Timestamped at source
Each entry carries its date, its time and the identity of its author at the moment the action is taken: no reconstruction from memory, no date “rounded off” several days after the incident.
Evidence & architecture · the foundation and the trace
How Galyct Pro records decisions and evidence.
Each register entry keeps its author, its timestamp, its context and the items it is linked to. The register is designed to reconstruct a timeline and export a file that management, an auditor or an authorised third party can use.
Understand the risk. Take back control. Stay the course.
Append-only log · timestamped · hosted in France by Scaleway · Mistral AI (EU) · your data remains exportable.
PRINCIPLE
Trust
is proven.
“Sovereign” has become a marketing argument. We prefer verifiable facts: the hosting country, the name of each subcontractor, our AI provider, the exact nature of the encryption, and an explicit list of what we do not do. An organisation does not entrust its cybersecurity to a promise: it entrusts it to an architecture it can read, audit and submit to its own DPO.
Part IEvidence: what remains after the decision
01 · THE EVIDENCE REGISTER
A timestamped register that fills itself
You do not have to “remember to document”. Every action taken in the console (a crisis decision, a treatment measure, a compliance gap closed, an IOC analysis) feeds the register as it happens, with its timestamp and its author. Evidence is not a report written after the fact: it is the trace of what actually happened.
Linked to its context
A piece of evidence never stands alone: it is linked to the risk, the incident, the playbook or the regulatory requirement that produced it. You can trace back from the fact to the decision, and from the decision to the fact.
Logs, screenshots, documents
Decisions, hypotheses, event logs, screenshots, exchanges and attachments: the file builds up continuously, ready to be reviewed by a third party who was not in the room.
Kept for as long as needed
Retention by category and purpose, proportionate: incident files are archived for evidential purposes for up to 5 years (the general limitation period for civil actions is five years under Article 2224 of the French Civil Code); accounts, 24 months after the last activity. Never indefinite.
02 · TIMESTAMPED, TRACEABLE DECISION LOG
Append-only: you add, you do not rewrite history
A log is only worth something if it cannot be doctored after the fact. The Galyct Pro decision log works on an append-only basis: entries are added, the past is never silently deleted or modified. Correcting a decision means writing a new entry that explains the correction; the original entry remains visible. How the log is sealed and verifiable →
The principle
A lifeline, not a draft
Each decision records: what was decided, by whom, when, on the basis of what information was available at the time, and why. A later revision is stacked on top without erasing what came before. The thread reads in order, from the first signal to closure.
This is exactly what an insurer handling a claim, a regulator checking that a deadline was met or a judge reconstructing a timeline expects: a timeline that no one could alter after the event.
What each entry records
- What: the decision or action taken
- Who: the identified author, their role in the cell
- When: the timestamp, to the second
- On what basis: the information known at that moment
- Why: the justification, the trade-off chosen
- Status: established fact, hypothesis or weak signal
03 · OBSERVED VS ASSUMED
Distinguishing what is established from what is assumed
The most costly mistake, in a crisis as in an audit, is to present a hypothesis as a fact. Galyct Pro explicitly qualifies every item in the file: on rereading it, you know what had been demonstrated and what was still an assumption when the decision was made.
Observed
An established fact, backed by a verifiable trace: an event log, a screenshot, a document, a technical confirmation. Something that can be shown to a third party.
Assumed
A working hypothesis, useful for moving forward but not demonstrated. It is labelled as such: decisions are made on that basis knowingly, without disguising it as a certainty.
Weak signal
A clue worth noting without drawing a conclusion. Recorded so that it is not lost, it may be confirmed (or refuted) as the file progresses.
The direct consequence: no attribution without evidence. No culprit and no root cause is asserted until the technical or contextual evidence supports it. What cannot be demonstrated is still presented as a hypothesis or a limit.
04 · USABLE EXPORTS
The same file, readable by each of the people you deal with
An evidence register is only useful if it leaves the tool. Galyct Pro produces structured exports from the same facts, adapted to who reads them. One truth, several levels of reading: management, the bank, the insurer, the lawyer, the auditor and the regulator do not receive contradictory versions.
Bank
Incident timeline and measures taken: enough to support a fraud report, a request to block a payment or a recovery file, with the dates that matter.
Cyber insurer
A well-documented claim file: timestamps, decisions, logs and evidence of remediation, the supporting documents insurers often ask for, depending on your policy.
Lawyer & legal
An unaltered timeline, distinguishing facts and hypotheses: the basis for filing a complaint, a notification or a defence, with no grey area about what is proven.
Auditor
Evidence linked to requirements (ISO 27001, NIS 2, DORA): the documentation points to real practices and traces, not to statements of intent.
