Your DPO and your auditor will ask where everything sits and what is certified. This page answers with the full nuance, including the US provider that is in the request path.
Platform facts, with no uptime figures and no badges.
Infrastructure and data are hosted in the EU. Cloudflare, a US company, is in the path of every request. Both are true at once.
Path of a request
Your organisation
Browser, CLI or endpoint agent
Where the request starts
Cloudflare
DNS, CDN and TLS
US company
OVH
Managed application hosting, database and storage
Gravelines, France (EU)
The application, the database and the object storage, on OVH Gravelines. The copilot's AI is provided by Mistral AI; we do not state its processing region.
Docs · Subprocessors (opens in a new tab)We do not say that no data touches US infrastructure, or that the platform is free of US providers: Cloudflare is in the path. If that matters to your risk analysis, ask us before the demo.
Controls the console implements today, explained by what they guarantee. The exact technical names are in each «Technical detail». The reference framework is OWASP ASVS: the platform is aligned with it, not certified.
Who gets in, and with what assurance.
Scope: Enforcing it is your administrator's decision: it does not come imposed.
Integration credentials and multi-factor secrets are stored encrypted.
Each customer sees only its own data: the database itself enforces the isolation, not just the application.
An immutable audit log of platform activity, and a record of ACT actions saying who did what.
Scope: Post-quantum signatures (ML-DSA-65) protect attestations and the action ledger. They do not encrypt live traffic.
The copilot sends content to an AI provider. These are the exact limits of that processing.
Mistral AI SAS (Paris) through its paid API.
Before sending, HodeiShield replaces the personal data it recognises with placeholders.
Scope: Names of people who are neither users nor vendor contacts of your organisation are not recognised and are sent as written. The content itself (a vendor's name, for example) can still describe your business. This applies to HodeiAI and the virtual CISO. The risk analysis of supplier scans does not pseudonymise: it sends the supplier's domain and the findings. That call is only made if HodeiAI is switched on for your organisation.
Conversations are kept for 90 days at most and then deleted automatically.
Scope: It queries your organisation's live data through tools; it is not a RAG system.
We say it plainly so nobody has to guess in the audit.
Hodeitek holds the label, which expresses a self-declared European origin. It is not equivalent to a certification. Hodeitek also appears in the INCIBE catalogue, which is a listing and not an accreditation.
What someone might take for granted and should not.
Cloudflare, a US company, handles DNS, CDN and TLS in the request path.
Hodeitek S.L.'s ISO/IEC 27001 and ENS Medium certifications include HodeiShield in their scope, but HodeiShield does not certify your organisation's compliance. Alignment with OWASP ASVS is not a certification.
It is optional by default. Your organisation's policy turns it on or enforces it.
It proves the integrity, origin and time of what was signed. It does not prove it is true, and there is no public transparency log. Signing keys are kept as platform secrets, not in a hardware security module (HSM).
It pseudonymises what it recognises, and what it does not recognise is sent as written.
We publish no SLA and no availability metrics on this site.
If you think you have found a vulnerability, write to us before making it public.
This is Hodeitek's channel for security issues. We do not offer encrypted email.
Acknowledgement and first assessment in business days; every other period in calendar days. Fix targets are for shipping a fixed release, counted from the first assessment. These are the times we work to, not an SLA.
We do not pay bounties. With your permission, we credit you publicly.
An index of what you can ask for or check before you sign. Each link goes to the text in force, not to a summary.
Hodeitek S.L. is certified to ISO/IEC 27001 and to the ENS, Medium category (certificate no. 34/5704/26/09103), with the HodeiShield SaaS service in scope. What we do not certify is in the same section.
Scope, rules and indicative timelines, and the security.txt file (RFC 9116) for tooling.
The website and the console have separate notices because they handle different data.
The published lists are those of the two notices above, and each describes the scope of its own document. The subprocessor annex for beta participants is under review and will be published together with the data processing agreement (DPA).
A public page shows the current status of the service. It is informational: it is not an SLA and not an availability commitment.
HodeiShield has no public trust portal of its own. Trust Center is a console feature that lets each customer publish its own, and it is managed from the console once signed in.
The ones that come up most, with the answer that survives a review.
The application, the database and the storage are on OVH Gravelines (France). Cloudflare, a US company, handles DNS, CDN and TLS in the request path, so we cannot promise that no data touches US infrastructure.
Yes. Hodeitek S.L. holds ISO/IEC 27001 and ENS Medium category certifications (ENS certificate no. 34/5704/26/09103, issued by OCA Instituto de Certificación), whose scope includes the HodeiShield SaaS service. That does not certify your organisation's compliance, and the CPSTIC catalogue is a different thing that we do not claim.
That the platform's security controls were designed with ASVS as the reference. It is not a certification and no third party issues it.
It sends content to Mistral AI. Before that it pseudonymises the personal data it recognises (emails, phone numbers, IDs, IBANs and the names of your users and contacts), but not what it does not recognise. The risk analysis of supplier scans does not pseudonymise: it sends the supplier's domain and the findings. An administrator can switch it off.
Write to security@hodeitek.com with the affected URL or tenant, the steps to reproduce it, the impact and a way to reach you. Scope, rules and indicative timelines are in the responsible disclosure section of this page.
If your risk analysis needs more detail, we cover it in the demo with whoever you choose.
A working conversation, no commitment.
