Security
Provisional text, pending legal review. It is not the final version.
Your data and your customers' data are entrusted to us. This page describes what we do to protect them. It only covers measures that are in place.
Hosted in France
Our services are hosted by Scaleway, in France. The e-mails we send you leave through Scaleway, in France. Backups are stored in France too.
Your data stays yours
Each customer account is isolated from the others, at two levels:
- in the application code, which only reads the data of the current account;
- in the database itself, which refuses any read or write outside the current account.
If a mistake slipped into the code, the result would be an empty page, not a leak. Automated tests check this isolation on every code change, background jobs included.
Our team has no tool to enter your account. If you need help, you show us your screen.
Sign-in and accounts
- Two-factor authentication for every account, whatever the plan: authenticator app, passkeys and recovery codes.
- Two-factor authentication can be enforced: an account can require it from all its members.
- Confirmation for sensitive actions: changing a role, exporting data, changing the company sign-in or the billing requires a recent check of the second factor. A password alone is not enough.
- Sign-in with Google or Microsoft, without automatic linking to an existing account based on the e-mail address alone.
- Company sign-in (SSO) with SAML or OpenID Connect, after verification of your domain.
- Internal team: two-factor authentication is mandatory to access our administration tools.
Permissions and API keys
- Each action is allowed or refused by the server, according to the person's role.
- An API key is shown only once. We only keep a fingerprint of it. Its permissions never exceed those of the person who created it, and you can revoke it at any time.
Encryption
- All connections use HTTPS.
- The credentials of your connected tools (your CRMs, for example) are encrypted in our database.
- Backups are encrypted before they leave the server.
Audit log
Important actions are recorded in an audit log: who, what, when, from which address. This log cannot be changed. It is kept three years. You can view it from your account.
Your data, from start to finish
- Full export of your data at any time, protected by two-factor authentication.
- Deletion of your contacts and their responses 30 days after cancellation, after giving you time to export them. Our encrypted backups erase themselves within the following 30 days, about 60 days in all.
Artificial intelligence
Some analyses use an AI: Claude (Anthropic), processed in the European Union. Before anything is sent, we remove e-mail addresses, phone numbers, links, bank details and known names. You can switch AI off for your account.
Integrations
- The webhooks we send you are signed: you can check that they really come from us.
- The widget embedded in your application checks the identity of your users with a signature computed on your server. It sets no cookie.
Errors and monitoring
Technical error reports contain neither the content of requests, nor program variables, nor the identity of users.
Development
Every code change goes through automated checks before it is delivered: tests, check of the isolation between accounts, licence check.
Report a vulnerability
Think you have found a flaw? Please report it to us at security@scaliamo.com. Our vulnerability disclosure policy explains how to do it and what we commit to in return.