Trust Center
Trust backed by evidence.
Explore our hosting, sub-processors, data protection agreements, and security controls. Clear, verifiable information, kept up to date.
- GDPRDPA on request
- EU AI ActReadiness mapped
- ISO 27001Planned
- SOC 2 Type IIPlanned
- EU-hosted
- Scaleway Paris region. Data plane, telemetry, email and inference.
- Read-only connectors
- Nothing is written back to the systems we read.
- DPA available
- Article 28 template, on request.
- Last updated
- 5 Oct 2026. Sub-processor changes are notified before they happen.
Data handling
How we handle your data.
Hosting and data residency
The data plane, telemetry, transactional email and AI inference all run on Scaleway in Paris. No third-country transfer mechanism is involved in delivering the service.
- Data residency
- Customer data is stored and processed exclusively within the EU, on Scaleway fr-par (Paris).
- EU hosting
- Managed Scaleway services only: serverless containers, managed PostgreSQL, static hosting. Infrastructure is code, deployed through CI.
- Sub-processor changes
- One sub-processor covers the whole chain. Customers are notified before one is added or replaced, per the DPA.
- Jurisdiction
- Qastel AI SAS is a French company, operating as a processor under Art. 28 GDPR.
Access and encryption
Connectors request read-only scopes, listed in the security overview. Inline policy enforcement is a per-tenant flag that is off by default.
- Access model
- Connectors use read-only scopes (for example Application.Read.All, Directory.Read.All, AuditLog.Read.All on Entra ID). No write permission to customer tenants is requested for discovery.
- Encryption
- TLS on all public ingress and to the database. Provider-managed encryption at rest; connector credentials additionally encrypted with AES-256-GCM. Managed key rotation is on the roadmap.
- Tenant isolation
- Every request runs in a database transaction scoped to the tenant, with row-level security on core tables.
- Sign-in
- Email/password or Microsoft Entra work-account sign-in, rate-limited. Per-tenant enterprise SSO (SAML) and MFA are planned.
Operations
Security is owned by the CTO and operated by the founding engineering team. Every state-changing action is recorded with the acting identity and a trace ID.
- Retention and deletion
- Raw observations 90 days by default, adjustable per tenant; audit log 24 months. Tenant data is deleted on termination per the DPA; backups expire on a 7-day rolling window.
- Audit log
- Typed, append-only, enforced at the database level. Tenant administrators can view, filter and export it.
- Vulnerability reporting
- Write to security@qastel.ai. Application security is addressed through PR review, CI gates and pre-commit secret scanning.
- Change notices
- Sub-processor changes are notified per the DPA, and this page is updated in the same change.
Security controls
The security controls in place today.
Infrastructure security
- All-EU processing chain
- Managed services only, infrastructure as code
- Secrets in Scaleway Secret Manager
- TLS on all public ingress
Organisational security
- PR review and CI security gates
- Pre-commit secret scanning
- Security owned by the CTO
- Single sub-processor surface
Product security
- Read-only connector scopes
- Append-only audit log
- Tenant isolation with row-level security
- Rate-limited authentication endpoints
Documents
Security and compliance documents.
Sent on request.
Data processing agreement
GDPR Art. 28 template
Sub-processor list
One vendor, role and region · on this page
Security overview
Architecture, controls and questionnaire answers
Certification roadmap
Current controls, what is planned · on this page
Sub-processor list
| Subprocessor | Purpose | Location | Safeguard |
|---|---|---|---|
| Scaleway | Cloud hosting (application, database, telemetry), transactional and scheduled-digest email delivery, and AI inference on open-weight models hosted by Scaleway (such as Mistral and Qwen) for the agent runtime (posture assessment, triage, catalog signatures), prompt classification, the in-app assistant (Chat), Guardian reviews and the policy-authoring assistant | EU (France, `fr-par`) | EU processing; Scaleway DPA |
Certification roadmap
In place today
- All-EU processing chaindata plane, telemetry, and AI inference inside the EULive
- Single-subprocessor surfaceScaleway only (hosting, email, and Mistral-model inference, all EU)Live
- Typed audit logactor identity + trace-linked, append-only by designLive
- Tenant isolation with RLSper-request tenant context + row-level security on core data tablesLive
- CI security gatesPR review, lint, typecheck, tests, secret scanningLive
Certification stages
- External penetration testPlanned
- SOC 2 Type IPlanned
- SOC 2 Type IIPlanned
- ISO 27001Planned
- ISO 42001 (AI management systems)Planned
FAQ
Frequently asked questions
If yours is not here, write to security@qastel.ai.
Where is customer data stored?
Exclusively in the EU: Scaleway fr-par (Paris) for the data plane, hosting, telemetry, transactional email and AI inference. No third-country transfer mechanism is involved.
Do connectors write anything to our systems?
No. Connectors observe and report back; they do not create, modify or delete data in the systems they connect to. The only writes are to Qastel's own database.
Can Qastel see prompts and outputs?
Only for tenants that opt into prompt insights, and then the prompt text is processed in memory for one classification call and never stored. What remains is topic counts and sensitivity categories, never the text.
How do we get the DPA?
Write to security@qastel.ai. The Article 28 template is sent on request.
Do you hold SOC 2 or ISO 27001 certification?
Not yet. Both are planned stages on the certification roadmap on this page, alongside an external penetration test. The compensating controls we run today are listed above.
Need the DPA or the sub-processor list?
We send the documents on request and notify you when they change.