Regulator · CNIL, NIS 2 authority
Notification of a data breach on time (72 hours under the GDPR), with a record of the decisions taken: the regulatory clock and the log speak the same language.
Management & committee
A concise report, focused on decisions and budget: what happened, what was decided, what remains to be done, all backed by the detailed file.
Open formats that can be read outside the platform. See the frameworks covered →
05 · END-TO-END TRACEABILITY
From the first signal to the evidence, a single chain
Evidence is not manufactured at the end: it is laid down at each link. Because risk, analysis, incidents and compliance live in the same place, nothing is entered twice and nothing gets lost between two tools. Any item in the file can be traced back to its origin.
01SignalA connector alert (gathered in the “Signals” view), an IOC analysis, a risk scenario: the event comes in dated.
02QualificationObserved, assumed or weak signal: the item is labelled before it is used.
03DecisionThe trade-off is recorded with its author, its time and its justification.
04ActionPlaybook, owner, deadline, remediation: every action leaves its trace.
05EvidenceFacts, decisions and documents are linked in the append-only register.
06ExportThe file goes out, adapted for the bank, the insurer, the lawyer, the auditor or the regulator.
06 · REVERSIBILITY
Your evidence belongs to you, and you can leave with it
An evidence register locked inside a tool you do not control is not evidence: it is a dependency. With Galyct Pro, your data remains yours, hosted in France by Scaleway, and you export it whenever you want, including to leave the platform.
Hosted in France, by Scaleway
Your evidence and your logs are hosted in France, with Scaleway. The AI assistant relies on Mistral (EU), under human oversight: no processing outside the EU behind your back.
Exportable at any time
The register, the decision log and the documents can be exported in open formats: you need neither our agreement nor our tool to reread your own file.
Reversibility by design
Leaving must remain possible. You get back the complete history of your decisions and your evidence: traceability does not disappear because you change solutions.
We never ask for your access codes to your banks, email or third-party services. Evidence is built from what you observe and decide, not from access to your accounts.
Part IIThe architecture: where your data lives, and who processes it
07 · THE FOUNDATION: WHERE YOUR DATA LIVES
Your account and incident data, hosted and processed in France, with Scaleway
Hosting, backups, logs and evidence items stay in France (EU), with Scaleway. The optional external checks (DNS resolution, URL reputation, leak lookup) are triggered in a controlled, documented way: for each one, you know which data is transmitted and to which service. Facts, described, not a marketing absolute.
French hosting
Servers operated in France by Scaleway, a hosting provider without SecNumCloud qualification. The data on your incidents, your risks and your evidence does not leave the EU in the normal course of the service.
Encryption at rest & in transit
Sensitive data is encrypted at rest; exchanges go over TLS (HTTPS), with hardened security headers (HSTS, CSP). Encryption protects the data; it is never an excuse for recording nothing.
Multi-entity partitioning
Each organisation (and each entity in a group) has a partitioned space. One subsidiary does not see another’s data; sharing, where it exists, is an explicit, logged choice.
Backups & reversibility
Regular backups and exportability of your data: your evidence, your registers and your logs belong to you. You leave with what you have produced, with no hostile retention.
Minimal, logged access
Roles (administrator, editor, member), least privilege and traceability of access. Sensitive actions are timestamped: who saw what, who decided what, and when.
Encrypted DNS resolution (DoH)
The Galyct Domain component queries DNS in encrypted form (DNS-over-HTTPS) through non-filtering public resolvers in the European Union, Mullvad (Sweden), Freifunk München (Germany) and LibreDNS (Greece), with FDN in France as a fallback: only the domain name being checked is transmitted, no personal data. Controlled observation, described as it is.
Your tools remain yours. The connectors (EDR, firewalls, backup, intelligence) work read-only: “the customer brings their own instance”. Galyct reads your events and never controls your tools: no Galyct agent is required for these connectors. An optional endpoint sensor (“Endpoint agent”) is also available, if you want to enrich the telemetry. See the connectors →
08 · AI UNDER HUMAN OVERSIGHT
A European AI that assists, never one that decides alone
The Galyct Pro assistant relies by default on Mistral, a French provider whose models are operated in the European Union. AI prepares, proposes and speeds things up; the decision remains human, and every output can be verified.
European model by default
AI processing takes place at Mistral (France/EU). The choice of provider is governed on the server side: you know which engine processes your requests, and nothing is sent to a model outside the EU without your knowledge.
People approve, AI does not act alone
AI drafts a playbook, proposes a qualification, summarises an incident: a person approves. No irreversible action is triggered by the assistant without a decision by the operator.
