Technical audit · 2026-05-13

erasmus-plus.ec.europa.eu

Erasmus+ — the EU's Program for Education, Training, Youth and Sport

The Erasmus+ program — 133 requests, 6 domains. The Commission's own video player instead of YouTube. AWS eu-west-1 for media-service APIs — data stays within the EU. The Inter typeface via webtools.europa.eu. Zero trackers.

Timeline of the leak

+231 ms · load
webtools.europa.eu — the Inter font served from webtools, the Commission's theme, components.
+262 ms
audiovisual.ec.europa.eu — the Commission's own video player. An ec.europa.eu subdomain.
+1813 ms
AWS eu-west-1 (execute-api.eu-west-1.amazonaws.com) — the Commission's media-services API. Ireland.
+3256 ms
vod.prd.commavservices.eu — the Commission's video streaming. A .eu subdomain.

Context

Erasmus+ is the EU’s flagship program for education, student exchange, and youth cooperation. Managed by the European Commission. The site runs on ec.europa.eu infrastructure. HAR: 133 requests, 6 domains, 2 pages.

The Commission’s own video player

audiovisual.ec.europa.eu/corporateplayer is the European Commission’s own Angular-based player for the EU Audiovisual Service. A complete replacement for YouTube: the player, an API for video metadata and chapters, and video streaming. All components sit on europa.eu and ec.europa.eu subdomains. The same principle as PeerTube at ENISA — except this is a centralized solution for the entire Commission.

AWS eu-west-1 — a European region

yy2iyrkool.execute-api.eu-west-1.amazonaws.com and gfdwwnbuul.execute-api.eu-west-1.amazonaws.com — Amazon API Gateway in the eu-west-1 region (Ireland). This is the API for the Commission’s media services: video metadata, chapters, a list of formats. AWS eu-west-1 means the data is processed within the EU — physically in Ireland. Data does not leave the EEA.

vod.prd.commavservices.eu

vod.prd.commavservices.eu — the Commission’s video streaming, on a .eu subdomain. Delivers an HLS video stream. Data on European infrastructure.

Inter via webtools — the same as the Commission

The Inter typeface loads from webtools.europa.eu/fonts/inter/InterVariable.woff2 — the same solution used on commission.europa.eu. Erasmus+ uses the webtools.theme-ec.css theme — the European Commission’s theme, not the generic EU theme.

webtools.captcha

A new component not seen at other institutions in the series: webtools.captcha.js and webtools.captcha.css. This is webtools’ own CAPTCHA implementation — no Google reCAPTCHA. Analogous to bundesheer.at’s proprietary CAPTCHA, but implemented centrally for all of the Commission’s sites.

Conclusion

Erasmus+ demonstrates exemplary video-content architecture: the Commission’s own player instead of YouTube, an EU AWS region for the API, video streaming on a proprietary .eu domain. Fonts served via webtools, a proprietary CAPTCHA. Zero external trackers, zero cookies. One of the cleanest results in the EU institutions series.

Evidence
Original (audit)
HAR file: eu/erasmus-plus-ec-europa-eu-2026-05-13.har
SHA-256: 3423a836cedf29a53d56c85e2b33236cac5fc367394fc9684c24e4b131020663
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.