At rest, in the EU
Databases, backups, logs and evidence items are hosted and processed in France, with Scaleway. Your incident data does not leave the EU in the normal course of the service.
Trust centre · evidence, component by component
Galyct Pro trust centre
A trust centre should not be a page of adjectives. Here is one that sets, against each security promise, the real mechanism that upholds it, and states clearly what is already active, what is a contractual commitment and what we provide on request. You can read it, show it to your DPO, submit it to your CISO.
Each section below points to an element that is verifiable, dated and usable in an evidence file.
Hosted in France with Scaleway · encryption at rest · timestamped log · multi-entity partitioning.
PRINCIPLE
We show
the mechanism.
Most “trust centers” line up logos and words. Ours puts a “technical evidence” column against each commitment, and a “status” column that honestly distinguishes what is running today from what is a commitment or what we provide on request. Nothing is presented as achieved until it is true: that is the rule we set ourselves.
01 · TECHNICAL SECURITY, PROVEN
The evidence matrix
Each row: a commitment, what it concretely protects, the real technical mechanism that upholds it, and its status. Components marked Active are active in the service today.
| Component | What it provides | Technical evidence | Status |
|---|---|---|---|
| Evidence integrity | An uploaded item cannot be altered without it showing. | SHA-256 fingerprint calculated on upload and stored with the item. | Active |
| Encryption at rest | Your sensitive data remains unreadable even if someone gains access to the storage. | AES-256-GCM (random IV + authentication tag); writing is refused if the key is missing rather than storing in plain text (fail-closed); key rotation tooling in place. | Active |
| Timestamped log | Who saw what, who decided what, and when, with no possibility of rewriting. | Server-side append-only log (insertion only; actor and timestamp set by the server, not by the browser). | Active |
| Two-factor authentication | A stolen password is not enough to get in. | Mandatory second factor (enrolment wall at login) on Pro, Perso and the MSP console: TOTP (RFC 6238, secret encrypted at rest, backup codes) or a one-time code by email on the consumer space. | Active |
| Brute-force protection | No hammering of logins or of the second factor. | Sliding limit per IP and per email address, also applied to the MFA step. | Active |
| Privacy-respecting check | We test whether a password has been exposed without ever sending it. | k-anonymity: only the first 5 characters of the SHA-1 hash leave the browser; the comparison is done locally. | Active |
| Multi-entity partitioning | One entity never sees another’s data. | Scope derived on the server side (never from the request) and enforced on every partitioned table. | Active |
| Evidence outside the web root | Your files cannot be served by mistake. | Storage outside the web folder, opaque file names, 0700 permissions; complete GDPR purge of a scope. | Active |
| Outsourced payment | Card numbers and security codes are entered and processed directly by Stancer; they do not pass through DRC’s servers. | Payment page hosted by Stancer (France); the server re-reads the payment before unlocking anything. | Active |
| Reversibility | Nothing is lost by mistake; you leave with your data. | Encrypted 30-day recycle bin (self-service restoration) + exports of your registers and evidence. | Active |
| Recorded AI governance | You know what is sent to the model, and you consent to it. | Choice of engine governed on the server side (Mistral/EU by default) + an informed-consent log. | Active |
| Hardened transport | Exchanges are encrypted in transit (TLS). | HTTPS + HSTS, CSP, X-Content-Type-Options, X-Frame-Options; a rule blocking internal files. | Active |
These mechanisms are those of the real product, not of a brochure. For the architecture in detail: the technical foundation →
02 · SERVICE COMMITMENTS
What we commit to, and what remains to be published
Availability is a contractual commitment (SLA Appendix of the Terms of Use). We distinguish these objectives from measurements we do not yet publish, rather than display flattering figures we do not meet.
99,0 %
Availability, Essentiel plan Committed
99,5 %
Availability, Résilience plan Committed
99,9 %
Availability, Performance plan Committed
RPO ≤ 12 hours
Maximum data loss, encrypted backup every 12 hours In place
RTO ≤ 24 hours
Target time to restore service, rebuilding from the tested backup Target
Backup
Encrypted off-site backup (France), restoration tested In place
Status
Service status page: live availability Online
The availability objectives are set out in Appendix 1 (SLA) of the Pro Terms of Use; the liability framework is governed by the Pro Terms of Sale.
03 · HOSTING & DATA FLOWS
Where your data lives, and what leaves (or does not)
The normal framework of the service stays in France (EU). Some external checks are optional and controlled: for each one, you know exactly what is transmitted.
External checks, named
Encrypted DNS resolution (Mullvad SE, Freifunk München DE, LibreDNS GR, with FDN in France as fallback: only the domain is transmitted), URL reputation, leak lookup: every outgoing flow is documented and triggered in a controlled way.
AI operated in the European Union by default
The AI engine is Mistral (France/EU) by default. An explicit switch to an engine outside the EU remains a choice governed on the server side, recorded and consented to, never silent.
Named subcontractors
Scaleway/Online (hosting, FR), Mistral (AI, FR/EU), Stancer (payment, FR). The dated list is kept up to date and provided within the contractual framework. See the register →
04 · COMPLIANCE TRAJECTORY
What is real, and what is a trajectory
We refuse to let anyone believe in a label we do not have. Here is the exact situation.
Cybermalveillance.gouv.fr Real
Galyct is a provider listed on Cybermalveillance.gouv.fr, the French government’s cyber assistance platform. It is a sign of commitment, it is not a state certification, and we never present it as one.
SecNumCloud, as a compass Not certified
The SecNumCloud framework serves as our architecture compass. To date, no certification process (ISO 27001, SecNumCloud) has been started; we say so rather than let anyone believe otherwise. The day a process is launched, it will appear here, dated.
GDPR · NIS 2 · DORA Supported
The platform provides tools for these frameworks (record, 72-hour notification, third-party risk, Art. 28 DPA); it issues no label and replaces neither your DPO nor your auditor. The frameworks →
05 · DOCUMENTS & EVIDENCE
The documents to show your DPO, your insurer, your auditor
What is available right away, and what we provide on request as part of a structured exchange.
DPA, data processing agreement (Art. 28)Appendix 2 of the Pro Terms of Use.
Available
SLA, availability objectivesAppendix 1 of the Pro Terms of Use.
Available
Register of subcontractorsDated, kept up to date, provided in the contract.
Available
Evidence export (SHA-256) & CODEX fileYour items, timestamped and verifiable.
Available
Internal adversarial security reviewCode reviews & hardening, ongoing.
Ongoing
Penetration test summary (third party)Scope & results of an external pentest.
Coming soon
Liability insurance certificateProfessional / cyber liability.
On request
Need an “on request” document for your supplier file? Contact us →
06 · WHAT WE DO NOT PROMISE
A trust centre also states its limits
No serious tool promises to be unbreakable. We would rather state our limits than have you discover them on the day of an incident.
No zero risk
Neither “100%”, nor “guaranteed”, nor “unbreakable”. The aim is to reduce exposure and keep the evidence: no result is guaranteed.
Honest statuses
A component marked “to be published” or “on request” is not yet a public achievement: we do not count it as done. This page evolves as those boxes turn green.
Trust you can verify line by line.
Explore the cockpit freely with sample data, or request a 30-minute demo to walk through this matrix against your hosting, compliance and subcontracting requirements.