PRIVACY BY ARCHITECTURE | MOBILE THREAT DEFENCE
Full protection. Zero surveillance.
Most mobile security asks people to trade privacy for protection. Corrata doesn’t. Every threat check runs on the phone itself, so personal data never has to leave it.
EU-native • ISO 27001 certified • GDPR compliant
WHY IT MATTERS
Phones are personal. If security can see location, messages or browsing, staff push back, works councils block it and DPOs slow it down. Privacy now decides whether mobile security gets deployed at all.
100%
of threat inspection happens on the device itself.
Zero
user traffic routed through Corrata infrastructure.
#1 of 20
Highest overall score in the GigaOm Radar for MTD 2025.
Two ways to inspect a phone
THE COMMON APPROACH
Send it to the cloud
Traffic is tunnelled through a vendor VPN or cloud proxy to be checked. Activity leaves the phone, adds latency and lands on someone else’s servers.
THE CORRATA APPROACH
Check it on the phone
Deep packet inspection runs inside the Corrata agent. Threats are blocked in place. Only the security verdict reaches your console.
What that means in practice
The privacy questions users, DPOs and works councils ask first, answered plainly.
| The concern | How Corrata handles it |
|---|---|
| Location tracking | Never collected. No GPS, no location history, no movement data. Not a setting you switch off. It was never built in. |
| Files, photos and messages | Never scanned. Corrata inspects network traffic only. Nothing else stored on the device is touched. |
| Browsing history | Never touched. Corrata does not read, scan, store or analyse browsing history in any way. It is not something we use. |
| Traffic routing | No VPN backhaul and no cloud proxy. Traffic goes where the user sends it, once it has been checked on the phone. |
| Battery and connectivity | No round trip to a remote server. No added latency, no dropped connections, no extra battery drain. |
| Personal use on BYOD | Personal life stays personal. Your console sees risk and posture, not what someone does with their phone. |
DATA TRANSPARENCY
Exactly what we see. And what we don’t.
Data minimisation by design, not by policy. If we never collect it, it can’t be misused, breached or requested.
Stays on the device
- Location and movement
- Messages, emails and texts
- Photos, files and documents
- Browsing history, never scanned or used
- Personal app data on BYOD and mixed-use phones
Shared with your console
- Security events and verdicts
- Device risk and posture
- OS version and compliance status
- Risky app alerts
Why privacy wins the deal
Works councils say yes
No location, no content, no monitoring of staff. A clear story for employee representatives, without months of back and forth.
DPOs sign off faster
Minimal data leaves the device, so the DPIA is shorter, the legal basis is simpler and GDPR obligations are easier to meet.
BYOD is possible
Staff install the app because it can’t see their personal life. Higher enrolment, fewer opt-outs, real coverage.
Users don’t notice it
Fast, quiet and light on battery. Nothing to see until it blocks an attack. No helpdesk tickets about slow phones.
EU DATA SOVEREIGNTY
European data. European company. European law.
Corrata is headquartered in Dublin and built under EU law. Your security data is hosted in the EU as standard. And because inspection happens on the phone, there is very little of it to host in the first place.
WHERE IT LIVES
In the EU. As standard.
Console data, security events, logs and backups are hosted in the EU. Not an add-on, not a premium tier.
WHO RUNS IT
A European company.
Headquartered in Dublin. Contracts governed by Irish and EU law.
WHO SEES IT
Fewer people than you’d think.
Role-based access under ISO 27001 controls. Every access logged. Full sub-processor list, with locations, on request.
The safest data transfer is the one that never happens.
Messages, location, files and browsing never leave the phone. There is no personal content on our servers to move outside the EU, hand to a foreign authority, or lose in a breach.
GDPR, ARTICLE BY ARTICLE
Compliance that comes from the architecture.
How Corrata maps to the parts of GDPR your DPO will check first.
| GDPR | What it asks | How Corrata meets it |
|---|---|---|
| Art. 5(1)(c)Data minimisation | Collect only what’s necessary | Only security verdicts and device posture leave the phone. Content never does. |
| Art. 25Privacy by design and default | Build privacy in, don’t bolt it on | Location tracking was never built. Privacy isn’t a setting an admin can switch off. |
| Art. 28Processors | A binding contract with every processor | Standard DPA and full sub-processor list available. |
| Art. 32Security of processing | Appropriate technical and organisational measures | ISO 27001 certified platform and operations. |
| Art. 35DPIA | Assess high-risk processing before you start | Minimal data in scope means a shorter, simpler DPIA. DPIA support pack available. |
| Chapter VInternational transfers | Safeguards for any data leaving the EU | EU hosting as standard. Personal content never leaves the device, so there is nothing to transfer. |
| Art. 15 to 22Data subject rights | Answer access and erasure requests | We hold so little personal data that requests are quick to answer. |
WHY SOVEREIGNTY MATTERS NOW
Your vendor’s postcode is now a compliance question.
Transfer frameworks keep falling
EU courts struck down Safe Harbor in 2015 and Privacy Shield in 2020. Smart teams are planning for the day the current EU-US framework goes the same way. EU hosting removes the dependency.
Foreign law can reach EU data
Under the US CLOUD Act, US providers can be compelled to hand over data they control, wherever it is stored. Where your vendor is based matters as much as where its servers sit.
NIS2 and DORA reach your suppliers
Both require organisations to manage security risk across their ICT supply chain. An EU-based, ISO 27001 certified vendor with a short data inventory makes that assessment simpler.
Eight privacy and sovereignty questions worth asking any MTD vendor
We are happy to answer every one of these in writing.
- Is traffic inspected on the device, or routed through your VPN or cloud?
- Do you collect location data? Can it be removed entirely, not just hidden?
- Does your agent access files, photos or message content?
- Exactly what data leaves the device? Can we see the full inventory?
- Where is that data hosted, and who can access it?
- Is your company, or your hosting provider, subject to non-EU laws that can compel access to our data?
- Can you share your full sub-processor list, with locations?
- If the EU-US Data Privacy Framework fell tomorrow, would anything about your service change?
EU
Data residency as standard
ISO 27001
Certified platform and operations
GDPR
Privacy by design, Dublin HQ
MISA
Member of Microsoft Intelligent Security Association
Security without surveillance.
Stronger protection than the cloud approach, with none of the privacy trade-offs.