When someone claims to be GDPR compliant and claims to achieve SEAL level 4 on virtually all sovereignty objectives, you may want to have some proof. Here is how you can check Jet-Stream’s sovereignty yourself.

Test URL: https://player.jetstre.am/?account=25yearsstreaming&file=ReadySetRocknRoll.smil&type=streaming&service=wowza&output=player&poster=readysetrocknroll.jpg&sub=readysetrocknroll_EN.vtt%2Creadysetrocknroll_NL.vtt&events=1&no-ext=all

This test URL loads the Jet-Stream Privacy Player, connects to our load balancers, retrieves the stream, the poster image and the subtitles from our services, and the stream is delivered by the Jet-Stream direct playout without connecting to any third-party service. Based on built-in automatic geo, popularity, cost and performance mechanisms, the load balancers can decide to overflow requests to an EU sovereign CDN partner. No cookies. No trackers. No EU personal data leaking outside our platform or outside Europe. A viewer in the US may be served from a regional edge in the US, owned by the same European CDN; that data never enters the EU, so there is no transfer out of it.

We performed eight checks, run on the Jet-Stream Privacy Player, our backend and our playout, with the raw output, and with the points where we are not yet where we want to be. Every command below is one you can run yourself in a terminal to replicate the test and see the results yourself. None requires more than dig, whois, curl and the developer tools of a browser.

What we checked, and what came out

What we tested, layer by layer

The eight checks were run against every layer a viewer’s request passes through, not just the player. For each layer the question was the same: which legal entity is this, under which law does it fall, and what does it send and store.

The one caveat sits outside these layers, in the default embed: two Google SDKs for Chromecast and advertising that load unless a customer disables them. We come back to it below.

The player

Load the Privacy Player, open the Network tab, play a video to the end with subtitles on. With external services disabled (no-ext=all) the trace contains 48 requests to six hostnames, every one of them under jetstre.am: the player itself, the load balancer, the origin, the subtitle hosts and the CDN. No Google, no analytics vendor, no fonts from a US CDN, no pixel.

●  Then open the Storage tab. Cookies: none. Local storage: none. Session storage: none. Nothing is written to the device, and because there is no analytics script, nothing is read from it either.

That matters more than the word “cookieless”: the ePrivacy rule is about storing on or reading from the device, and a player that reads your screen resolution and ships it to a stats endpoint is not consent-free just because it skipped the cookie. Ours reads nothing and ships nothing.

The events=1 parameter you may see in our embed codes does not change this. It lets the player post playback events to the page it is embedded in, so a customer can sync slides to a talk, highlight a transcript, or control the player locally in the browser. It goes to the page, not to us.

The backend

Who answers when your browser resolves our hostnames?

$ dig player.jetstre.am
player.jetstre.am.   300  IN  A  82.150.152.XXX
$ whois 82.150.152.XXX
inetnum:   82.150.152.XXX – 82.150.152.XXX
netname:   JETSTREAM-NL
org-name:  Jet-Stream BV
address:   Groningen, The Netherlands
created:   2004-04-07

●  The player, the origin and the subtitle hosts answer from address space that has been registered to Jet-Stream since 2004. It is routed through LeaseWeb Netherlands B.V., a Dutch company operating out of Amsterdam, whose own registry record tells you where police and government requests go: a Dutch address, under Dutch law. Jet-Stream hosts its own hardware in LeaseWeb racks, so LeaseWeb does not have access to the data. Our load balancer, takeoff.jetstre.am, answers from multiple addresses in two zones so that it is not a single point of failure.

Look at the response headers from the origin and you will find no via, no x-amz-*, no x-cache, no CDN fingerprint of any kind. You will also find no Server header.

Each playback gets a server-issued session in the URL path. That is how we measure: from the delivery logs, on our own servers, where a viewer cannot be hidden by a content blocker and cannot be invented by a script. Viewing statistics are compiled server-side in our secure EU-hosted service and are not shared with any third party.

The playout: own origin first, European CDN when it matters

By default a video is served from our own platform, end to end. When a video becomes popular, our load balancer moves its playout to a CDN. The thresholds, the business rules and the choice of CDN are configurable per customer. The CDN we use by default is Bunny, a Slovenian company.

A hostname of ours in front of a CDN could hide anything, which is exactly what a case study found at another vendor: a “European CDN” that pulled its video from Amazon CloudFront, which read it from Amazon S3. So here is the same check on us:

$ dig bn-global.airflow.jetstre.am
bn-global.airflow.jetstre.am.  300  IN  CNAME  bn-global-airflow.b-cdn.net.
$ curl -sI https://bn-global.airflow.jetstre.am/…/playlist.m3u8
server: BunnyCDN-FR1-1221
cdn-requestcountrycode: NL
cdn-requestpullcode: 200

And once more over a VPN in the United States:

server: BunnyCDN-IL1-1234
cdn-requestcountrycode: US
cdn-requestpullcode: 200

●  An American viewer gets the video from a Bunny edge in Illinois, which is where you want it served from for performance. We do not claim “EU-only edges”, because that claim is about geography and the question that really matters is about jurisdiction. Data of a US viewer served from a US edge never enters the EU; what matters is who owns the edge and what it pulls from. And in both cases the answer is the same: cdn-requestpullcode: 200 from our own EU-hosted origin services, with no via: cloudfront and no x-amz headers anywhere in the response. The chain is Jet-Stream origin, Jet-Stream Edge, viewer, or Jet-Stream origin, Bunny edge, viewer. Two legal entities, both European, and the second one only when a video is popular enough to need it.

