Security Measures

1. Data hosting and access

The servers used by the Service Provider are hosted on servers located in France.  Our subcontractor's services provide multiple levels of replication and security to ensure maximum availability and a strong guarantee of data protection.

This includes:

• Redundant servers for API and Web interface
• Encrypted database passwords
• Operating systems used on servers regularly updated with the latest security updates
• External service monitoring via dedicated tools
• Data encryption with TLS for the public part of the Solution (accessible from the Internet)
• Identity management provided by the cloud provider
• Virtual private link between our instances and applications via network firewall
• Storage encryption

Access to source code and personal data is restricted to the Service Provider's employees or partners who need it for the operation, development or monitoring of the Service Provider's services. These persons are contractually bound to respect the confidentiality of such data, and are subject to disciplinary action should confidentiality be breached.

All accounts are nominative with traceability of access and actions.

The Service Provider’s services are periodically updated with the latest security patches available.

2. Other organizational and technical measures implemented by the Service Provider

Organizational

• Authorization management
• Access logging
• Subcontracting agreement
• DPA
• Management of security incidents and data breaches
• Personnel management
• Risk management
• Maintenance  

Physical

• Access control systems
• Badge readers (NFC)
• Means of identification
• Surveillance by an individual
• Video surveillance  

Techniques

• SSO - LDAP authentication
• Storage encryption
• Data partitioning
• Https
• Strong password
• Supervision

Sub-processors of the Service Provider as at the date hereof