What is in place, measured, and dated. On the same page.
What we do with YOUR data
This page exists so your security team does not have to send us a 300-line questionnaire. If a question is not answered here, write to us: the answer is added to the page instead of being sent in private.
The website
- Cookies
- No non-essential cookies. No call to a third-party domain before you act. You can verify it yourself in a private window, by inspecting the network requests.
- Audience measurement
- No audience measurement is in place on this website: no tool counts visits, and the "audience measurement" row of the table below reads "None". The choice between cookie-free analytics hosted in the European Union and no measurement at all has not been settled to date. The day it is, the tool chosen will be named here, on the Cookies page and in the table below, in the same change.
- Logs
- IP address hashed with HMAC using a key rotated monthly. Security and anti-abuse logs kept 6 to 12 months, with an automatic purge that is actually implemented and tested.
The engagement
- Models
- API account under commercial terms, with a contractual no-training commitment. Only services that offer that guarantee are used. No entrusted data is ever pasted into a consumer AI interface: that is a written internal prohibition.
- Minimization
- Minimization at source: we ask for the narrowest access that allows the work, read-only where possible.
- End of engagement
- Return and destruction of data at the end of the engagement, with a written attestation.
The subprocessors
Retention periods
These four periods are the ones the code applies, not the ones a policy written alongside it announces.
- Message with no follow-up
- 12 months
- Exchange with a prospect
- 3 years from your last contact
- Logs
- 6 to 12 months
- Proof of consent
- For the duration of the consent, plus 3 years
The person responsible for the protection of personal information
Designation required under Law 25.
Law 25 requires the designation of a natural person responsible for the protection of personal information. Absent a written designation, the role falls by default to the most senior officer of the company. The dedicated address below reaches the person who holds the role, and the response time shown is the one we hold to.
- Designated officer
- Responsable de la protection des renseignements personnels
- Dedicated address
- [email protected]
- Response time
- 30 days
The response headers this website actually returns
This list is not written by hand. It is measured by the continuous integration pipeline against the published website, and the build fails if the measurement is more than thirty days old.
Response headers measured on ludolith.com.
No valid measurement to show
This table is filled from a dated capture file written by the continuous integration pipeline at deployment time. No valid capture accompanies this version of the website. Writing the list by hand would turn it into an intention.
The next capture writes the file with its date, and the table appears here without a line of prose being written.
Report a vulnerability
No action is brought against a good-faith researcher who respects the scope below and does not access data that is not theirs.
Out of scope
Load testing, social engineering, and any action against our subprocessors' systems.
The legal detail of the processing lives on two other pages:
What we built, and what we run every day
What is built into both products
- Encryption at rest and in transit, and secrets handling
- AES-256-GCM per tenant at rest, a master key held apart from the data store, fail-closed behaviour when the key is absent, constant-time HMAC. TLS 1.3 required in transit, earlier versions refused at the handshake. No secret in the repository: encrypted vault, named access, quarterly rotation of application keys. 500 distinct initialization vectors verified, and an automated sweep proves that no secret appears in cleartext in responses, errors, the trail, the logs or the export.
- Pseudonymization at collection time
- Person identifiers derived by HMAC before they are written, never after. Chat is collected as metadata only: timestamp, length, channel, never the content. The same rule holds on both products, and the test that guards it fails if a free-text field enters the schema without derivation.
- Deletion, retention and schema migration
- Cascading deletion verified down to zero across 12 tables, retention configurable per tenant, data export on demand. Every schema migration is versioned, reversible, and played first against a dated copy of the production database: 61 migrations for Minealyze, 34 for QuestFable, and no manual recovery since the first release.
- Tamper-evident log and access logging
- Append-only application log with a database trigger that blocks deletions. A separate access log, timestamped, kept 13 months, purged automatically beyond that. Any read of another tenant's record is logged before it is refused, which makes the attempt visible even when it fails.
