Data Sovereignty
Verify where your data actually lives and flows
Geolocation built for compliance, not advertising
Commercial geolocation services exist to serve ads. They're accurate enough to show you a nearby restaurant, but they reflect where organizations are headquartered—not where specific infrastructure operates. An IP registered to a cloud provider in Seattle might actually be in Prague. Our studies show 40–60% disagreement between commercial providers at city level. For ad targeting, close enough. For GDPR compliance or data localization verification, not even close.
Oscar geolocates infrastructure using physics, not paperwork. We combine IP aliasing—grouping addresses onto physical devices—with latency measurements from over 10,000 collectors worldwide. When we know 50 IP addresses belong to one router, we aggregate geolocation evidence across all of them. Packets can't travel faster than light. Round-trip times expose impossible claims—and BGP data and traceroutes reveal how traffic actually moves, not just where endpoints sit. If a vendor says your data stays in the EU but the routing path transits through infrastructure outside it, Oscar shows you.
Inspect infrastructure locations
Oscar returns layered geolocation: registry claims, commercial estimates, and latency polygons showing where infrastructure can physically be. Discrepancies surface immediately.
Verify compliance boundaries
Map your infrastructure and your vendors' against jurisdictional requirements. Identify assets in restricted regions or data crossing borders that regulations prohibit.
Audit vendor claims
Compare what vendors attest against what Oscar observes. Registry data reflects paperwork. Latency measurements reflect physics.
Monitor routing paths
Traceroute data shows where traffic actually flows. Identify foreign transit, routing through sensitive regions, or dependencies outside compliant jurisdictions.
Most compliance tools stop at "where is this IP?" Oscar answers the harder question: "where does traffic to this IP actually go?" A server can be in Frankfurt and still have its traffic routed through infrastructure in a country your regulators care about. Routing paths change. Providers make BGP announcements that redirect traffic through unexpected jurisdictions. These aren't edge cases—they're how the internet works.
Oscar combines geolocation with routing analysis to give you the full picture: where infrastructure physically sits, where traffic flows to reach it, and whether either answer has changed since you last checked. That's the difference between compliance on paper and compliance in practice.