Most tools that claim European hosting send your content to an American AI model the moment you click a "generate" button. Here, both halves of the chain fall under European law.
This page describes measures that are in place, not a certification. The distinction is made explicitly further down.
A public-sector or enterprise buyer asks both questions. Here are both answers.
Server infrastructure located in France. Manifst commits to hosting and processing your data within the European Union. Where a processor established outside the EU is used, appropriate safeguards are put in place, including the European Commission's standard contractual clauses.
Your data is never sold to third parties. It is only passed to the processors strictly necessary to deliver the service, all bound by a GDPR-compliant data processing agreement.
The model provider is Mistral AI, a French company established in the European Union. Content you submit to assistance features (a ticket description, a meeting transcript, a document dropped into Launchpad) is transmitted solely to produce the requested result.
No AI feature fires on its own. Every call starts from an explicit action, and the credit cost is announced beforehand. The free plan calls no model at all until you buy credits.
Stated plainly, so it can be copied straight into a security questionnaire. Each line corresponds to a mechanism present in the product.
HttpOnly, and Secure over HTTPSStrict-Transport-Security header set for one yearA vendor who makes leaving hard is telling you what they think of their own product. The question is worth asking before signing, not after.
At Manifst the paths in and out are symmetric, documented, and usable without going through support.
Read the API documentationA security page that only says good things is not a security page. Here are the four lines where the answer is no.
Neither ISO 27001, nor SOC 2, nor a publishable penetration test report. This page describes measures that are implemented, which is different information from an attestation issued by an independent third party. We do not present one as the other.
Single sign-on runs on OAuth 2.0 with Google and Microsoft. SAML federation and automated SCIM provisioning are not implemented. If your requirements mandate them, today the answer is no.
There is no second factor by authenticator app or one-time code on Manifst accounts yet. Signing in through Google or Microsoft lets you rely on the second factor already enforced by your identity provider.
Manifst is an online service. There is no self-hosted build and no on-site installation, and therefore no scenario where the data stays inside your own information system.
On server infrastructure located in France. Manifst commits to hosting and processing data within the European Union. Where a processor established outside the EU is used, appropriate safeguards are put in place, including standard contractual clauses.
Mistral AI, a French company established in the European Union. Content submitted to assistance features is transmitted solely to produce the requested result, under a GDPR-compliant data processing agreement. Hosting and AI both fall under European law. Details are in our privacy policy.
No. The single sign-on available relies on OAuth 2.0 with Google and Microsoft. SAML federation and SCIM provisioning are not implemented today and must not be assumed in a requirements document.
Yes. A project backlog exports to CSV from the project settings, and the REST API v1 gives programmatic access to projects, epics, tickets, sprints, logged time and financial indicators. No request to support is required.
No. Manifst claims neither ISO 27001 certification, nor a SOC 2 attestation, nor a publishable penetration test report. This page describes technical measures that are implemented, which is different information from a certification issued by a third party.
Write to contact@manifst.net describing the problem and the steps to reproduce it. Reports are handled as a priority, and we commit to taking no action against anyone reporting in good faith and without exfiltrating data.
Write to contact@manifst.net. Reply within 48 hours, including on the lines where the answer is no.