Designed for the security questionnaire
We're a French company selling to teams with real compliance obligations. The platform is built deny-by-default, audited, and aligned with GDPR and the NIS2 directive - not as a retrofit, but from the foundations.
This page is the short version. A signed DPA, our sub-processor list and a full security questionnaire are available under NDA - ask sales.
Tenant isolation
- Every organization is a hard boundary, enforced in the application on every request
- Org context is carried end to end, so cross-tenant access fails closed
- Isolated egress so one tenant's activity never affects another's reputation
- Database-level row security planned as an additional backstop
Identity & access
- OIDC/SSO login with MFA where applicable
- Deny-by-default RBAC with separation of duties for platform staff
- API keys hashed at rest, with lifecycle management and rotation
- Every sensitive action is attributable to an identity
Data protection & privacy
- EU-only data residency, hosted in France
- Encryption in transit and at rest; secrets centralized and access-audited
- GDPR DSAR workflows - export, delete, anonymize
- Configurable retention, legal hold and scheduled purge for artifacts
Edge & network
- TLS policy with HSTS and strict security headers
- Rate limiting and IP allow/deny, per organization and per API key
- Edge WAF (OWASP CRS baseline) and expanded abuse detection on the roadmap
Observability & response
- Metrics, centralized logs, distributed traces and error monitoring
- Security events emitted for auth failures, admin anomalies and abuse patterns
- Backups with documented restore procedures
- SIEM/IDS pipeline and formal incident runbooks on the roadmap
Audit & governance
- Immutable-style audit logs (who, what, when, where) for sensitive actions
- Audit log export on Business and Enterprise
- SBOM per release and dependency scanning as we harden the CI/CD supply chain
- NIS2 used as the benchmark for controls, monitoring and operational readiness