Last updated: September 2026
Sovereign and Secure Scientific AI
1. Overview
Welcome to the Emerit Science Trust Center
At Emerit Science, the security and confidentiality of your research data are at the heart of our priorities. This Trust Center describes how Charlie is hosted, where your data is processed and which measures we apply to protect it. Our strategy is clear: the core of the system (hosting, data, identities, search engine, vectorisation, document parsing) is operated in France with a French provider, and our roadmap aims to extend this sovereignty to the whole platform.
Here you will find a description of our arrangements and commitments, at the level of detail appropriate for a public page. Our reference documents (privacy policy, terms of use, subprocessor register, architecture and security dossier, data processing agreement) are kept up to date with each change to the platform and provided to organisations that request them — under a non-disclosure agreement for those describing our architecture.
Whether you are a researcher, an IT manager, a data protection officer or an industrial partner, this Trust Center lets you understand how Charlie protects your data and verify our commitments. For any question or request for additional documents, our team can be reached at contact@emeritscience.com.
2. Compliance
GDPR
Emerit Science processes your data in accordance with the General Data Protection Regulation (GDPR), whether or not you reside in the European Union. Each processing operation relies on an identified legal basis (performance of the service, legal obligation, legitimate interest, or consent for audience measurement), and our privacy policy describes precisely which data is collected, why, for how long it is kept and to which sub-processors it is entrusted.
User rights and data security: You can access your data, rectify it, request its deletion, restrict its processing and retrieve it. Account deletion is available directly in the application, with cascading erasure of your conversations, libraries and files; accounts inactive for more than a year are deleted automatically. A data protection lead is appointed to oversee our compliance and answer your questions at contact@emeritscience.com.
Data protection commitment: We apply the principles of privacy by design and privacy by default: minimisation of the data sent to the models, strict segregation between users, masking of personal data in technical logs, a log of the third-party services called. We maintain an up-to-date register of our subprocessors, provided on request, and supply client organisations with a data processing agreement compliant with Article 28 GDPR, including a right to audit. In the event of a data breach, we notify the organisations concerned within 72 hours.
Hosting in France and sovereignty roadmap
The core of Charlie is hosted and operated in France, in Paris, with a French hosting provider certified ISO 27001: your accounts, your documents, your conversations, the search engine, vectorisation and document reading never leave France. Language models run exclusively within the European Union, and our contracts exclude the reuse of your data to train models. A 100% France configuration, relying solely on open models hosted in Paris, is available to organisations that request it. Our ambition: to extend this sovereignty to every function of the platform and to bring the core of the system within the ANSSI SecNumCloud framework as qualified offerings make it possible.
3. They Trust Us
• Genopole
• Abolis
• CHU Caen
• Université Grenoble Alpes
4. Documentation
Emerit Science's reference documents:
• Architecture and security dossier: provided to organisations on request, under a non-disclosure agreement
• Data processing agreement (Article 28 GDPR) and subprocessor register by name: provided to client organisations and, on request, to organisations evaluating Charlie
5. Security Categories
The measures below describe, in broad terms, Charlie's security arrangements. The technical details, configuration settings and our quantified objectives are set out in our architecture and security dossier, provided under a non-disclosure agreement.
5.1 Data Encryption
All communications are encrypted in transit (TLS), with automatic certificate renewal, from the browser through to the databases and the model providers. Data at rest is encrypted by our hosting provider's managed services, and files are accessible only through time-limited signed links.
5.2 Access Management and Authentication
Authentication relies on a dedicated identity service hosted within our platform: hashed passwords, a complexity policy, progressive lockout after repeated failures, email address verification at sign-up and automatic expiry of inactive sessions. Single sign-on via Google, Microsoft Entra ID or ProConnect allows organisations to enforce their own multi-factor authentication. Roles (user, team administrator, platform administrator) restrict access to what is strictly necessary, and administration interfaces are restricted.
5.3 Secure Data Storage
Data is hosted in Paris, with a hosting provider certified ISO 27001, in separate production and test environments. The databases, the identity stores and the file storage are backed up automatically and regularly, and file storage is redundant. Our recovery time and maximum acceptable data loss objectives are contractually committed and communicated to organisations on request.
5.4 Threat Monitoring and Detection
Technical logs from all components are centralised in a logging service hosted in France, with masking of personal data and a limited retention period. Health probes monitor the availability of each service and every interaction with the models is traced.
5.5 Security Policies and Training
Access to production data is limited to those who need it, technical secrets are stored outside the code with a renewal schedule, and every change goes through review, automated tests and a pre-production deployment before production. Automated guardrails check the third-party services called by the application at every release, and any new sub-processor is entered in the register before going live.
5.6 Incident Management and Business Continuity
We have a data breach management procedure covering detection, assessment, containment and notification: users are informed within the application, client organisations are notified within 72 hours with the information they need to meet their own obligations, and every breach is recorded in a register. The procedures for restoring our backups are documented.
5.7 Regular Audits and Compliance
We carry out regular security reviews of the code and of third-party services, with a tracked remediation plan. Client organisations have a right of audit provided for in our data processing agreement.