Skip to main content

Trust centre

Security software must first be secure itself

This page describes our security practices and their real status, with no embellishment. It is updated with every notable change.

Our practices

  • Hosting

    Planned

    Professional customers' data is intended to be held by a host whose head office and data centres are in the EU (final choice in progress). The showcase website is hosted by Vercel and contains only public content.

  • Encryption

    In development

    TLS 1.3 for communications, mutual authentication of agents by certificate, encryption at rest with keys specific to each customer.

  • Customer isolation

    Pilot programme

    Every database query is filtered by customer and protected by row-level security rules, with tests proving the isolation.

  • Signed commands and updates

    Pilot programme

    Every command sent to an agent is signed (Ed25519) and protected against replay; every update is signed and deployed in rings.

  • No kernel code

    Pilot programme

    Analysis runs in user mode, with memory and time limits. No kernel driver before validation and a very gradual rollout.

  • Software supply chain

    In development

    Component inventory, checks for licences and known vulnerabilities, secret scanning before every commit; full automation at every release is being put in place.

  • Internal access

    Pilot programme

    Strong authentication, audit log of every sensitive action, principle of least privilege.

  • Audits and certifications

    Planned

    No certification has been obtained to date. An external penetration test is planned before the antivirus modules are sold, followed by an independent certification.

Your data

  • We collect only what each enabled module requires, as documented in the privacy policy.
  • No customer data is used to train an AI model.
  • No advertising, no data resale.
  • Retention periods applied automatically by the code.

Documents

security.txt file

Found a vulnerability?

Report it to us: we acknowledge receipt within 5 business days, and we will not take legal action against research carried out in good faith within this framework.

Read the disclosure policy