Other CDNs exist in our pool, for example Fastly and Akamai, US companies. These are opt-in per customer, switched off unless a customer explicitly asks for it, and we say so here because a dig on fl-global.airflow.jetstre.am will show you the record and you deserve to know what it is before you find it.

What the checks taught us about ourselves

We ran these checks to answer a question, and they answered one we had not asked. That is the point of running them.

●  Customers who want extra privacy can add the no-ext=all parameter to their URL. Without no-ext=all, the Privacy Player loads the Chromecast sender SDK from www.gstatic.com and the IMA advertising SDK from imasdk.googleapis.com, before a viewer casts anything or sees any ad. Every viewer’s IP address then reaches Google. The parameter that prevents this is publicly documented and works, but it is an opt-in, and we think privacy should not be an opt-in.

So in the next release we are turning this around. We are developing a new version of our player. We want to only load the Chromecast SDK when a viewer clicks the cast icon. The advertising SDK will load only when a playout actually has an ad tag configured. Viewers who never cast and customers who never advertise will never contact Google, and nobody loses a feature. no-ext=xx features stay as a hard guarantee for customers under strict policy, and a Content-Security-Policy on the player will make “no external calls” a rule the browser enforces rather than a promise our code keeps.

●  You may also have noticed wowza being a variable in the URL. This is US owned software which is currently still in use as a legacy JIT packager. It is self hosted and isolated, meaning Wowza cannot access or control anything. It is not used as an end customer or CDN facing origin but shielded by open source caches. Customers can choose to use other packagers too, such as the Dutch (Australian owned) Unified packager. The Wowza packager is being phased out and is set to be replaced by our own more modern and advanced JIT packagers.

We publish this not because it is dramatic but because the alternative is what we see too often in this market: claiming a finished state that does not exist. A vendor that says it has nothing left to fix is either not looking or not telling you.

Open architecture

By the way, Jet-Stream’s platform is open. You can use your own player, since there is zero dependency on players for analytics or access control. You can geographically choose the CDN, per title, in real time. You can use your own origins, with your own transcoders and your own packagers. You can connect any CMS and any backend system, your own monitors and your own analyzers. This open character is by design and takes sovereignty to another level, because sovereignty goes beyond hosting and ownership in Europe: it is about control, independence and freedom. If you like Jet-Stream’s services and pipelines: great. If you want to replace a service with another: also great.

Do it yourself

You do not have to take our word for any of this, and you should not take anyone else’s. For any video platform, including ours:

  1. Open the player in a browser, open the Network tab, play a video to the end. List every domain that is not the vendor’s. Ask what each one is for.
  2. Open the Storage tab. List every cookie, local storage key and session storage key. Ask why each one is there.
  3. dig every hostname in the trace. Follow every CNAME to its end. whois the address it lands on.
  4. curl -sI a media URL from the trace. Read the server, via and x-amz headers. Do it again over a VPN outside Europe.
  5. Ask the vendor where its viewing statistics come from: delivery logs, or a script in the browser.

Five checks, half an hour, no specialist required. Run them on us. If you find something we missed, tell us, and this page will change.

The full test results follow below. The two anonymised case studies, “Sovereignty washing in practice” and “Privacy washing in practice”, are available on request.

Test results

Tested on 12 September 2026 from the Netherlands and over a VPN in the United States, in Safari with its developer tools, plus dig, whois and curl. IP addresses are shown with the last octet masked; session tokens, signed-link tokens, CDN pull-zone and request identifiers are masked. Everything else is as returned.

1. Network trace, no-ext=all

Full playback with two subtitle tracks. 48 requests, 6 hostnames, 0 external.

HostnameRoleRequests
●  player.jetstre.amPlayer page, scripts, styles, iconsdocument, js, css, svg, png, manifest
●  takeoff.jetstre.amLoad balancer, CDN decision per session2 fetches (1.5 KB, 0.7 KB)
●  w1.cdn.jetstre.amJet-Stream origin (first sessions)playlist.m3u8, chunklists, .ts segments
●  bn-global.airflow.jetstre.amBunny CDN (after popularity threshold)playlist.m3u8, chunklists, .ts segments
●  a1.cdn.jetstre.am, a2.cdn.jetstre.amSubtitles, signed expiring linksreadysetrocknroll_NL.vtt, _EN.vtt

Default embed (without no-ext=all), additional hostnames observed: www.gstatic.com (cast_sender.js, Chromecast SDK) and imasdk.googleapis.com (ima3.js, advertising SDK). Both Google. Poster images may additionally be served from fl-global.airflow.jetstre.am (Fastly) on accounts that have opted in to that CDN.

