Your data stays yours, in Europe
Encryption, SSO, per-team permissions and audit logs on every plan. Your data is hosted in the EU and never used to train a model.
How the platform protects your data
Encryption
Data is encrypted in transit and at rest, including documents read by the foundation.
TLS in transit · encrypted at restSSO and SAML
People sign in with your identity provider; access ends when their account does.
SAML 2.0 · OIDCRoles and permissions
Who can run, edit and approve each agent, per team. Agents read only what their owner can open.
Per-team scopesEU hosting
The platform and your data are hosted in the European Union.
EU regionAudit logs
Every run, every source read and every approval is recorded and exportable.
Exportable logsAI governance
Your data is never used to train a model. Each agent's model, prompts and limits are reviewed and versioned.
No training on your data
Frameworks and certifications
Where each one stands today.
- EU hostingIn placePlatform and data in the EU
- GDPRIn progressDPA and sub-processor list
- EU AI ActIn progressTransparency and human oversight
- ISO 27001Planned
- SOC 2 Type IIPlanned
Where your data goes, and where it doesn't
Where it lives
The platform, its databases and backups run in the European Union.
What agents can read
Only the sources you connect, with the permissions of the person who owns the agent.
What models receive
Only what a step needs, under contracts that forbid training on your data.
Retention and deletion
You set how long runs and documents are kept; deletion follows within 30 days of a request.
Found a security issue? Tell us first
We welcome reports from researchers and customers, and we will work with you on a fix before anything is made public.
Report a findingsecurity@zastral.com
- 01What you found and where (URL, feature, account type)
- 02How to reproduce it, step by step
- 03What an attacker could do with it
- 04How to reach you for follow-up
We acknowledge every report within two working days. Research done in good faith and within these rules will not lead to legal action from us.
Questions teams ask first
Which AI models do you use?
We are model-agnostic. Each agent runs on the model that does its job best, from Anthropic, OpenAI, Google DeepMind, Mistral AI or Meta, and we can change it without rebuilding the agent.
Where is our data hosted?
In the European Union. The platform is built and hosted in Europe, and your data is never used to train a model.
How long until the first agent is live?
Usually four to eight weeks after the audit. The audit itself takes three to four weeks and ends with a roadmap ranked by return on investment.
Do we need a technical team?
No. A forward-deployed engineer does the build inside your tools. Your people review and approve what the agents produce.
See Zastral on your own work
A 30-minute demo on one of your real workflows, and a view of the hours it gives back.