Trust Centre

Trust is documented. It cannot be reduced to a badge.

The Trust Centre brings together what can be published without exposing sensitive mechanisms: location, security, continuity, subprocessors, incidents, maintenance, reversibility and policies.

See service status See the subprocessors

99.9%target platform availability

1 hmaximum data loss in the event of a disaster (RPO)

4 hmaximum to restore service (RTO)

30 daysminimum backup immutability

Hosting and data

hosting in France by Scaleway; processing in France or the European Union;
critical technical subprocessors based in France or the EU;
preference for providers that are European in law, to limit extraterritorial exposure;
the artificial intelligence engine processes data in France or the European Union.

Hosting provider: Scaleway, in France. The hosting is not SecNumCloud-qualified.

Identity and access

MFA mandatory for all MSP and client accounts, with no exceptions;
passkeys (WebAuthn);
OIDC SSO for client organisations on the Performance or Sur mesure plan (Microsoft Entra ID, Google Workspace or any OpenID Connect provider), with the Galyct second factor always required;
stricter policies at the partner’s choice: IP addresses, session length, trusted devices, re-authentication for sensitive actions.

Continuity

Backups that we restore, and prove.

encrypted backups replicated to a geographically separate site, in France or the EU;
immutability for at least 30 days;
quarterly restore tests, with timestamped evidence and an alert if they fail;
summary of the tests published here, with no sensitive technical detail.

Latest restore test

Published at each quarterly test.

Date and result of the latest test, updated by the platform.

Status and incidents

What happens on the platform, reported in good time.

Service status

Real-time or near real-time availability, ongoing incidents, scheduled maintenance and recent history. Scheduled maintenance is announced at least 7 days in advance, except for urgent security fixes.

See status

Security incidents

Notification as soon as a potential impact on data or the service is identified. A post-incident report is mandatory for any major or critical incident: cause, timeline, impact, measures, prevention. A non-sensitive summary is published.

Severity	Communication frequency
Critical	every 30 minutes
Major	every 2 hours
Significant	at least once a day, until closure

Subprocessors

The list is public, and it does not change without notice.

Galyct publishes the list of its critical subprocessors, with their role and location.

30 days’ notice before any change of critical subprocessor, except in a security emergency;
partners and clients may raise a reasoned objection during this period;
if the objection is well founded, Galyct looks for an alternative solution;
failing a reasonable solution, the service ends without penalty, with a full data export.

View the subprocessor register

Independent audits

Regular independent security audits, at most every 24 to 36 months, and sooner after a major change, a significant incident or a critical architecture change. A non-sensitive summary is published.

Mandates

Your provider’s access is scoped, dated and revocable.

Mandatory mandate

a single Galyct template, with mandatory clauses that cannot be changed;
appendices uploaded, versioned and open to review by Galyct;
expiry date, reminders, renewal only on the client’s explicit approval.

Immediate revocation

from the client’s portal, with re-authentication and MFA;
the provider’s actions are blocked immediately;
automatic closure report, sent to the client and to Galyct.

Change of provider

new mandate and explicit confirmation from the client;
scheduled switchover, at least 48 hours’ technical notice, with no overlap;
cancellation possible up to 24 hours before; notifications 2 days before, 1 day before and at switchover;
transfer report to the client, the new provider and Galyct, never to the former provider.

Reversibility

Leaving should be as simple as arriving.

exit package at any time: readable PDFs, reusable CSV and JSON, original files;
scope: mandates, reports, history, evidence, documents, actions, incidents, assessments, relevant configuration;
API export for the client and for the mandated provider, with every call logged;
sensitive or large exports: re-authentication and MFA;
30 days to retrieve data after the service ends, then deletion and a downloadable deletion certificate.

Category	Target retention period
Detailed technical logs	12 months
Evidential history of the provider’s actions	term of the mandate + 5 years
Ongoing dispute or proceedings	until closure, for the necessary data only

Third-party verification

The tool that checks our sealed exports can be downloaded.

The console seals its logs and can export them as a signed document. The program that checks this document does not stay with us: you take it, you read it, and you run it on your own machine. Recalculating a chain while trusting us would prove nothing.

it recalculates the exact layout of the document, its SHA-256, each seal and the chaining from the genesis entry;
it compares the manifest with what it recalculates: number of entries, chain head, genesis, fields, lines outside the chain;
it verifies the Ed25519 signature against a list of published keys, never against the key carried by the document itself;
it runs from the command line with PHP 8, and opens no network connection.

Both files are served as plain text, as attachments, and are never executed by our server. The /tools/ directory remains closed, as before.

Download, then verify

Two files, laid out like this: the tool under tools/, the seal library under api/. The tool loads the library at startup and will not run without it.

The tool The seal library

SHA-256 fingerprint of the tool: computed on demand
SHA-256 fingerprint of the library: computed on demand

The fingerprints as plain text in sha256sum -c format. They are computed on demand from the actual files: a value copied into this page would have diverged at the tool’s first change.

Documents

Versioned documents, explicitly accepted.

Every key document is versioned. A substantial change requires a new explicit acceptance, depending on the scope concerned.

The data processing agreement (DPA) is available on request before signature, then signed in the partner space.

Request the DPA

partner contract and programme charter;
brand and badge usage rules;
Academy and certification terms;
support policy, SLAs and calculation rules;
mandate between provider and client;
DPA and GDPR framework;
mediation, sanctions and appeal rules;
subprocessing, reversibility and deletion policy;
NARA policy: authorised and forbidden actions.

A security question before you commit?

Support and the programme team answer your security questionnaires during the sandbox.

See status See support Read the FAQ