Penetration tests with every feature.

Every entry point of the feature is tested for each user profile, an outside account and an anonymous visitor. The report records the application's response to each attempt.

Where your data is

01
Hosting
Everything is hosted in France with OVHcloud: your data stays in Europe and is processed in compliance with the GDPR.
02
AI model
You choose your AI provider: in France or in the United States.
03
Sovereignty
A sovereign platform: your applications are hosted in France, and you can also choose an AI provider in France.

What the penetration tests check

Every screen, every read and every action of the feature is tested individually. The report gives the server's answer for each one.

The test relies on the application's real access rules: it tries exactly what the application exposes.

The report details every attempt and the application's answer. It is included in the subscription.

The test runs before each feature is delivered, and again before it goes live.

What protects your data

01
Checks
Every feature goes through automated tests, a code review, a functional acceptance test and a penetration test.
02
Authentication
The application's own sign-in, the account locked after several password attempts, and each account holds the roles it was given.
03
Service continuity
Regular database backups, kept outside the production environment: a version can be restored with its data.
04
Data and AI
The AI model works on fictitious data. Personal data reaches it pseudonymised, and access secrets stay out of its reach.
05
Infrastructure
The application and its database are hosted on an infrastructure kept up to date, with a backup taken before each go-live.
06
Server monitoring
Every few minutes, the platform records the state of each hosted server: memory and disk space used, processor load, and the memory used by every service of the application and its limit. Our team is alerted as soon as memory or disk nears its limit, a service nears its own, or a service or a server needs restarting.
07
Isolation
Each organisation has its own accounts and its own data, reserved for it.
08
Separate website and application
We recommend keeping the website separate from the business application: each has its own system account, its own separate database, its own memory ceiling, its own deliveries and its own penetration tests.
09
Permissions
For each type of data, rules define who may consult and who may modify. The server applies these rules to every operation, for every user.

What data is recorded? Who can access it?

01
An application account
The name, the e-mail address and the role of each person who signs in to an application.
02
The records of an application
Everything the people of an organisation enter in their application is kept in their organisation's database.
03
What they are used for
An application's data is used to run it and to show each person the information they may access.
04
Who reads them
An application's records are reserved for the organisation that owns it. Each person sees what their role and access rights open to them.
05
How long they are kept
An application's records are kept for the whole duration of the subscription, then exported for the organisation and deleted at the end of the agreed period.