StackeoSecurity and data
Our rules for your clients’ data
The rules Stackeo applies to firms’ data, where that data is hosted, and what we do not claim.
The rules. Written first, binding on everyone who builds Stackeo.
Each firm is isolated
No organisation can reach another’s data: database isolation plus server checks, and every boundary is checked by automated attempts to cross it.
Rule and checksVision acts with the asker’s rights
Every agent and tool acts with the effective permissions of the person and the firm; the model’s instructions are never the boundary. Sensitive actions wait for a person’s yes.
RuleNo access by our team by default
No access by our team to your content. There is no support access today; if one ever exists, it will be explicit, limited and recorded.
RuleSensitive actions are recorded
An audit log keeps the sensitive actions.
RuleAI under business terms
Models that serve firms go through providers’ APIs or business agreements that allow it, never pooled personal subscriptions.
RuleHosting in Paris
Supabase on Amazon Web Services, region Paris (eu-west-3), two US companies.
Chosen
What protects your firm. In place.
- In place
Each firm walled off, and tested
Every row of data belongs to one firm: row level security in the database and permission checks on the server. Automated database and server checks try to cross each boundary.
- In place
Two factor authentication
A code from an authenticator app (TOTP) at sign in; passkeys come next.
- In place
Encrypted in transit
HTTPS only on stackeo.ai, TLS 1.3 on, TLS 1.0 and 1.1 refused.
- With production
Encrypted at rest
The database host encrypts all customer data at rest with AES-256, as Supabase states.
- In place
Your data never trains a model
Our rule: no model is trained on a firm’s data, and nothing learnt in one firm serves another. On Amazon Bedrock, model providers have no access to requests and answers, as AWS states.
- In place
Sensitive actions recorded
Sensitive actions go to an audit log, chained so a removed line shows. Bulk actions on mail keep a technical log only.
- With production
Backups, and restores rehearsed
The host’s daily backups kept 7 days, plus our own encrypted copy each night in the EU, kept 30 days, and a restore rehearsed every month.
- In place
Sub-processors, named
Our providers, what each does and where: the table below.
Sources read on 12 November 2026: supabase.com/security (encryption at rest), docs.aws.amazon.com/bedrock (data protection).
Hosted in Europe. Country by country, and what we use.
The firms’ data is hosted in Paris, notifications leave from France, and Vision runs in the United States or in France as the offer allows. Each status gives the provider’s role.
In placeChosen
France and the European Union
Supabase, Paris region (eu-west-3)The firms’ database and files, on AWS in ParisChosen for production
Scaleway Transactional EmailThe app’s notification e-mails, processed in FranceIn place- OVHcloudThe stackeo.ai domain and our mailboxesIn use
- Mistral AIVision’s AI in France, EU endpoint, zero retention requestedChosen
United States
- CloudflareThis website, its DNS and its cookieless audience measurement, on a worldwide networkIn use for this site
- Anthropic, OpenAI, GoogleVision’s AI in the United States, as the offers stateChosen
- StripePayment of subscriptions in the appChosen for payments
The brands and logos mentioned belong to their respective owners; their presence implies no partnership.
Names given for information: no partnership with these companies, no endorsement by them, and no contract or processing agreement is claimed. Stackeo does not call itself sovereign: some providers are American companies, named as such. The full table is on the security page.
Where the AI runs, by offer
Pro
- Vision’s AI
- United StatesVision runs in the United States.
- Your firm’s data
- Paris, FranceHosted in Paris, France.
Max
- Vision’s AI
- United StatesorFranceYour choice: Vision in the United States or in France.
- Your firm’s data
- Paris, FranceHosted in Paris, France.
Ultra
- Vision’s AI
- United StatesorFranceThe same choice as Max, the United States or France, with the most usage.
- Your firm’s data
- Paris, FranceHosted in Paris, France.
Prices excl. VAT, per seat and per month; mix the offers in one firm. Nothing is bought on this site: subscriptions are set up with the founders.
Our providers. What each one does, where, and where it stands.
The providers that serve Stackeo: the app, Vision, calls and backups. No contract is claimed.
| Provider | What it does for Stackeo | Where | Status |
|---|---|---|---|
| Cloudflare, Inc. | Serves and protects this website; DNS of stackeo.ai | United States | In use for this site |
| OVHcloud (OVH SAS) | The stackeo.ai domain and e-mail boxes | France | In use |
| Supabase, on Amazon Web Services | Hosting of the firms’ data (database and files) | Paris region, France (eu‑west‑3) | Chosen for production |
| Scaleway | The app’s notification e-mails (Transactional Email) | France | In place |
| Anthropic | AI models for Vision in the United States (Max or Ultra when the firm chooses the United States) | United States | Chosen for Vision |
| OpenAI | AI models for Vision in the United States, same use as the line above | United States | Chosen for Vision |
| AI models for Vision in the United States, same use as the lines above | United States | Chosen for Vision | |
| Mistral AI | AI models for Vision in France (Max and Ultra, when the firm chooses France) | France | Chosen for Vision |
| Stripe | Payment of subscriptions in the app | To confirm | Chosen for payments |
| Groq | Instant answers for Vision (live calls, titles), development only; never for a firm that chose the EU or France | Outside the EU | Development only, not chosen for production |
| Cloudflare Realtime | Audio calls in Messages (media relay) | Cloudflare’s network | Proposed: account and residency to decide by both founders |
| SMS provider | SMS as a supervised fallback for the second factor | France (OVHcloud proposed) | Proposed, both founders to decide |
| Our backup server | A nightly encrypted copy of the database and files, kept 30 days | European Union | Decided, server to choose (both founders) |
Names given for information: no partnership with these companies, and no endorsement by them, is claimed.
What we do not claim
- Any certification (ISO 27001, SOC 2, HDS, SecNumCloud): none is held.
- « End to end encrypted », « zero knowledge », « anonymised »: we do not write them.
- « Compliant with professional secrecy »: that is for each firm and its counsel to judge.
- A partner’s endorsement: the tools we name are not partners unless a decision says so.
- Signed processing agreements, a service level or a data retention commitment: we publish none today. Our providers are listed with their status, not as contracted sub-processors.
Security questions.
ContactWhere is our data hosted?
Supabase on AWS, region Paris (eu-west-3). the providers are listed on this page with their status.
Which AI does Vision use?
Vision is multi-model by design: it chooses the best model for each task among the providers of your offer’s region, the United States on Pro, the United States or France on Max and Ultra; always through providers’ APIs or business agreements, never personal subscriptions. The providers are listed on this page.
Can your team read our files?
No. No access by our team to your content. There is no support access today; if one ever exists, it will be explicit, limited and recorded.
Who hosts this website?
Cloudflare, over HTTPS only. See the legal notice and the privacy page.
A question from your IT team?
Write to us: we answer with what is decided, and say what is not.