Skip to content
ekera AI
Request an assessment

Ekera’s security and sovereignty

A tool that reads your information system’s dependencies must offer safeguards matching the data it handles. Ekera separates what is in place from what is planned.

Illustration: server room with four racks, one alert light on
Security and sovereignty

Ekera’s security, up to what it analyses

A tool that reads your information system’s dependencies must offer safeguards matching the data it handles. Ekera separates what is in place from what is planned.

Control of data Open-weight models served in France; no customer data sent to US services; hosted in Paris, on an isolated platform or a dedicated instance. For sensitive sites, the AI runs on your premises.
Access control Rights set by use, read-only by default; connections and writes limited to the scope agreed with you.
Traceability Operations are recorded: who approved, when, what changed. Tracing or undoing a change is separate from data retention and deletion.
Human approval Ekera prepares analyses and proposed scenarios, to be approved by the company; decisions and changes go through your approval flows. Nothing is written into your tools without your consent.
Calculated, not declared The figures come from a calculation engine, not the language model; every finding cites its source.
No lock-in Your data stay in open tools and formats. If you leave, everything stays with you.
What we do to stay secure

Large-company security, for a mid-sized company

Ekera brings a mid-sized company the security resources of a large group, shared among its customers. A tool that reads the map of your systems must itself meet the standards of a large group. Here is what is in place today, at the level of principle.

Your data

  • Open-weight models served in France
  • Each customer isolated at several levels, tested by cross-access attempts
  • Every change is traced and can be compensated by a reverse operation

Access and writes

  • Identity from your own directory; separate roles, including one dedicated to sharing
  • Read-only by default; writes signed, single-use, recalculated by Ekera
  • Collector with no inbound door; documents analysed in an isolated space

Development and website

  • Review by a dedicated security role, independent review
  • Code analysis, secrets searched across the full history, locked dependencies, licence checks, tests that replay every known bypass
  • Website checked before any publication, no third party loaded

Also in place: hosting in Paris in two modes, the isolated platform, with one encryption key per customer and data made unreadable within 30 days at the end of the contract, or the dedicated instance, with its own keys and backups, destroyed at the end of the contract with an erasure certificate; fresh authentication before every write approval. Planned: external penetration test, PASSI audit, bug bounty, ISO 27001, SecNumCloud-qualified hosting. These tests cover Ekera itself: Ekera does not certify your architecture and does not replace your penetration tests; it targets them and tracks your exposure between two campaigns. Read the security documentation.

Get the security sheetSent after a first conversation.

Shared security

Learning together, without confusing sharing with protection

Companies face risks that resemble each other: what one observes helps others understand the threats they meet. Ekera organises this sharing within a framework: signals validated before they are shared, to limit errors and manipulation; sharing only under the conditions each customer authorises; feedback that improves everyone’s analyses and proposed scenarios. Sharing a signal does not, on its own, guarantee that an attack is detected or blocked.

Shared security

The security resources of a large group, shared among mid-sized companies

30% of our revenue is devoted to Ekera’s research, quality and security. It is a commitment on Ekera’s spending, for the benefit of every customer: it is neither a legally separate fund nor a reserve held on customers’ behalf. It mostly pays for people: R&D engineers who improve the reading of your documents, the calculation engine and the connectors; security engineers; analysts who validate the signals shared between customers. The rest funds Ekera’s tests, audits, qualified hosting and certifications.

These needs grow with Ekera: Ekera becomes a more attractive target, there are more tools to support, and operators of vital importance have stricter requirements. Every fix then benefits all customers, at no extra cost.

Pooled security30% of Ekera’s revenue goes to a shared budget that funds tests, audits and monitoring for everyone's benefit.All customersEach pays its subscription30% of our revenueDevoted to R&D, qualityand securityA shared budgetThe same for every customerWhat it fundsTest bench, trapped fictitious companies,penetration tests, PASSI audit,ISO 27001, qualified hostingEvery customer benefitsEvery vulnerability fixed is fixed for all;large-company security, for each customer

What is planned for Ekera’s security

  • an external penetration test of Ekera by a provider;
  • an audit by a PASSI-qualified provider, then regular audits and penetration tests;
  • a large-scale test bench with hundreds of fictitious companies;
  • a permanent bug bounty;
  • ISO 27001 certification of Ekera;
  • SecNumCloud-qualified hosting for operators of vital importance;
  • a dedicated security team.

