Twice honored for our security measures!

Complying with the General Data Protection Regulation is essential for a platform like Witco. Beyond the legal requirements, these fundamental principles of information security and data privacy serve as a shield to protect the rights and freedoms related to personal data.

We inform our users and obtain their explicit consent for data collection. Each individual retains the right to access their personal information, the right to have it rectified, and the right to be forgotten.

To ensure a high level of information security, each of our employees has access only to the strictly necessary resources required to perform their duties. These restrictions apply not only to physical access but also to virtual resources and data.

Additionally, our employees and subcontractors commit, by signing a confidentiality clause, not to disclose any data or information related to the projects they are involved in.

A thorough risk analysis is conducted annually and systematically presented during ISO 27001 audits. Our cybersecurity performance was notably recognized as mature in 2024, achieving a score of 907/1000 during our Cybervadis certification.

For both safer and faster access, our platform is integrated with the most commonly used SSO protocols (SAML, OIDC, etc.) that enable true single sign-on authentication. If your company chooses to use email accounts as reference identifiers, then a simple click will allow employees to log in to the Witco platform via the single sign-on system.

From the design phase onward, we apply digital security best practices to prevent intrusions and limit vulnerabilities in information systems. Our application is "secure by design", meaning that security concerns are incorporated into the functional specifications and security features are included in the technical specifications.

Our Chief Information Security Officer (CISO) is responsible for training employees and ensuring they adhere to the established security rules. He conducts annual awareness campaigns for teams about cybercrime and provides regular reminders regarding phishing risks.

Our platform undergoes periodic penetration testing to assess its ability to withstand attacks from cybercriminals attempting to gain access to our system. These security control operations aim to identify potential vulnerabilities that may arise from hardware flaws, inappropriate software configurations, or operational weaknesses in processes, among other factors.

Our data is hosted in France, as is our Witco platform, which is supported by our cloud solution providers. Their France-based data centers are leaders in IT reliability and security.

These data centers are equipped with the most advanced security solutions on the market, including firewalls and anti-DDoS systems. We thus guarantee our customers optimal protection of their data.

On a daily basis, the data on our platform is backed up and encrypted to ensure its restoration in a timely manner in the event of a major incident, and to prevent any data loss.

The record of processing activities provides a comprehensive view of our activities involving personal data: stakeholders, categories of data processed, use of this data, individuals who have access to it, retention periods for personal data, and security methods. Everything is documented.

We maintain a knowledge base that is available to authorized personnel, which includes our policy and procedure for security incident management, as well as our crisis management procedure. This comprehensive information regarding incident resolution is intended to optimize the effectiveness of our teams in addressing recurring issues.

Executable log files record user business activities (application traces), technical interventions, anomalies, and security-related events (technical or "system" traces). The retention period is limited, and the system’s proper functioning  is regularly checked.