Zum Inhalt springen
EU VETTED

Whereby

Videokonferenzen · Norwegen
Gegründet 2013 · whereby.com

Norwegian browser-based WebRTC video (ex-appear.in, Videonor-owned), no-install meetings + Embedded SDK; ISO 27001 + GDPR + HIPAA.

Whereby bietet EU-Hosting in Irland, doch ein US-Mutterkonzern oder Unterauftragsverarbeiter hinterlässt ein materielles CLOUD-Act-Risiko. Gelistet unter Videokonferenzen.

Bewertungsnotizen

Whereby (originally appear.in, spun out of Norwegian telecom Telenor as a summer intern project and now owned by Videonor, a Norwegian entity) is a browser-based WebRTC video-calling platform without installs or accounts at the meeting-attendee level; ISO 27001 certified, GDPR and HIPAA compliant, sold as both consumer-style Whereby Meetings and Whereby Embedded (API/SDK for product builders). Norway holds an EU adequacy decision (SCC-free EU↔NO transfers). The DPA now names the hosting provider explicitly: Amazon Web Services EMEA SARL (Luxembourg / Ireland) stores user account information, and clause 7.5 commits DPA-covered data to Ireland or another EU/EEA location. CLOUD Act flag raised to material at the 2026-08 re-verify because that EU/EEA commitment covers only account data: the DPA explicitly carves out call content (voice, video, text, files) and traffic metadata, the privacy policy states usage information is stored in Ireland and the United States, and Whereby routes calls through a worldwide mesh of its own SFU media routers rather than an EU-confined media plane. EU-adequate jurisdiction, ISO 27001 certified, public DPA, but the video path itself is not contractually EU-bound and there is no confirmed EU ownership.

Befund

CLOUD Act
Eigentümer
Unterauftragsverarbeiter
— nicht offengelegt

Geprüfte Signale

Jurisdiktion
  • EU-/Angemessenheits-Hosting: Ja
  • EU-/Angemessenheits-Betreiber: Ja
  • Keine US-CLOUD-Act-Exposition: Nein
Transparenz
  • Öffentlicher AVV: Ja
  • Unterauftragsverarbeiter offengelegt: Ja
  • Open-Source-Clients: Nein
  • Zertifizierung durch Dritte: Ja
Springen zu

Über Whereby

Whereby is a Norwegian browser-based video-meeting platform originally launched as appear.in in 2013 as a summer-intern project inside the Norwegian telecom group Telenor. The product grew a strong user base internationally before being spun out and acquired by Videonor (a Norwegian holding entity) with the brand renamed to Whereby. The core proposition is unusual in the video-conferencing category: no installs, no accounts for meeting attendees, just a URL that opens in any modern browser via WebRTC. The product surface is two-tier: Whereby Meetings for individuals and teams (consumer + business plans), and Whereby Embedded, an API/SDK that lets product builders embed Whereby's WebRTC video into their own applications, competing directly with Twilio Video, Daily, Agora, and Zoom SDK.

Compliance posture is solid for a consumer-friendly video tool: ISO/IEC 27001 certified, GDPR-compliant by design, HIPAA-compliant for US-healthcare customers, and a privacy-first product philosophy carried over from the Telenor engineering culture. The legal entity sits in Norway (EEA member, EU adequacy decision under Art. 45 GDPR, SCC-free for EU↔NO transfers). The underlying infrastructure is now named: the DPA lists Amazon Web Services EMEA SARL (Luxembourg / Ireland) as the sub-processor storing user account information, and clause 7.5 commits DPA-covered data to Ireland or another EU/EEA location. That commitment does not reach the call itself. The DPA expressly carves out the content transmitted between users (voice, video, text, files) and traffic metadata, the privacy policy states usage information is stored in Ireland and the United States, and Whereby routes calls across its own worldwide mesh of Selective Forwarding Units rather than an EU-confined media plane, with no published EU-only media-residency option. The Session Transcription and Live Captions features add a speech-to-text vendor that is named in neither the documentation, the feature pages nor the DPA. CLOUD Act exposure is recorded as Erheblich on that basis.

Pricing is freemium with a long history of generous free tiers (free unlimited 1-on-1, free group meetings up to 45 minutes); paid plans add custom rooms, branding, longer meetings, advanced controls, recording, and analytics. Embedded pricing is usage-based per video-minute. Best fit: agencies and consultancies needing easy no-install client video calls, educational and healthcare workflows that benefit from no-account meetings, developers building video into their own products via Embedded, and Norwegian / Nordic / European buyers who specifically want a Norwegian-rooted EU-friendly alternative to Zoom and Google Meet.

Unterauftragsverarbeiter-Karte · nicht offengelegt

Anbieter veröffentlicht keine Liste der Unterauftragsverarbeiter. Schrems-II-Konformität und CLOUD-Act-Risiko lassen sich ohne sie nicht unabhängig prüfen.

Rahmenwerke & Zertifizierungen

ISO/IEC 27001
Aktiv

Funktionsmatrix

Tabelle 1Funktionen von Whereby

Self-Hosting Nein
Max. Teilnehmer 200 Teilnehmer
Bildschirmfreigabe Ja
Aufzeichnung Ja
Ende-zu-Ende-Verschlüsselung Nein
Breakout-Räume Ja
Browser-Beitritt (ohne App) Ja

Integration & Zugriff

REST API Ja
SSO (SAML / OIDC) Ja

Compliance & Governance

Audit log Ja
Self-host / on-prem option Nein

Preise & Tarife

ab 10.99 $/Monat
Freemium
Preisseite ansehen

Öffentliche Dokumente

  • Auftragsverarbeitungsvertrag (AVV)
    whereby.com/information…
    Öffnen
  • Liste der Unterauftragsverarbeiter
    whereby.com/information…
    Öffnen
  • Nutzungsbedingungen
    whereby.com/information…
    Öffnen

Alternativen in dieser Kategorie

  • Element (Matrix)
    Vereinigtes Königreich
    EU-gehostet
    Öffentl. AVV: Ja Subprozessoren: Ja Open Source: Ja
  • kMeet (Infomaniak)
    Schweiz
    EU-souverän
    Öffentl. AVV: Ja Subprozessoren: Ja Open Source: Nein
  • Olvid
    Frankreich · 10 €/Mt.
    EU-ansässig
    Öffentl. AVV: Nein Subprozessoren: Nein Open Source: Ja
Alle videokonferenzen-Alternativen ansehen