories of third parties we share them with are described above. In the vocabulary used by California law, the categories are identifiers, commercial information, internet or other electronic network activity, geolocation inferred at city level from an IP address, and professional information.

We do not sell personal information for money. We do, however, use advertising and visitor-identification technologies on our marketing website that may constitute "selling" or "sharing for cross-context behavioral advertising" as those terms are defined by California law — specifically Google Ads remarketing and RB2B. These load only if you accept the marketing category in our consent banner, and declining is a complete opt-out. You may also withdraw a previous acceptance at any time from the cookie settings on our website, or write to privacy@whisper.security with "Do Not Sell or Share My Personal Information" in the subject line. You may request access to, correction of, or deletion of your personal information, and appeal a decision we make on such a request, at the same address; we will not discriminate against you for exercising these rights. We do not knowingly collect personal information from children. There is no common industry standard for responding to browser Do Not Track signals, and our website does not currently respond to them.

Changes to this Policy

We may update this Policy from time to time. We will update the "Last updated" date above and, for material changes, notify account holders directly at least 30 days before the change takes effect. Where the law requires your consent, we will obtain it first.

Contact

viaGraph B.V.

Keizersgracht 520 H, 1017 EK, Amsterdam, Netherlands

KVK: 95822429 — VAT: NL867322433B01

Privacy questions and data-subject requests: privacy@whisper.security

Security disclosures: security@whisper.security

General legal questions: legal@whisper.security

Cookies in Use

The table below is generated automatically by our consent management provider and lists every cookie set across whisper.security and console.whisper.security, the category each falls under, its purpose, and its expiry. You can change your consent at any time by clicking the cookie icon in the bottom-left of any page.