Understand how your data is processed.
Hosting, model providers, access, retention: this page describes the protections in place, the scope of our commitments and the documents your security teams can review.
The facts, in writing.
The questions your CIO will ask, and our answers. The contractual detail comes with the DPA, before you commit.
- Cloud platform
- Operated by Scalt and hosted in France at OVHcloud, Paris and Gravelines regions.
- Documents and backups
- Stored in France at OVHcloud, alongside the platform. Retention and deletion described in the DPA; removed documents purged within 24 h.
- AI models
- Providers chosen among those you approve. Personal data is anonymised before the model call.
- Search and protection
- Sensitive-content and attack detection runs inside our infrastructure, with no third-party managed service.
- Logs and support
- Exportable governance log; security logs kept for the retention periods and under the access rules described in the DPA. Limited, logged access.
- No model training
- Your data is not used to train models, per Scalt’s contractual commitment and its providers’ terms.
- Reversibility
- You get your documents and your case history back; terms and timelines written in the DPA.
- Supporting documents
- DPA, sub-processor list, security measures: shared under NDA with your security and compliance teams. Pentest report to follow.
AI expands the attack surface.
Every agent that reads, writes and acts on your systems is a new surface to govern. Without a frame, adoption outpaces control.
of organisations have exposed sensitive data to AI.
year-over-year increase in AI-enabled adversaries.
AI agents expected across Fortune 500 companies by 2028.
Govern every interaction between your data and AI, on every surface.
Detect sensitive content across all connected sources, surface it for review and keep over-shared documents from ever reaching an agent.
Choose exactly which folders, channels and objects each source exposes. The rest is not ingested.
GDPR, secrets, over-shared documents: switch on the built-in policies or describe your own in plain language.
Every agent, skill and memory is reviewed before publishing: sources, permissions, allowed actions.
Defend against AI-borne threats.
Every prompt, document and answer goes through specialised detection models before it reaches your teams or your systems.
Detection of instruction-hijacking attempts, in prompts as well as in ingested documents and emails.
Filtering of toxic content and off-policy answers, with thresholds adjustable per team.
Answers come with the sources used: review them to verify information before acting on it.
Personal data, anonymised before the model call.
GLiNER models, specialised in zero-shot entity recognition, detect and anonymise personal and sensitive data before any model call, then watch the outputs.
Names, emails, IBANs, social security numbers, addresses, internal IDs: detected with no prior training, including your own entity types.
Detected entities are replaced by tokens before the model call, then re-hydrated in the answer.
Every agent output is scanned: sensitive data trying to leave its scope is blocked and surfaced in the Inbox.
Guardrails for every agent.
Governance profiles apply different rules per agent, user or team. You choose which actions require checks or approval, and the exact scope of these controls is documented.
Allowed sources, permitted actions, thresholds, counterparts: one profile per agent or team, versioned and inherited.
Choose which actions (send, pay, write) need human approval in your applications: requests land in the Inbox before they run.
Every action, human or agent, is logged with its inputs, sources and model, and exportable to your SIEM.
The basics, without compromise.
AES-256 at rest, TLS 1.3 in transit, per-tenant keys with automatic rotation.
SAML 2.0 and OIDC with Entra ID, Okta, Google. Automatic provisioning, enforceable MFA.
User, builder, admin. Every agent inherits the permissions of the sources it reads.
Dedicated encrypted storage per workspace, isolating each organisation’s data.
Your data is not used to train models, per Scalt’s contractual commitment and its providers’ terms, detailed in the DPA.
Removed documents purged within 24 h, retention periods configurable per source.
Oversight and traceability for your AI Act obligations.
The regulation sets requirements that depend on your use cases and your role. Scalt provides oversight, traceability and transparency features; the compliance work itself is defined with your teams, use case by use case.
Configure which steps need human approval in your applications; requests land in the Inbox. Relevant to Art. 14.
Agent runs are logged: inputs, sources, model, output. Relevant to Art. 12.
Answers come with their sources; agents identify as agents. Relevant to Arts. 13 and 50.
Assess each use case’s risk level and document the chosen guardrails, with our team if needed.
Everything is documented. Just ask.
DPA, sub-processor list, processing register, security policy: available under NDA for your security and compliance teams. Pentest report to follow.
Let’s discuss your first use case.
Describe the work you need done and the tools you use. We’ll prepare the demonstration around your needs.
Talk with someone who knows the product and your project.
Bring a recurring task and the result you need.
We’ll explain the next steps and the conditions for beta access.