Your data never leaves your infrastructure.

SkaLean follows a structured compliance and certification roadmap in 3 phases.

1. Current phase (operational): GDPR, Quebec Law 25, HIPAA (activatable medical mode), OSFI (activatable financial mode). These compliances are architectural, built into the system design from the start. Compliance controls are documented and available on request (security questionnaires for your audits).
2. Ongoing phase (H1 2026): SOC 2 Type I certification preparation, covering organizational security audit, access controls, and incident management.
3. Planned phase (H2 2026): ISO 27001, information security management system.

For clients with specific certification requirements today, SkaLean can provide: a third-party penetration test report (available on request under NDA), security architecture documentation, and a completed security questionnaire (SIG, CAIQ, or custom format). Specific compliance requirements of an Enterprise client are addressed from the discovery phase.

GDPR and Law 25 compliance is ensured at 5 levels in SkaLean.

1. Data localization: option for processing exclusively on physical servers in Canada or your designated country. No transit to the US or other non-adequate countries without explicit agreement.
2. Automatic PII detection and pseudonymization: 15 categories of personal data (names, emails, phones, insurance numbers, birthdates, medical data, financial data, etc.) are detected and pseudonymized before any LLM processing. Your company is the data controller; SkaLean acts as processor.
3. Data subject rights: SkaLean provides tools to honor access, rectification, erasure (right to be forgotten), and portability requests. An individual can request deletion of all their data within 72 hours.
4. Processing register: SkaLean automatically generates a GDPR-compliant processing register for your organization, including purposes, data categories, and subprocessors.
5. DPA (Data Processing Agreement): a GDPR/Law 25-compliant data processing agreement is signed with each client, detailing SkaLean's obligations as processor.

When you ask SkaLean a question, an LLM inference occurs: a computing calculation that generates the response. Sovereign GPU hosting means this calculation happens on graphics processing units (GPUs) physically located in your country, operated by an entity subject to local laws.

Without GPU sovereignty, even if your data is stored in Canada, LLM computing is often delegated to US providers (AWS, Google Cloud, Azure, OpenAI) subject to the US Cloud Act of 2018, which compels these companies to provide data to US authorities on request, even if the data is physically outside the US.

Sectors that must use sovereign GPU:

• Sectors subject to HIPAA (medical clinics, hospitals)
• Sectors subject to OSFI (banks, insurance)
• Organizations subject to government regulations on citizen data protection
• Professions with strict professional secrecy obligations (lawyers, notaries)

Sovereign GPU is available on SkaLean Pro and Enterprise plans. With Starter plans using a cloud LLM, only relevant anonymized excerpts transit, never the complete document. For the sectors cited, we systematically recommend sovereign GPU.

SkaLean applies end-to-end encryption at two stages.

1. In transit (moving data): all communications between your browser/app and SkaLean servers use TLS 1.3 (the most recent and secure version of the protocol). Communications between internal servers use mTLS (mutual TLS with authentication on both sides). No unencrypted HTTP communication is permitted in the infrastructure.
2. At rest (stored data): all files (documents, vector base, logs) are encrypted with AES-256 (industry standard for sensitive data). Encryption keys are managed by a key management system (KMS) with automatic rotation every 90 days. For Enterprise clients, key management can be transferred to the client (BYOK: Bring Your Own Key), meaning SkaLean technically cannot access your data even in case of an external request.

Backups are also encrypted and stored in a separate region. Data retention after termination is 30 days by default (configurable from 7 to 90 days), then certified permanent deletion.

SkaLean has a documented 5-phase incident response plan.

1. Detection: 24/7 continuous infrastructure monitoring with automatic alerts on abnormal behavior (unusual access, abnormal request volumes, intrusion attempts). Anomalies trigger an alert to the security team in under 5 minutes.
2. Containment: immediate isolation of the affected area to stop spread, without cutting service for unaffected clients.
3. Notification: in case of a confirmed breach involving personal data, SkaLean notifies affected clients within 24 hours (well within the 72 hours required by GDPR and the 30 days required by Law 25). You are then responsible for notification to your Data Protection Authority if required.
4. Remediation: vulnerability fix, log analysis to determine incident scope, post-incident report delivered to client.
5. Improvement: each incident undergoes a post-mortem with documented corrective actions. The report is shared with affected clients.

Availability SLA: 99% (Starter), 99.5% (Pro), 99.9% (Enterprise). Incident histories are published on the public status dashboard.

Yes. SkaLean has a standard compliance documentation package available to clients under NDA.

1. Completed security questionnaire: SIG Lite format, CAIQ v4 (Cloud Security Alliance), or your organization's custom questionnaire. Includes technical, organizational, and physical controls.
2. Documented security architecture: architecture diagrams with data flows, encryption points, network segmentation, and external access.
3. Information security policy: 40+ page document covering access management, data classification, incident management, and business continuity.
4. Penetration test report (pentest): conducted by an accredited third party, available under NDA. Frequency: annual and after any major architectural change.
5. Risk analysis report: based on the ISO 27005 standard.
6. Data Processing Agreement (DPA): GDPR/Law 25 compliant, customizable to your requirements.

For Enterprise clients, SkaLean can participate in your own security audits (custom questionnaires, security team interviews, architecture review). Standard turnaround for documentation: 5 business days.