Machine translation, not reviewed by a native speaker. In case of doubt, the French text prevails.

Under construction · early access SANTVIA · Protection

See everything. Catch the attack hiding in the noise.

Detkrypt is a sovereign SIEM: it collects the logs from across your information system, correlates them and detects the signs of an attack, with prioritised alerts and audit trails. Hosted and operated in Europe.

Self-hostable on your own servers Multi-source collection Correlation & detection Audit trails EU sovereign
detkrypt — correlation in progress
Correlation in progress
  • Abnormal connections correlated across several sources.
  • Alert raised with its full context.
  • Log retained for investigation and audit.
Prioritised alert — context attachedGrouped from several sources, timestamped.
In brief

A sovereign SIEM: collect, correlate, detect, prove.

Detkrypt is the sovereign SIEM of the SANTVIA galaxy. A SIEM (Security Information and Event Management) collects the logs and events from across the information system, correlates them to spot suspicious patterns, raises alerts and keeps an audit trail for investigation and compliance. Detkrypt is a sovereign alternative to non-European SIEMs, hosted and operated in the European Union. The product is under construction; early access is available on request.

The problem

An attack hides in the noise — and your logs don't speak

The security traces already exist: every workstation, server and service produces logs. But scattered and unreadable, they're useless. An intrusion advances in small, innocuous steps that no one cross-references, while compliance — NIS2 first — demands audit trails that are kept and usable.

Scattered, unreadable logs

Every device dumps its logs in its own corner, in its own format. Without collection or normalisation, the useful signal drowns in the volume and stays unusable.

The attack slips under the radar

An intrusion moves in weak signals, harmless one by one. With no correlation across sources, it progresses unseen — and is found too late.

Non-EU SIEMs, costly, offshored

Market platforms are non-European, billed by volume and send your security data outside the Union — just as sovereignty becomes a requirement.

The solution

Collect, correlate, detect — sovereignly

Detkrypt gathers everything your information system produces, makes sense of it and surfaces what matters: the alert that counts, with its context, within a European circle of trust.

Collection

Unified collection

Every source in one place: workstations, servers, network, cloud and applications. Logs are normalised into a common format, ready to be cross-referenced and searched.

Detection

Correlation & detection

Correlation rules and anomaly detection link weak signals across sources. An innocuous sequence becomes a visible attack pattern.

Alerts

Alerts in plain language, with context

Not an avalanche of lines, but prioritised alerts in plain language, with what you need to understand and act fast.

Sovereignty

Data and operation in the EU

Detkrypt is hosted and operated in France and the European Union. Your logs and their processing never leave the circle of trust.

Key features

Everything a SIEM should do — as standard

From collection to audit, the essentials of a security centre, with European sovereignty and native galaxy integration on top.

Multi-source collection

Workstations, servers, network, cloud and apps, in one place.

Log normalisation

Heterogeneous formats brought to a common language.

Correlation rules

Link events from several sources into a single pattern.

Anomaly detection

Spot the deviation from normal behaviour, not just a signature.

Prioritised alerts

What matters surfaces, with its context, in plain language.

Dashboards & search

See the state at a glance, search across the logs.

Audit trails & retention

A log kept, maintained and usable for compliance.

Endkrypt & Dnskrypt integration

Ingests the Endkrypt EDR detections and DNS logs.

Detkrypt composes with the galaxy: it ingests the detections of the Endkrypt EDR and the logs of the sovereign DNS Dnskrypt, alongside all your other sources. The EDR sees the endpoint, the SIEM cross-references the whole information system.
The heart of the SIEM

Correlation: catching what isolated tools miss

Taken on their own, each event looks ordinary. It's by cross-referencing them that the attack pattern appears. Correlation is what sets a SIEM apart from a mere log collector — and what catches what a point tool lets through.

Verifiable sovereignty

Trust is proven, not decreed

Your security logs are among your most sensitive data. Detkrypt keeps them in a European space, under European law, without offshoring them.

We display no certification we have not obtained. Any security qualifications will be announced once they are earned — never before. See the SANTVIA proof sheet →
Who it's for

Three profiles, one same standard

SOC team / CISO

See everything, react fast

Gather the logs of the information system, correlate the signals and work on prioritised alerts rather than an unreadable stream. The SOC gains visibility and time.

Regulated organisation (NIS2)

Detect and prove

Meet detection and traceability requirements with maintained audit trails, in a sovereign frame — without handing your logs to a non-EU platform.

Public sector / local authority

Security, sovereignly

Monitor your information system with a European SIEM, hosted and operated in the EU, aligned with the public sector's sovereignty expectations.

Detkrypt is coming. Let's talk.

The SIEM is under construction. Write to us for early access, a chat about your needs, or to be told when it opens. No commitment.

Product under construction — no general availability yet. SANTVIA — RCS Aix-en-Provence 130 594 823.

FAQ

Frequently asked questions

What is a SIEM?

A SIEM (Security Information and Event Management) collects the logs and events from across the information system, normalises and correlates them to spot suspicious patterns, raises alerts and keeps an audit trail. Detkrypt, by SANTVIA, is a sovereign SIEM, hosted and operated in the European Union. Under construction; early access on request.

What does Detkrypt collect?

The logs and events from varied sources: workstations, servers, network, cloud and applications. It also ingests the Endkrypt (EDR) detections and the logs of the sovereign DNS Dnskrypt. Everything is normalised into a common format to be correlated and searched.

How does it detect an attack?

By linking weak signals from several sources through correlation rules and anomaly detection. A sequence that looks harmless source by source becomes an attack pattern once cross-referenced: Detkrypt then raises a prioritised alert with its context, rather than an avalanche of lines.

Do my logs stay in Europe?

Yes. Detkrypt is hosted and operated in France and the European Union, under European law. The logs and their processing never leave the circle of trust — unlike non-European SIEMs that offshore the data.

Does it integrate with an EDR?

Yes. Detkrypt natively ingests the detections of Endkrypt, the SANTVIA galaxy's EDR, as well as the Dnskrypt logs and many other sources. The EDR sees the endpoint, the SIEM cross-references the whole information system: the two complement each other.

Is it available today?

Not yet: Detkrypt is under construction. Request early access at contact@santvia.eu; general opening will be announced on this page.

SANTVIA, the sovereign galaxy

Detkrypt is one brick of SANTVIA: sovereign communication, protection and digital compliance, hosted in France and Europe. One account, a sovereign copilot, proof rather than promises.

↑ Back to the mother company santvia.eu

Measured on this page, at every update

How it is measured

These figures are recalculated automatically each time the site is updated, from the code of this page: number of published language versions, resources loaded from another domain (fonts, scripts, styles, images), known audience measurement tools.