Sent from Europe
Our transactional emails are sent through an email service hosted in Europe. Your exchanges with Galyct do not pass through relays outside Europe.
Hosting · France & European Union
Galyct’s data location and dependencies.
Galyct is designed, developed and hosted in France, with Scaleway. This page sets out, service by service, where your data is processed, by which provider, in which country, and for how long.
We never ask for your passwords.
Hosting
France · Scaleway/Online hosting
Mistral
French AI · EU
Encrypted
In transit & at rest
30 days
Safety recycle bin
Transfer outside the EU
None in the standard configuration
DEPENDENCIES, IN PLAIN TERMS
Where your data is processed, service by service
Each Galyct component, with its provider, its country, the type of data, whether there is a transfer outside the EU, and the retention period.
| Service | Provider | Country | Data | Transfer outside the EU | Retention |
|---|---|---|---|---|---|
| Hosting (servers) | Scaleway / Dedibox | France | Application, case files | None | Life of the account + 30-day recycle bin |
| AI engine | Mistral AI | France / EU | Assistance requests | None | Not reused for training |
| Transactional email | Scaleway (TEM) | European Union | Service emails | None | Limited logs |
| Database | MySQL, self-hosted | France | Accounts, encrypted content | None | Depends on account + 30-day recycle bin |
| DNS / domain name | Online.net | France | None | None | Not applicable |
| TLS certificates | Let's Encrypt / ISRG | United States | Galyct domain names, no client data | Yes, with no personal data | Life of the certificate |
| Password check | Pwned Passwords (Cloudflare front end) | Outside the EEA | 5 characters of a SHA-1 hash | Yes, with no personal data | Not stored |
| RDAP bootstrap (Pro) | rdap.org, then the domain’s registry | To be established | Domain name analysed | Yes, with no personal data | Short cache |
| Certificate transparency (Pro) | crt.sh, operated by Sectigo Limited | United Kingdom | Domain name analysed | Yes, with no personal data | Short cache |
No transfer of personal data to a third country is initiated by Galyct in the standard configuration. Four technical flows leave the European Economic Area without carrying any personal data: they are named in the table above. Other services located outside the EEA are provided for in the code but are not configured to date: checking whether an email address has been exposed (Have I Been Pwned), abuse.ch and AbuseIPDB. The security connectors (Microsoft, Google, Sophos, Acronis, CrowdStrike, SentinelOne, MISP) work with your own credentials towards your own subscription: the destination is then a matter for your contract, not for Galyct’s standard configuration. We have not established the identity of the operator of rdap.org, nor the country of each registry server it redirects to; we say so rather than assume it. Updated: 24 September 2026.
WHERE YOUR DATA IS
Where your data is, and who hosts it
The facts, written down once: they are what all our pages that talk about hosting refer to.
The facts
Hosted in France by default, with Scaleway
Hosting, primary processing, default AI and backups operated within the European Union, with no transfer to a third country initiated by Galyct in the standard configuration.
A connector that you choose to activate may add a destination: it is then named, logged, and a matter of your initiative, not of the standard configuration.
What it is not
A hosting provider, not a certification
Our hosting provider is Scaleway, in France. It is neither a label, nor a state qualification, nor a certification issued by a third party.
ANSSI makes the point for the cloud: being hosted on a SecNumCloud-qualified service does not make the application itself SecNumCloud. The same reasoning applies here. Galyct is not SecNumCloud-qualified and does not claim to be.
Three questions, three separate answers
A serious client does not ask one question, they ask three. Merging them under a single word answers none of them.
Location
Where your data is stored and processed. A dedicated server in France; backups and evidence kept within the European Union; artificial intelligence processing in France or the European Union by default.
Jurisdiction
Who operates the infrastructure, and which law that operator is subject to. The hosting provider is Scaleway / Online S.A.S., a company governed by French law (RCS Lille Métropole 433 115 904). The publisher and operator is Datashield Risk Consulting (SAS, RCS Lyon 984 134 916, Lyon). Neither of these two companies is controlled from a third country.