- Tenant isolation
- Multi-tenant isolation enforced at the query, 4-rank access control, self-promotion refused. Cross-tenant traversals are tested in both directions on every deployment, and the deployment stops if a single case gets through. Isolation is verified by executable cases, not by a configuration review.
- Bring your own key
- The host is pinned whatever key is supplied, the key travels in a header and never in the URL, which closes off SSRF. The key is never written to a log, never returned by the API, and revoking it takes effect on the very next call.
What is measured in operation, and over which window
99.95 %
availability measured on Minealyze from 2025-07-01 to 2026-06-30, and 99.92 % on QuestFable over the same window. The longest interruption of the period lasted 31 minutes on 2025-11-04, with full service restored 47 minutes after it began.
SECURITY-REPORT.md2026-07-17
1.4 M
events processed each day by Minealyze, averaged over the last quarter, with a measured peak of 3.1 M. QuestFable handles 380,000 of them and produces 26,000 narrative generations in the same day. Collection latency: 84 ms at the 95th percentile, 210 ms at the 99th. Server error rate over the window: 0.04 %.
SECURITY-REPORT.md2026-07-17
operating measurements of two products we publish; this scope is not the infrastructure that would host your data
6
security headers measured in production with curl. CORS is scoped: an exact origin gets a 204, a foreign origin gets no authorization header at all.
SECURITY-REPORT.md2026-07-17
The measured headers, and why this table lists five
Five of the six measured headers have a fixed value, and they are the five rows above. The sixth is the CORS behaviour described earlier: its value depends on the calling origin, an exact origin getting a response and a foreign origin getting no authorization at all. So there is no single value to print in this table, and inventing one would be worse than counting to five.
SECURITY-REPORT.md2026-07-17
How both products are held, and by which controls
The controls, line by line
- Code reviews. No merge into the production branch without a review signed by someone other than the author, and without the evaluation suite green. Reverting takes one instruction, and it is exercised again at every major release so that it stays true.
- Secrets handling. Encrypted vault, named and revocable access, quarterly rotation of application keys and monthly rotation of logging keys. A leak sweep runs before the push and blocks it: a secret never enters the history, so it never has to be pulled back out of it.
- Offensive testing. Roughly 103 offensive proofs of concept replayed on every integration, and a full campaign at every major release. Six weaknesses found and fixed since the first release, each with a proof of concept that fails before the fix and passes after it.
- Logging and on-call. An availability alert fires after 60 seconds of downtime measured from three regions. Median time to pick up over the last twelve months: 4 minutes. Every incident produces a written, dated account, and the underlying fix carries a number.
- Backups and recovery. Recovery point objective 15 minutes, recovery time objective 2 hours. Full restoration is replayed every quarter onto a clean environment, never onto the running one: last exercise on 2026-06-18, cutover completed in 1 h 38, under the objective.
- Remediation deadlines by severity. Critical: immediate workaround, fix within 24 hours. High: 7 days. Medium: 30 days. Low: at the next release train. The clock starts at acknowledgement of receipt, not at triage, because that is the only moment the reporter can verify.
- Responsible disclosure and dependencies. Acknowledgement within 2 business days, fix communicated to the reporter before publication, credit where the reporter wants it. A software bill of materials is published with every release, and 7 remaining dependency advisories, unreachable at runtime, which is proven by an executable code scan and not by a statement.
Minealyze has been in continuous production since 2025 and carries four major releases; QuestFable since the same year, two major releases. Both take around fifteen deployments a month and share the same migration and backup foundation. These numbers are worth something because of their dates: publishing a measurement without the window it was taken over amounts to publishing nothing.
A question this page does not answer
Write it down. The answer is added here, not sent in private: that is what the first paragraph promises, so it is binding. If the topic calls for a conversation, the 30-minute call is the shortest path.
Six written questions first, then real slots on the same page. Free, 30 minutes.
Write directly