The questionnaire answers, before you ask

This page gathers what a security lead or a procurement team asks before signing. Each point links to the documentation page that details it. We claim no certification we do not hold.

Hosting and isolation

One instance per customer, on a dedicated server in France; nothing is shared.

Location: Scaleway Elastic Metal server, zone fr-par-2, Paris. Backups in a Scaleway object storage space in Paris, one space per customer.
Isolation: Database, graph, message bus and services belong to each instance. No customer data is readable from another customer’s instance.
Exposure: A single exposed service: the web server, with a Let’s Encrypt certificate, HSTS and no framing. The other services answer only on the instance’s internal network.
Subprocessor: Scaleway SAS, a company under French law, for hosting, backups, transactional email and the language models of the assistants. No other.

Your data

What is kept, how, and for how long.

Cloud credentials: Encrypted with AES-256-GCM using a key specific to the instance before being written to the database; the scan orders that carry them are sealed with a second key. The key is never included in backups.
Sensitive data found: Only masked excerpts are kept with the finding; the content read is never stored. Databases are read on a temporary copy inside your account, destroyed afterwards.
Retention: Closed findings purged after ninety days by default, adjustable between seven days and ten years. Audit log kept one year. Daily backups kept thirty days.
Reversibility: At the end of the contract, the instance and its backups are destroyed; findings can be exported beforehand from the application.

Access to your accounts

Through the cloud APIs, without an agent; permissions published cloud by cloud.

Requested permissions: Read permissions for inventory and configuration: CloudFormation role with ExternalId for AWS, service principal for Azure, service account or identity federation for Google Cloud, API key for Scaleway, consumer key for OVHcloud, EIM user for OUTSCALE.
Copy permissions: Analysing hosts, on-disk vulnerabilities and databases creates snapshots, ephemeral instances and copies inside your account: these write permissions are requested separately, and you decide whether to grant them. Without them, those scanners do not run and say so.
Kubernetes: Read through the cluster API with a dedicated group; the exact permissions are in the connection guide.
Audit log: Every user action in the application is logged with its author, viewable in the settings and kept one year.

Access to the application

Authentication, roles, scopes.

Sign-in: SAML and OIDC with group-to-role mapping. For local accounts, a password of at least twelve characters then a code received by email.
Roles and projects: Roles per user, scope restricted to projects, cloud accounts and repositories grouped in folders.
Assistants: Four assistants that read the instance data and apply nothing without a human decision. Mistral models served by Scaleway; scope enforced server-side; guard against instructions hidden in the data read.
Outputs: Notifications, tickets and emails only go to channels you configured and can switch off.

The details, in the documentation

The pages below describe the product as delivered, limits included.

Report a vulnerability

Write to contact@ctadel.eu with the reproduction steps. We acknowledge within two working days and keep you informed of the fix. The site’s security.txt file carries this address.

contact@ctadel.eu

A question this page does not cover?

Write to us; we answer precisely, limits included.

Write to us