The principle: we can't access it.
Your questionnaire answers and generated documents are encrypted before being stored. The decryption key is derived from your user identifier β something our database alone cannot use.
Concretely: if someone accesses our database directly β leak, breach, or an admin having a curious moment β all they see is unreadable noise.
The honest caveat: Mistral AI sees some of your data.
To analyse your audit and generate your regulatory documents, we use Mistral AI β our generative AI model provider (GPAI). They produce the summaries, recommendations, and narrative content of your documents.
Before sending anything to Mistral, we apply automatic pseudonymisation: emails, phone numbers, SIRETs, and IP addresses are replaced with neutral tokens (EMAIL_1, PHONE_2β¦). Mistral never sees your direct identifiers.
The business content of your questionnaire (sector, AI system uses, organisational context) is necessary for generation β Mistral does access this. That's the inherent trade-off of using an external LLM. We'd rather tell you clearly than bury it in the terms of service.
Who sees what
Questions about our practices? Our full privacy policy is available below.