Security
Security and data protection
A tool that checks your third parties should be open to checks too. Here is what we do with your data, as the service works today.
Hosting in France
The data is hosted in France, on ARDNTECH servers in the Ardennes and at OVHcloud in Roubaix, with a backup at OVHcloud in Paris. It is encrypted on our servers and backed up every day: each daily backup is kept for a week, then one backup per week is kept for a month. It is never sold or cross-used for other purposes.
Access to your account
- Your password is never stored in clear: only its hash (argon2id) is.
- Two-factor authentication with a code received by e-mail, on from the moment the account is created; from your settings you can switch to an authenticator app, remove it (password required) and get single-use backup codes, stored as hashes and shown only once.
- Logging out closes the whole session, second factor included: the next login asks for the password and then the second factor again.
Exchanges and integrations
- The site is served over HTTPS only, which browsers are required to use (HSTS).
- API tokens are stored only as hashes. Webhooks are signed (HMAC-SHA256), and their signing secret is encrypted in the database.
- Payment goes through Stancer's hosted page: no card data passes through or is stored by TierSafe.
Traceability
- Sensitive actions (enabling or removing two-factor authentication, administration actions) are written to a separate audit log, kept for 30 days.
- The site access log is kept for 90 days, without session cookies, authentication headers or the tokens of links sent by e-mail.
Sub-processors
Three sub-processors only, whose data stays within the European Union:
- OVHcloud: hosting of part of the service and backup;
- Brevo: sending of e-mails and alert text messages;
- Stancer: collection of payments.
The data, retention periods and your rights are detailed in the privacy policy.
Every release checked
Before reaching production, every release passes its automated tests, a static analysis of the code, a search for secrets left in the code and a search for known vulnerabilities in the dependencies and images that run the service. These services run without administrator rights.
Data processing agreement
A data processing agreement under Article 28 of the GDPR is available on request. A security question, or a vulnerability to report? Write to us.