Trust center · Version française

How we handle your code and your data

Everything your security, privacy and procurement teams need to review CRYPTAGION, in one place. If something you need is missing, request it below and we reply within one business day.

EU companyKOR IT SAS, Bordeaux, France · RCS Bordeaux 905 247 706

Your code stays putThe product runs in your environment, including air-gapped. Demos use public code only.

Engagements in FranceWhen we run the scan for you, a dedicated VM in France, destroyed within 7 days.

GDPR contractsNDA, statement of work and Article 28 DPA signed before any technical work.

Where your code is processed

There are two ways to use CRYPTAGION, and they handle your source code differently. We state both plainly so your review covers the one you will actually use.

Product in your environment

Your code never leaves your perimeter

Runs on your servers, as a CLI, in your CI/CD, or fully offline (air-gapped).
Static analysis, certificate parsing, TLS handshakes, risk scoring, CBOM and report generation all run locally.
Your source code is never uploaded to us. Only aggregated findings are produced.
The optional executive narrative can call an EU-sovereign LLM backend that you choose, or run in a deterministic offline mode with no external call.

Deployment & data flow →

Discovery engagement

We run the scan for you, in France

Each engagement gets a dedicated virtual machine on a dedicated server we lease from OVHcloud in Gravelines, France. VMs are never shared between customers.
No customer data is transferred to or processed outside the European Economic Area.
You choose how code reaches us: a read-only deploy key on a mirror you control, a one-time expiring transfer, or a live screen-share scan where you watch every command.
Deliverables are pushed to a destination you control, with SHA-256 checksums.
Within 7 days of closure the VM is destroyed and you receive a signed data destruction certificate.

Demos are different again: we only ever scan public repositories, so a demo never involves your code.

Security controls for engagements

These controls apply to the infrastructure that processes customer code during a discovery engagement. The full detail is in the security posture document (PDF).

Area	Control
Access	SSH public-key authentication only, password authentication disabled. Deny-by-default firewall and Fail2ban on the host. TOTP two-factor authentication on the hypervisor console.
People	Only the engagement lead holds access to customer VMs, with no shared credentials. You are told in writing within 5 business days of any change in who can access your data.
Encryption in transit	SSH and SFTP restricted to modern suites (AES-256-GCM, ChaCha20-Poly1305). 3DES, RC4, MD5 and SHA-1 are disabled.
Encryption at rest	LUKS full-disk encryption of the customer VM on request, and by default for engagements involving regulated personal data.
Patching	Daily automatic security updates on the host. Customer VMs are cloned from a template patched at provisioning. Product dependencies are pinned and reviewed at each release. Quarterly vulnerability scan of the host.
Audit trail	Every VM creation and destruction is logged with timestamp and customer reference, kept for 90 days.
Output integrity	CBOMs are validated against the official CycloneDX 1.6 JSON schema before delivery. See a published example with its validation record.

Sub-processors

For customer engagement data

Provider	Purpose	Location
OVH SAS	Dedicated server hosting the engagement VMs	Gravelines, France

There are no other sub-processors for customer code or deliverables. When you run the product yourself, we process none of your data.

For this website

Visitors’ data is handled by Vercel (hosting), Brevo (form delivery), Microsoft 365 (email), and, only if you accept analytics, Google Analytics and Microsoft Clarity. The full list, purposes and transfer safeguards are in our privacy policy and cookie policy.

Contracts

Every engagement is governed by three documents, signed before any technical work begins. Standard templates are available before you commit.

Mutual NDAPerpetual confidentiality on your source code, business information and findings.

Statement of workScope, deliverables, timeline, fees and liability. Deliverables are your property.

Data processing agreementGDPR Article 28: KOR IT as processor, you as controller, OVH as the only sub-processor.

Incidents and vulnerability disclosure

If something goes wrong

We notify your DPO or named security contact within 48 hours of becoming aware of an incident reasonably suspected to involve your data.
We take part in your incident response, including forensic imaging of the affected VM where applicable.
No public statement about an incident touching your data without your written approval.

If you find a vulnerability

Write to security@cryptagion.io.
We acknowledge reports within 5 business days and practise coordinated disclosure, with safe harbour for good-faith research.
Machine-readable policy: /.well-known/security.txt.

Full disclosure policy →

Request documents

The security posture document is public: download it (PDF). For contract templates, your own security questionnaire or a call with the engagement lead, tell us what you need.