Machine translation, not reviewed by a native speaker. In case of doubt, the French text prevails.

Under construction · early access SANTVIA · Endpoint protection

Detect and stop attacks
on your endpoints, on your own terms.

Endkrypt is a sovereign EDR: it detects suspicious behaviour, investigates and responds to threats on your workstations and servers, with ITDR for identity attacks. A European alternative to non-EU EDRs.

Self-hostable on your own servers Behavioural detection Response & containment ITDR for identities EU sovereign
endkrypt — EDR console
Detection on the endpoint
  • Suspicious process isolated before it spreads.
  • Compromised account flagged (ITDR).
  • Endpoint contained automatically, analyst alerted.
Response — containment activeThreat contained, detection forwarded to the SIEM.
In brief

A sovereign EDR that protects your endpoints and your identities.

Endkrypt is the endpoint protection product (EDR) of the SANTVIA galaxy: it detects malicious behaviour on workstations and servers, investigates incidents and responds by isolating, containing and remediating. Its ITDR component spots attacks on accounts and identities. Operated and hosted in the European Union, it composes with the Detkrypt SIEM. The product is under construction; write to us for early access.

The problem

Classic antivirus no longer sees modern attacks

Today's attacks no longer need a file: they hijack legitimate tools, steal credentials and move laterally. Signature-based antivirus doesn't see them, high-performing EDRs are non-European, and few SMEs or public bodies have a 24/7 SOC.

Antivirus is no longer enough

Fileless attacks, credential theft, lateral movement: modern threats slip past signatures and stay invisible to a classic antivirus.

High-end EDRs are outside the EU

Market leaders send your endpoint telemetry outside the European Union, under foreign jurisdictions. Your visibility depends on a non-sovereign third party.

No 24/7 SOC

Detecting is one thing, responding in the middle of the night is another. Most SMEs and public bodies have neither a dedicated security team nor continuous monitoring.

The solution

Detect, investigate, respond — on every endpoint

Endkrypt watches the behaviour of workstations and servers, surfaces weak signals, and gives you the means to act: isolate, contain, remediate. All operated in Europe.

Detection

Behavioural, beyond signatures

Endkrypt analyses what processes do, not just their fingerprint. It spots suspicious behaviour — abnormal execution, persistence, lateral movement — that an antivirus misses.

Response

Contain and roll back

Faced with a threat: isolate the endpoint from the network, kill a process, quarantine, undo changes. You take back control in a few gestures.

Identities (ITDR)

Detect attacks on accounts

ITDR watches identities and accounts: privilege escalation, abnormal logins, compromised accounts. Where the attacker tries to blend in, Endkrypt spots them.

Sovereignty

Telemetry and operation in the EU

Your endpoint telemetry stays in the European Union, under European law. A sovereign alternative to non-EU EDRs, with no extra-EU dependency.

Key features

Everything a modern EDR should do — as standard

The level of the best EDRs, with European sovereignty and identity ITDR on top.

Behavioural detection

Analysis of behaviour, not just signatures.

Response & containment

Isolate an endpoint, kill a process, roll back.

ITDR — identities

Detection of attacks on accounts and privileges.

Threat hunting

Threat hunting across endpoint telemetry.

Inventory & hardening

Mapping of endpoints and surface reduction.

Network isolation

Cut a compromised endpoint off the network in one gesture.

Logging & audit

Detailed audit trails, exportable, retained.

SIEM integration

Feeds Detkrypt and your SIEM with detections.

Endkrypt composes with the galaxy without hard dependencies: detections feed the Detkrypt SIEM for correlation and compliance, and identity relies on Idenva. Each brick stays usable on its own.
The response

When a threat is found, you keep control

Detecting isn't enough: Endkrypt gives you the means to act fast, on the affected endpoint, without waiting. Every action is framed and traced.

Verifiable sovereignty

Trust is proven, not decreed

Endkrypt doesn't ask you to take its word for it. Its hosting, its operation and its processing chain are European, and sovereignty is a fact, not an argument.

We display no certification we have not obtained. Security qualifications (HDS, SecNumCloud) are in progress and will be announced once they are earned — never before. See the SANTVIA proof sheet →
Who it's for

Three profiles, one same standard

SME with no SOC

Advanced protection without a dedicated team

Get enterprise-grade EDR without building a SOC: detection, plain-language alerts and guided response, ready from deployment.

Regulated organisation / health

Visibility and compliance under control

Protect sensitive endpoints with audit trails, traced response and telemetry that stays in Europe — in service of your obligations.

Public body / public sector

Sovereignty at the endpoint level

Keep detection and response within a sovereign frame, without handing endpoint security to a non-European player.

Endkrypt is coming. Let's talk about your endpoints.

The product is under construction. Write to us for early access, a walkthrough, or to be told when it opens. No commitment.

Product under construction — no general availability yet. SANTVIA — RCS Aix-en-Provence 130 594 823.

FAQ

Frequently asked questions

What is an EDR?

An EDR (Endpoint Detection & Response) continuously watches workstations and servers to detect malicious behaviour, investigate incidents and respond to them — isolate, contain, remediate. Endkrypt is the sovereign EDR of the SANTVIA galaxy. Under construction; contact us.

How is it different from an antivirus?

Antivirus blocks known files via signatures. EDR analyses behaviour: it detects fileless attacks, credential theft and lateral movement that an antivirus misses, and lets you investigate and respond, not just block.

What is ITDR?

ITDR (Identity Threat Detection & Response) detects threats on identities and accounts: privilege escalation, abnormal logins, compromised accounts. It complements EDR where the attacker tries to pass for a legitimate user.

Does my data stay in Europe?

Yes. Endkrypt is operated and hosted in the European Union: your endpoint telemetry is processed under European law and is not sent outside the EU. It is a sovereign alternative to non-EU EDRs.

Does it integrate with a SIEM?

Yes. Endkrypt protects endpoints and forwards its detections to a SIEM for correlation and compliance — notably Detkrypt, the sovereign SIEM of the SANTVIA galaxy. Each brick stays usable on its own.

Is it available today?

Not yet: Endkrypt is under construction. Write to us at contact@santvia.eu for early access; general opening will be announced on this page.

SANTVIA, the sovereign galaxy

Endkrypt is one brick of SANTVIA: sovereign communication, protection and digital compliance, hosted in France and Europe. One account, a sovereign copilot, proof rather than promises.

↑ Back to the mother company santvia.eu

Measured on this page, at every update

How it is measured

These figures are recalculated automatically each time the site is updated, from the code of this page: number of published language versions, resources loaded from another domain (fonts, scripts, styles, images), known audience measurement tools.