Trust & compliance
Your data security, by default
Protect your digital platform with a sovereign infrastructure, strictly controlled access and cutting-edge cybersecurity expertise.
01 Stance
Uncompromising security, wherever the work happens
02 Framework
The 4 main pillars of our security framework
Infrastructure 100% hosted in France
Our infrastructure and the environments we operate are hosted on servers located in France. The entity holding the hosting contract is OVH Tunisie, whose servers are located on French territory. This approach guarantees strict compliance with European regulations (GDPR) and gives you complete digital sovereignty.
Managed with the backing of RDMC’s expertise
For the management and protection of our technical infrastructure, we rely on the expertise of our French partner RDMC, a recognised specialist in cybersecurity and managed IT services. RDMC manages our entire server estate, carries out security audits and watches over our defensive posture.
Absolute isolation of environments (Dev / Prod)
Your real production data is completely sealed off. Our development teams only have access to isolated development and staging environments containing anonymised or test data. No developer has direct access to the production databases.
100% automated deployment chain (CI/CD)
To eliminate the risk of human error and unauthorised access to servers, our entire continuous integration and deployment chain is automated. Releases to production go through automated test and security-check pipelines, with no direct manual intervention on the servers.
03 Commitments
Our security commitments in detail
Security by default (Security by Design)
Security is not an option added at the end of a project; it is built in from the first line of code.
- Architecture analysis and threat modelling before every project.
- Attack surfaces and entry points reduced to the strict minimum.
- Automated vulnerability testing during the code build.
Strong multi-factor authentication (MFA)
Access to our internal tools and code repositories is subject to reinforced authentication policies.
- Mandatory use of MFA through physical security keys (FIDO2 / WebAuthn) or secure authenticator apps for all employees.
- Automatic removal of access as soon as an assignment or project ends.
Granular access rights management (RBAC)
We apply the principle of least privilege.
- Each person has only the access strictly necessary to carry out their task on their project.
- Regular review of permissions and full traceability (access and audit logs) of all actions carried out on our tools.
Proactive protection and continuous monitoring
With RDMC’s support, we proactively protect your applications against common risks and attacks.
- Next-generation web application firewall (WAF) and DDoS protection.
- Automatic detection of SQL injection and XSS attempts and OWASP Top 10 vulnerabilities.
- Regular security scans and patches on software dependencies and CMS.
Transparency & continuous improvement
Traceability & reports: when needed, or during audits, we provide full visibility of our protection policies and measures.
- Incident management: if a vulnerability is detected, we apply a protocol of rapid resolution and transparent communication.
- Regular audits: our procedures and infrastructure undergo regular reviews and audits managed by RDMC’s cybersecurity team.