File analysis (EU)
Automated analysis of files and indicators relies on an analysis engine that does not leave the EU, alongside recognised open sources. Advanced analysis capabilities are being added in waves: some are coming soon, and we say so rather than let anyone believe otherwise.
Consent & log
Use of AI is governed by consent and a log: a risk screen spells out what is sent to the model. You stay in control of what is submitted, and of what is not.
Galyct Pro’s AI is not meant to replace an analyst: it saves them time on repetitive work, so they can focus on the decision. See the analysis area →
09 · THE REGULATORY FRAMEWORK
Designed for your compliance, without faking it
Galyct Pro provides tools for the frameworks your stakeholders require. The platform helps you document and meet your obligations: it issues you no state label, and it replaces neither your DPO nor your auditor.
GDPR · 72-hour notification
Record of processing activities, impact assessments, procedure for notifying a breach on time. You are the data controller; we are the processor, with a dedicated contractual framework (DPA).
NIS 2
European directive: obligations, governance, control of third-party risk and compliance trajectory. The platform structures the evidence; the assessment remains a matter for you and your authorities.
DORA
Operational resilience for the financial sector: ICT third-party risk management, testing, major incidents and reporting. Each requirement is linked to decisions and exportable evidence.
10 · OUR SUBCONTRACTORS, NAMED
We tell you who processes what. By name.
Trust is verified along the subcontracting chain. Here are the key providers involved in the service, their role and where they operate. The full list is kept up to date (last review: 15 August 2026) and made available within the contractual framework (DPA).
| Subcontractor | Role | Location |
|---|---|---|
| Scaleway / Online Hosting provider |
Hosting of the service’s infrastructure, databases, backups and logs. | France |
| Mistral Artificial intelligence |
Provider of the AI model that assists with analysis and drafting, under human oversight. | France / EU 🇪🇺 |
| Stancer Payment |
French payment provider for subscriptions and passes. We do not store your card details: they go through the provider. | France |
Publisher of the service: Datashield Risk Consulting (SAS), which publishes the Galyct ecosystem. Any change to this list is communicated to you within the contractual framework. Legal notice →
11 · WHAT WE NEVER ASK YOU FOR
We never ask for your codes
A trustworthy platform can also be recognised by what it refuses to ask you for. These rules are not sales promises: they are prohibitions our teams apply to themselves.
Never
We will not ask you…
- for your passwords, access codes or credentials for your third-party accounts;
- for codes received by text message, email or authentication app;
- to disable your two-factor authentication or your protections;
- for remote access to your workstations outside a scoped engagement contracted with the firm.
If a message claims to come from Galyct and asks you for any of these things, it is an attempted fraud. If in doubt: report an incident →
Always
What we owe you
- to tell you where your data lives and who processes it;
- to record sensitive access and report it to you;
- to let you export and recover what you have produced;
- to distinguish an established fact from a hypothesis, in every report.
12 · WHAT WE DO NOT PROMISE
Trust is also built on what you refuse to promise
A register documents what happened; an architecture reduces exposure. Neither rewrites history, guarantees an outcome or replaces the judgement of your advisers. Saying so is precisely what gives them their value.
A trace, not a guaranteed result
Documenting a decision does not guarantee that it was the right one, or that an incident will be avoided: no result is guaranteed. The register proves what was done and when, not that it will be enough.
Solid evidence, not a verdict
A timestamped, consistent log is solid evidence: its exact weight before an insurer, a regulator or a court is for them to assess, with your legal advisers, not a promise on our part.
No zero risk, no “unbreakable”
We use neither “unbreakable”, nor “100% secure”, nor “guaranteed”. The aim is to reduce exposure and keep the evidence; a limited check never proves the total absence of risk.
Compliance linked to real practices
The platform documents; it issues no label. Documentation must match real responsibilities and practices: we document what is done, not the other way round.
Listed, not certified by the state
Galyct is a provider listed on Cybermalveillance.gouv.fr, a sign of seriousness, not a state certification, and we never present it as one. It does not prejudge how a given incident will be qualified.
The software, and people when needed
Galyct Pro steers day to day. For audit, EBIOS RM, forensics, crisis management or an outsourced CISO/DPO, the firm steps in on quotation: the human layer cannot be replaced by a ticked box.
A cyber crisis in progress?
Suspected intrusion, ransomware, compromised account, data leak: stabilise without destroying the evidence. We open a crisis cell, keep the decision log and build the file as things happen.
Evidence and architecture, in your context.
Tour the cockpit freely with sample data, or request a 30-minute demo: ask your questions about traceability, hosting and subcontracting. No commitment, processing in the European Union, your data remains yours.