AI transparency
Draft under review by our counsel. It may still change.
QoBot is an AI agent. This page says which models it runs on, what it does, and where you keep control. It exists in French and English; the French version prevails in case of difference.
You’re talking to an AI
QoBot is an AI system, and it says so: it presents itself as an AI CISO, never as a person. The people behind it are the Qontrol team, listed on our About page.
The waitlist chat on this site is a scripted conversation: fixed questions and answers written by our team, with no AI model behind it.
Which models
QoBot doesn’t have its own model. It uses a general-purpose model from the provider you choose. By default, as of the date of this page:
| How QoBot reaches the model | Provider | Default model |
|---|---|---|
| Your Claude subscription (“Sign in with Claude”) | Anthropic | Claude Opus 5.5 |
| Your Anthropic API key | Anthropic | Claude Opus 5.5 |
| QoBot credits, through our server | Anthropic | Claude Opus 5.5 |
| Your OpenAI API key | OpenAI | GPT-5 |
| Your Mistral API key | Mistral AI | Mistral Medium (latest) |
We update this table when the defaults change. Your provider’s terms decide what it may do with your requests; with an API key, check its data settings, and with a Claude subscription, those of your Claude account.
We don’t train AI models. We don’t use your workspace or your requests to train or fine-tune any model.
What QoBot does
QoBot does the work of a CISO for your organization, based on what you tell it and on the security know-how our team writes and reviews:
- it interviews you to understand your organization, and keeps that context in your workspace;
- it prioritizes risks and builds an action plan, with owners and next steps;
- it drafts policies, procedures and answers to security questionnaires;
- it follows up, reminds, and tells you what is still open.
What it doesn’t do
- It doesn’t guarantee security or compliance, and its output isn’t legal advice, an audit or a certification.
- It doesn’t act on your systems on its own: anything with an effect outside the app (sending, network access, deleting files) waits for your approval.
- It doesn’t follow instructions hidden in the documents it reads (a questionnaire, a web page) without asking you.
- It doesn’t attack or test systems you aren’t authorized to test (Acceptable use policy).
People stay in control
QoBot takes on the CISO’s work; your team still decides and applies. Every document it writes is a draft you can read, change and approve before it’s used or sent. Its work and its history stay in your workspace, so you can see what it did and why. AI models make mistakes: check what matters before relying on it.
The EU AI Act
QoBot is built on general-purpose AI models whose providers carry the duties the EU AI Act sets for those models. As the provider of QoBot, we:
- tell you clearly that you’re interacting with an AI system, as the AI Act’s transparency rules (article 50) require;
- describe here what QoBot does, its limits and the human oversight around it;
- keep our team trained on how these systems work and fail.
Our assessment is that QoBot, which assists organizations with their security governance, isn’t one of the high-risk uses listed by the AI Act. We’ll review this if QoBot’s uses change.
Questions
Write to hello@qobot.io. For data protection questions, see the Privacy policy.