Dependency
Which external components the service needs in order to work. Four: hosting (Scaleway / Online, France), the artificial intelligence engine (Mistral, France / EU), payment (Stancer, France) and transactional email (European Union). The dated list is kept in the register of subcontractors, which is authoritative for this page.
What we do not claim: we do not claim to be free of every dependency or of every foreign jurisdiction. We describe the architecture we have chosen and that we control. What is beyond our control, we do not guarantee: we name it.
01 · THE COMMITMENT
Four commitments built into the architecture
Hosting is not declared in a brochure: it is built into the architecture. Here, in concrete terms, is what protects your data at every stage.
French hosting
Servers in France, with Scaleway/Online (an SAS governed by French law). Your data and your evidence are kept within the European Union, under French and European law.
Mistral, French AI
Our artificial intelligence processing goes through the Mistral AI assistant (France / EU), under human supervision: no engine outside the EU, according to the published architecture.
Encryption & GDPR by design
Encryption in transit (TLS) and at rest, and compliance that is managed and documented. Data protection is not added after the fact: it is part of the design.
30-day recycle bin
Every deletion goes through an encrypted recycle bin, recoverable for 30 days. Never a deletion without a safety net: your accounts, case files and evidence do not disappear with a single click.
02 · COMPARING WITHOUT DISPARAGING
American solutions and Galyct: the facts
The major platforms have great strengths and provide great services. Only one question separates us: where your data lives, and who can access it. Here are the facts, without caricature.
Non-European platforms
The major American platforms
Powerful tools, but their legal framework and location do not depend on you.
- Data often hosted or replicated outside Europe.
- Subject to extraterritorial access laws (e.g. the CLOUD Act).
- General-purpose AI trained and operated outside the European Union.
- Terms and location that can change without your agreement.
No judgement, only the applicable framework.
Galyct · France & EU
The European choice
The same technical seriousness, but a framework that remains under French and European law.
- Hosting in France, with Scaleway/Online (an SAS governed by French law).
- French and European law: by default, no exposure to an extraterritorial access law.
- Mistral AI assistant (France / EU), under human supervision.
- A stable location, written into our commitments and enforceable.
03 · THE COMMITMENT
We will never ask for your passwords.
A genuine cybersecurity professional never asks for your codes. Neither does Galyct. We guide you so that you take back control yourself: you remain the sole holder of your access, from start to finish.
No window, no adviser and no Galyct email will ever ask you for your password, a code received by text message or your banking credentials. If anyone asks you for them in Galyct’s name, it is fraud: report it to us.
04 · EMAIL
Our emails are sent from Europe, not from anywhere else
An incident also plays out in the inbox. Our service email is hosted in Europe, authenticated and restrained: it keeps you informed without exposing you.
Authenticated domain
Our domain is verified and signed (SPF, DKIM, DMARC). An email claiming to come from Galyct without these signatures is not from us.
No tracking
No hidden marketing trackers in our service messages. A Galyct email is there to inform you, never to monitor you.
05 · OUR CANDOUR
What this hosting provides, and what it does not promise
We prefer clarity to fear-based marketing. Here is what we commit to, and what we will never claim.
What we commit to
Our commitments
- Hosting and data kept in France, within the EU.
- AI processing by Mistral (France / EU) by default; no transfer of your personal data to a third country without your explicit activation.
- Encryption in transit (TLS) and at rest, and GDPR compliance by design.
- Encrypted 30-day recycle bin: never a deletion without a safety net.
- Never a password or code requested in Galyct’s name.
What we do not promise
Our candour
- No result is guaranteed: absolute security does not exist anywhere.
- Hosting in France reduces risks; it does not eliminate them.
- We do not disparage other solutions: we set out facts.
- We do not sell fear: we prefer informed decisions.
A hosting decision is not one to make alone.
Let’s talk about your situation: hosting, data, compliance, AI. A conversation with an expert, with no commitment and no sales pitch.