Penetration tests with every feature.
Every entry point of the feature is tested for each user profile, an outside account and an anonymous visitor. The report records the application's response to each attempt.
Where your data is
- 01
Hosting
Everything is hosted in France with OVHcloud: your data stays in Europe and is processed in compliance with the GDPR.
- 02
AI model
You choose your AI provider: in France or in the United States.
- 03
Sovereignty
A sovereign no-code platform: your applications are hosted in France, and you can also choose an AI provider in France.
What the penetration tests check
Every screen, every read and every action of the feature is tested individually. The report states whether the server refused access.
The test relies on the application's real access rules, not on a simulation: it tests exactly what an attacker would reach.
The report details every attempt, refused or allowed. It is included in the subscription.
The test runs before each feature is delivered, and again before it goes live.
What protects your data
- 01
Checks
every feature goes through automated tests, a code review, a functional acceptance test and a penetration test.
- 02
Authentication
The application's own sign-in, lockout after repeated failed attempts, and each account holds only the roles it was given.
- 03
Service continuity
Regular database backups, kept outside the production environment: a version can be restored with its data.
- 04
Data and AI
The AI model works on fictitious data. Personal data reaches it pseudonymised, and access secrets stay out of its reach.
- 05
Infrastructure
The application and its database are hosted on an infrastructure kept up to date, with a backup taken before each go-live.
- 06
Server monitoring
Every few minutes, the platform records the state of each hosted server: memory and disk space used, processor load, and the memory used and limit of every service in the application. Our team is alerted if memory runs low, if the disk fills up, if a service approaches its limit or stops, or if the server stops responding.
- 07
Isolation
Each organisation has its own accounts and its own data, out of reach of the others.
- 08
A website apart from the application
We recommend keeping the website separate from the business application: each has its own system account, its own separate database, its own memory ceiling, its own deliveries and its own penetration tests.
- 09
Permissions
For each type of data, rules define who may consult and who may modify. The server refuses any unauthorised operation, whatever the user.
What data is recorded? Who can access it?
- 01
An application account
The name, the e-mail address and the role of each person who signs in to an application.
- 02
The records of an application
Everything the people of an organisation enter in their application is kept in their organisation's database.
- 03
What they are used for
An application's data serves to run it, and to present to each person the information they are allowed to access.
- 04
Who reads them
Who reads them? An application's records are accessible to the organisation that owns it. Each person sees only what their role and access rights allow. The data remains inaccessible to other organisations.
- 05
How long they are kept
An application's records are kept for the whole duration of the subscription, then exported for the organisation and deleted at the end of the agreed period.