I had thought about having the whitelist in memory in the past, but if it's in redis it can be updated for multiple tracker processes at once. The other option would require having some kind invalidation logic.