One personal link per participant
Each participant receives an individual, time-limited link that the coach or consultant can revoke. No password appears in the link.
Back to home
Security and hosting
Where your data goes. How it is protected.
Measures currently in place, described as they are, with no sweeping promises. This page is updated with every significant change.
As of September 14, 2026
Hosted in the European Union
The application, database and generated files are hosted in Belgium. Backups remain in the European Union.
AI analyses processed in Europe
Texts produced by artificial intelligence are generated on servers located in the European Union, including Paris, with no fallback outside the EU.
Pseudonymised identities
Before anything is sent to an AI provider, the person’s name is replaced with an identifier. The mapping stays with Stratelio.
Never used for training
No data is used to train an artificial intelligence model, nor passed on to third parties for their own use.
Where the data is
Each function, its location.
| Function | Location |
|---|---|
| Application, database, generated files | Belgium, European Union |
| Database backups | European Union |
| Text generation by artificial intelligence | European Union, including France (Paris), with no fallback outside the EU |
| Identity detection for pseudonymisation | European Union |
| Login for coach and consultant accounts | European Union |
| Sending platform emails | France, European Union |
| Technical error monitoring | Germany, European Union, no personal data |
| Delivery of website pages | Global network, no customer data stored |
No other transfer of data outside the European Union. Any addition or replacement of a provider is notified to customers in writing at least thirty days in advance, with a right to object.
How it is protected
Named measures, currently in place.
Named accounts with two-factor authentication
One account per coach or consultant. Two-factor authentication is mandatory to access their workspace.
Encryption and segregation
Data is encrypted in transit and at rest. Each client organization’s data is kept separate from the others.
An access log
Link sent, opened, progress, reminder, profile published: every step is timestamped. An extract can be provided for an engagement.
The Stratelio team’s access to data is limited to support, incident resolution and maintenance.
Retention, deletion, incidents
Deadlines in writing.
- 7 days
- of automatic backups, one per day, kept in the European Union.
- 10 days
- (business days) maximum to delete an engagement’s data on request, with a dated certificate.
- 48 h
- maximum to notify the customer concerned of a security incident, after it is discovered.
The retention period for an engagement’s data is set with each customer. When it ends, Stratelio deletes answers, profiles, generated documents and exchanges, then sends a certificate of deletion. Documents already downloaded fall outside this scope.
Who is responsible for what · In the context of an engagement, the customer (coach, consultant or company) is the data controller. Stratelio acts as a processor within the meaning of Article 28 of the GDPR.
Need the details?
The full note (providers, regions, available evidence) is provided on request, for example for a call for tenders or a review by your IT department.