Reunion Island · GMT+4

Everything we claim, you can open.

A cybersecurity practice and a software publisher on Reunion Island, working with organisations across the Indian Ocean, Asia and Australia. The product runs in your browser without an account, the research is written up in public, and the pricing is on the page.

Send us one thing. We'll review it.

What we ship

Éclat, and what the server never holds.

Sending a sensitive file to a client, an auditor or a regulator, without the platform in the middle being able to read it.

How Éclat works, and what it costs

  1. Files are encrypted in the browser, then packaged as an MLA archive, an open archive format published by ANSSI, the French national cybersecurity agency.

  2. The server holds ciphertext and nothing else: not the key, not the passphrase, not the file names.

  3. Pricing is published, and a transfer runs end to end without creating an account.

What we are looking into

Two projects, still in the lab.

Neither is a product you can buy today, and neither is announced as coming. The work is written up as it goes on beta.kodetis.com, where every entry carries its own date.

  • ATLAS-AI

    In R&D

    Detecting attacks against language models, agents and MCP servers: injected instructions, context exfiltration, and tool calls that do more than they were asked to.

  • SAINE

    In R&D

    Decontaminating USB media before they reach a workstation, for the sites where a removable drive is still the only way in and out.

The lab, project by project

What we do for organisations

Four areas, and nothing beside them.

The practice stops at four. When a request sits outside them, you get told so rather than a proposal shaped to fit.

What each engagement produces

  1. DevSecOps

    Security placed inside the pipeline rather than beside it: dependency and container scanning, secret handling, build provenance, and the written evidence a customer questionnaire or a CRA file asks for.

  2. Security project management

    Taking a funded security programme that is starting or drifting and bringing it to the end: migration, subsidiary integration, ERP rebuild, exit from an incumbent provider.

  3. AI security

    Reviewing what an LLM, an agent or an MCP server can reach once it is wired to internal data, and writing down what an attacker reaches through the same path.

  4. Delegated CISO

    The security function held without the full-time post: governance, gap measured against a published framework, vendor security questionnaires, audit preparation, tabletop exercises.

Who you contract with, and when we are at our desks.

Legal entity
A French company registered on Reunion Island, a French department and an outermost region of the European Union.
Governing law
French law, under European Union regulation.
Invoicing
In euros, under EU VAT rules.
Working day
GMT+4. The same day as Mauritius and the Seychelles, one hour from Madagascar and the Comoros, and 09:00 here is 15:00 in Sydney.
Languages
French and English. Deliverables are written in whichever one you pick.

Send us one thing. We'll review it.

A pipeline definition, an architecture diagram, an LLM or MCP integration, or the vendor security questionnaire you are stuck on. Something you already own, so there is nothing to prepare: we read it and write back what we found and what we would do, in the format of a real deliverable.

Write to us

contact(@)kodetis(.)com