EU web analytics, sovereign by design

Data residency is not paperwork. Since the Schrems II ruling invalidated the EU-US Privacy Shield, European organisations have had to treat transfers of personal data to the United States as a genuine legal risk — and it is exactly that transfer question that led several data-protection authorities to rule against US-hosted analytics tools.

Pulse removes the question rather than managing it. Visitor data is held on Swiss and EU infrastructure, and there is no US-jurisdiction cloud provider in the path. Nothing leaves for the United States, so there is no transfer mechanism to justify and no adequacy decision to depend on. And because Pulse is cookieless, the data being kept in Europe is aggregate and non-personal in the first place.

EU hosting alone is not full sovereignty if the company controlling the data is subject to foreign law. Under the US CLOUD Act, a US company can be compelled to produce data it controls no matter where the servers sit. The operator’s jurisdiction, not just the data-centre’s location, is what decides who can reach your data.

Pulse is operated by Ciphera BV, a Belgian company — so both the servers and the company responsible for them are in Europe. Ciphera builds deliberately on EU and Swiss infrastructure with the explicit goal of keeping US companies out of the critical path. If EU data sovereignty is a requirement rather than a preference, that combination — EU operator, Swiss/EU residency, no cookies — is the point of Pulse. The GDPR basis explains the compliance side in full.