Security & privacy
Your data stays under your control.
Qastel analyses the flows it needs to make a decision, without becoming a new store of your sensitive data.
Qastel processes only what it needs.
Qastel identifies who uses which AI, in what context and at what level of risk, without keeping the content of prompts at rest.
Sovereign hosting
Production runs on Scaleway in Paris (fr-par): a single European sub-processor, a French provider.
No prompts kept at rest
Prompts are analysed in transit, then discarded: only the metadata and the decision are kept.
Encrypted in transit and at rest
TLS on every connection, encryption at rest, and connector secrets encrypted with AES-256-GCM.
Least privilege
Connectors are read-only, each with the narrowest permissions it needs.
Minimisation & redaction
Redaction happens before the request leaves the device. If Qastel cannot answer in time, traffic goes through by default, or can be set to be blocked.
Traceability & audit
An append-only audit log, exportable as CSV. A DPA is available, and penetration testing and certifications are on our roadmap.
Need the details for your security review?
The Trust Center has the data handling, sub-processors and certification roadmap.