The tests, audits, certifications and qualified hosting listed are planned; they cover Ekera, not our customers’ architecture. With each customer’s consent and only in aggregate, from five companies, lessons learned also improve Ekera for everyone. Our R&D.

Learn more: the common budget in detail

Shared vigilance

The vigilance of a very large IS, at the price of a mid-sized one

By sharing what they learn, Ekera’s customers will benefit from the vigilance of a large group without its teams. It works like a community navigation app: every driver who reports a traffic jam or a safety hazard helps all the others. At Ekera, when a customer spots an attack, an exploited flaw or an incident, the signal benefits everyone, and each receives the alerts and protections drawn from the others’ experience.

The difference that matters to a CISO: verified signals, to limit the risk of manipulation. Each signal is checked by two people at the customer, then by an Ekera analyst, and signed. It is shared only with the customer’s consent, given by a designated person, and only in aggregate, from five companies. No raw data leaves your premises. Signal analysis is funded by the shared 30% budget.

Every customer strengthens the othersCustomers share validated, anonymised signals; Ekera's network analyses them and sends alerts and protections back to everyone.Each customerSpots an attack, a flaw,an incident on its sideA validated, anonymised signalFour-eyes checked at the customer,then by an Ekera analyst, signedThe Ekera networkAggregated from five companies,with the customer's consent; analysedAlerts and protections for allEach customer benefits fromeveryone else's vigilanceSignal analysis funded by the shared budget

Learn more: shared vigilance and its four safeguards

Ekera and cybersecurity firms

Complementary, not competing

Security plays out on three levels. AI accuracy: Ekera’s strength, tested on a bench of fictitious companies, hundreds in time, as in an AI lab. Security of the Ekera product: secure development already in place (code review by a dedicated role, automated analysis, secret scanning, verified dependencies, bypass tests, independent review), then an outside view planned and then by the shared budget: a penetration test of Ekera by a provider, a PASSI audit, ISO 27001 certification of Ekera (the roadmap). Security of your systems: Ekera does not run penetration tests and never enters your network. It reads, read-only, and computes what an attack would stop without launching it. PASSI-qualified providers remain essential, and become our partners.

Who tests whatThree areas: AI accuracy, tested by Ekera; security of the Ekera product, by Ekera then by outside providers; customer security, by cybersecurity providers, targeted by Ekera.AI accuracyEkera, its strengthTest bench of hundreds of fictitiouscompanies, some of them trapped,like an AI labCybersecurity firmsNot their businessSecurity of the Ekera productEkera, already in placeCode review by a dedicated role,automated analysis, secrets, dependencies,bypass tests, independent reviewOutside providers, plannedPenetration test of Ekera, PASSI audit,ISO 27001: plannedCustomer securityEkeraRead-only, never enters your network:computes what an attack would stop,without launching itPASSI providers, partnersTest for real: penetrationtests, audits, exercises

Better-targeted penetration tests, and monitoring between campaigns

Ekera does not replace penetration testing: it targets it. It tells you what to test first, the attack paths and single points of failure that matter, and the estimated potential loss from an outage; you avoid paying to test what has no impact. The provider’s findings flow back into the map and the costing in euros, with the work to be done, and Ekera monitors continuously between two annual campaigns. The result: shorter or more useful penetration tests, and monitoring the rest of the year. Ekera does not certify your architecture and never tells you that you no longer need to test.

Ekera and penetration testingEkera targets the penetration test, a provider runs it, its findings flow back into the map and the costing, and Ekera monitors between two campaigns.1. Ekera targetsWhat to test first: attack paths,single points of failure, cost of an outage2. The provider testsA real penetration test, shorteror more useful, on what matters3. Findings come backInto the map and the costing in euros,with the work to be done4. Ekera monitorsContinuously, between two campaigns↻ and the next campaign is better targeted

Learn more: who tests what, and Ekera with penetration testing

Understand shared security

Request an assessment

A first 30-minute call: framing your need, the possible scope and the list of information needed for the assessment. The initial assessment starts from your documents and exports, with no direct access to your information system.

Request an assessmentSee the offer and pricing

Read next