Aller au contenu
EU VETTED

Whereby

Visioconférence · Norvège
Fondé en 2013 · whereby.com

Norwegian browser-based WebRTC video (ex-appear.in, Videonor-owned), no-install meetings + Embedded SDK; ISO 27001 + GDPR + HIPAA.

Whereby propose un hébergement européen en Irlande, mais une maison mère ou un sous-traitant américain laisse une exposition matérielle au CLOUD Act. Référencé dans la catégorie Visioconférence.

Notes d’évaluation

Whereby (originally appear.in, spun out of Norwegian telecom Telenor as a summer intern project and now owned by Videonor, a Norwegian entity) is a browser-based WebRTC video-calling platform without installs or accounts at the meeting-attendee level; ISO 27001 certified, GDPR and HIPAA compliant, sold as both consumer-style Whereby Meetings and Whereby Embedded (API/SDK for product builders). Norway holds an EU adequacy decision (SCC-free EU↔NO transfers). The DPA now names the hosting provider explicitly: Amazon Web Services EMEA SARL (Luxembourg / Ireland) stores user account information, and clause 7.5 commits DPA-covered data to Ireland or another EU/EEA location. CLOUD Act flag raised to material at the 2026-08 re-verify because that EU/EEA commitment covers only account data: the DPA explicitly carves out call content (voice, video, text, files) and traffic metadata, the privacy policy states usage information is stored in Ireland and the United States, and Whereby routes calls through a worldwide mesh of its own SFU media routers rather than an EU-confined media plane. EU-adequate jurisdiction, ISO 27001 certified, public DPA, but the video path itself is not contractually EU-bound and there is no confirmed EU ownership.

Constats

CLOUD Act
Actionnariat
Sous-traitants
— non divulgué

Signaux vérifiés

Juridiction
  • Hébergement UE / adéquation: Oui
  • Opérateur UE / adéquation: Oui
  • Aucune exposition au CLOUD Act: Non
Transparence
  • DPA public: Oui
  • Sous-traitants divulgués: Oui
  • Clients open source: Non
  • Certification tierce: Oui
Aller à

À propos de Whereby

Whereby is a Norwegian browser-based video-meeting platform originally launched as appear.in in 2013 as a summer-intern project inside the Norwegian telecom group Telenor. The product grew a strong user base internationally before being spun out and acquired by Videonor (a Norwegian holding entity) with the brand renamed to Whereby. The core proposition is unusual in the video-conferencing category: no installs, no accounts for meeting attendees, just a URL that opens in any modern browser via WebRTC. The product surface is two-tier: Whereby Meetings for individuals and teams (consumer + business plans), and Whereby Embedded, an API/SDK that lets product builders embed Whereby's WebRTC video into their own applications, competing directly with Twilio Video, Daily, Agora, and Zoom SDK.

Compliance posture is solid for a consumer-friendly video tool: ISO/IEC 27001 certified, GDPR-compliant by design, HIPAA-compliant for US-healthcare customers, and a privacy-first product philosophy carried over from the Telenor engineering culture. The legal entity sits in Norway (EEA member, EU adequacy decision under Art. 45 GDPR, SCC-free for EU↔NO transfers). The underlying infrastructure is now named: the DPA lists Amazon Web Services EMEA SARL (Luxembourg / Ireland) as the sub-processor storing user account information, and clause 7.5 commits DPA-covered data to Ireland or another EU/EEA location. That commitment does not reach the call itself. The DPA expressly carves out the content transmitted between users (voice, video, text, files) and traffic metadata, the privacy policy states usage information is stored in Ireland and the United States, and Whereby routes calls across its own worldwide mesh of Selective Forwarding Units rather than an EU-confined media plane, with no published EU-only media-residency option. The Session Transcription and Live Captions features add a speech-to-text vendor that is named in neither the documentation, the feature pages nor the DPA. CLOUD Act exposure is recorded as Significative on that basis.

Pricing is freemium with a long history of generous free tiers (free unlimited 1-on-1, free group meetings up to 45 minutes); paid plans add custom rooms, branding, longer meetings, advanced controls, recording, and analytics. Embedded pricing is usage-based per video-minute. Best fit: agencies and consultancies needing easy no-install client video calls, educational and healthcare workflows that benefit from no-account meetings, developers building video into their own products via Embedded, and Norwegian / Nordic / European buyers who specifically want a Norwegian-rooted EU-friendly alternative to Zoom and Google Meet.

Carte des sous-traitants · non divulgué

L'éditeur ne publie pas de liste de sous-traitants. La conformité Schrems II et l'exposition au CLOUD Act ne peuvent pas être vérifiées indépendamment sans elle.

Référentiels & certifications

ISO/IEC 27001
Active

Matrice de fonctionnalités

Tableau 1Fonctionnalités de Whereby

Auto-hébergeable Non
Participants max 200 participants
Partage d’écran Oui
Enregistrement Oui
Chiffrement de bout en bout Non
Breakout rooms Oui
Accès navigateur (sans app) Oui

Intégration & accès

REST API Oui
SSO (SAML / OIDC) Oui

Conformité & gouvernance

Audit log Oui
Self-host / on-prem option Non

Tarifs & paliers

à partir de 10.99 $/mois
Freemium
Voir la page tarifs

Documents publics

  • Contrat de sous-traitance (DPA)
    whereby.com/information…
    Ouvrir
  • Liste des sous-traitants
    whereby.com/information…
    Ouvrir
  • Conditions d'utilisation
    whereby.com/information…
    Ouvrir

Alternatives dans cette catégorie

  • Element (Matrix)
    Royaume-Uni
    Hébergé UE
    DPA public: Oui Sous-traitants: Oui Open source: Oui
  • kMeet (Infomaniak)
    Suisse
    Souverain UE
    DPA public: Oui Sous-traitants: Oui Open source: Non
  • Olvid
    France · 10 €/mois
    Basé UE
    DPA public: Non Sous-traitants: Non Open source: Oui
Voir toutes les alternatives visioconférence