2. DNS

$ dig player.jetstre.am
player.jetstre.am.            300  IN  A      82.150.152.XXX

$ dig takeoff.jetstre.am
takeoff.jetstre.am.           300  IN  A      178.162.182.XXX
takeoff.jetstre.am.           300  IN  A      82.150.152.XXX

$ dig w1.cdn.jetstre.am
w1.cdn.jetstre.am.            149  IN  A      82.150.152.XXX

$ dig a1.cdn.jetstre.am
a1.cdn.jetstre.am.             29  IN  A      82.150.152.XXX

$ dig bn-global.airflow.jetstre.am
bn-global.airflow.jetstre.am. 300  IN  CNAME  bn-global-airflow.b-cdn.net.
bn-global-airflow.b-cdn.net.   35  IN  A      143.244.56.XXX

$ dig fl-global.airflow.jetstre.am          (opt-in CDN, off by default)
fl-global.airflow.jetstre.am. 300  IN  CNAME  n.sni.global.fastly.net.
n.sni.global.fastly.net.       29  IN  A      140.248.137.XXX

3. Registration

$ whois 82.150.152.XXX
inetnum:        82.150.152.XXX – 82.150.152.XXX
netname:        JETSTREAM-NL
descr:          Jetstream BV
country:        NL
org-name:       Jet-Stream BV
address:        Groningen, The Netherlands
created:        2004-04-07
route:          82.150.152.0/24   descr: Jet-Stream routed via LEASEWEB   origin: AS60781

$ whois 178.162.182.XXX
netname:        NL-LEASEWEB-20100205
org-name:       LeaseWeb Netherlands B.V.
reg-nr:         30141839
address:        Amsterdam, NETHERLANDS

4. Headers, Bunny CDN, from the Netherlands

$ curl -sI https://bn-global.airflow.jetstre.am/…/ReadySetRocknRoll.smil/media_b4033536_2.ts
HTTP/2 200
content-type: video/MP2T
server: BunnyCDN-FR1-1315           <- Bunny edge, France
cdn-pullzone: XXXXXXX
cdn-requestcountrycode: NL
cdn-requestpullsuccess: True
cdn-requestpullcode: 200             <- pulled from Jet-Stream origin
strict-transport-security: max-age=15724800; includeSubDomains
(no via header, no x-amz-* headers, no x-cache)

$ curl -sI https://bn-global.airflow.jetstre.am/…/readysetrocknroll.jpg
HTTP/2 200
content-type: image/jpeg
server: BunnyCDN-FR1-1217
cdn-requestcountrycode: NL
cdn-requestpullcode: 206
(no via header, no x-amz-* headers)

5. Headers, Bunny CDN, over a VPN in the United States

$ curl -sI https://bn-global.airflow.jetstre.am/…/ReadySetRocknRoll.smil/playlist.m3u8
HTTP/2 200
content-type: application/vnd.apple.mpegurl
server: BunnyCDN-IL1-1234           <- Bunny edge, Illinois
cdn-requestcountrycode: US
cdn-requestpullsuccess: True
cdn-requestpullcode: 200             <- still pulled from Jet-Stream origin, not from a US cloud
(no via header, no x-amz-* headers)

6. Headers, own origin and subtitle host

$ curl -sI https://w1.cdn.jetstre.am/…/ReadySetRocknRoll.smil/playlist.m3u8
HTTP/2 302
location: /session/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/…   <- server-issued session
strict-transport-security: max-age=15724800; includeSubDomains
(no server header, no CDN headers of any kind)

$ curl -sI https://a2.cdn.jetstre.am/XXXXXXXX/XXXXXXXX/sz/25yearsstreaming/readysetrocknroll_NL.vtt
HTTP/2 200
content-type: text/vtt
content-length: 27834
strict-transport-security: max-age=15724800; includeSubDomains
(signed, expiring link; no server header, no CDN headers)

7. Headers, the two Google SDKs in the default embed

$ curl -sI “https://www.gstatic.com/cv/js/sender/v1/cast_sender.js?loadCastFramework=1”
HTTP/2 200
server: sffe
report-to: {“group”:”cloudview”, … “url”:”https://csp.withgoogle.com/csp/report-to/cloudview”}

$ curl -sI https://imasdk.googleapis.com/js/sdkloader/ima3.js
HTTP/2 200
p3p: policyref=”https://www.googleadservices.com/pagead/p3p.xml”, …
server: cafe
content-length: 499908

8. Browser storage after playback

Safari Web Inspector, Storage tab, origin player.jetstre.am, after full playback with subtitles:
Cookies:          (empty)
Local storage:    (empty)
Session storage:  (empty)

Go back to see all blogposts