Trust is not declared. It is verified.
This page contains only mechanisms present in the code or the infrastructure, with their real values, and a verification date. When something does not exist yet — a certification, a public sandbox — we write that too. The rest of the site sells; this page describes.
AES-256-GCM at rest, TLS in transit
Sensitive data — documents, identities, assessment elements, report contents — live in columns encrypted with AES-256-GCM (the schema's _enc columns). The vault key never leaves the server; its escrow is kept offline, precisely so that restoration remains possible and crypto-erasure does too. All surfaces are served over TLS.
One firm, one tenant — enforced by the database, not the code
Each firm is isolated through PostgreSQL Row Level Security in forced mode, ancillary tables included: the database refuses to serve another firm's row, even to faulty application code. The network cockpit aggregates indicators; no suspicious activity report ever appears on a shared surface (art. L.561-18 of the French CMF).
A chained register, anchored with a third party, verifiable without us
Each file keeps a SHA-256 chained integrity register; the roots are anchored with a third-party timestamping authority (RFC 3161 protocol). The verifiers are published and work offline, without a Vigilae account: an inspector — or a competitor — can recompute the chain from /verif/. The evidence does not depend on the subscription.
TOTP, demanding passwords, epoch-based sessions
The TOTP second factor is available on every account and can be made mandatory for an entire firm. Passwords are 12 characters minimum, with an entropy check — twelve times the same letter does not pass. Sessions are epoch-based: a logout or a reset immediately invalidates every token issued before it, on every device.
Strict CSP wherever personal data lives
Surfaces that display personal data are served with a strict Content Security Policy — no inline script, no third-party origin, no audience measurement. The public site is measured without cookies. The Connect API exposes only neutral surfaces, documented in the developer section.
Encrypted, 3-2-1, restoration tested every week
Encrypted restic backups, following the 3-2-1 rule: three copies, two media, one off-site. An automated restoration drill runs every week — a backup that has never been restored is only a hope. Published retention: dailies kept 90 days, weeklies 52 weeks; data erased from the database therefore disappears from all backups at most 12 months after erasure — the period written into our data processing agreement. Secrets are escrowed in repositories separate from the data.
Inert by default, declared residency, boot-time guard
No content goes to an AI model without an explicitly set lock: by default, AI perception is inert and everything else — screening, risk rating, register — runs without it, on deterministic engines. When it is enabled, residency is declared (Vertex AI, region europe-west1) and a boot-time guard refuses to start the server if the effective provider or region differs from the declaration: the page you are reading cannot lie by omission. The detail: AI usage policy.
Four today, listed from the real configuration
Hetzner Online GmbH (hosting, Germany); Google Cloud (Vertex AI) — modèle Claude d'Anthropic (AI perception when enabled, European Union); Brevo (transactional e-mail, France); HubSpot Ireland Ltd (public site forms, Ireland). The full list — purposes, data, safeguards — is generated from the service's configuration: /sous-traitants/. A provider not on it processes nothing for us. Screening itself runs locally: no client name is ever sent to a data vendor.
A report read by the people who run the service
Think you found a flaw? Write to contact@vigilae.org with "Security" in the subject: the message reaches the team operating the platform directly. Describe what you observed without exploiting the vulnerability beyond the demonstration and without accessing data that is not yours; we acknowledge, fix, and keep you informed of the outcome. A dedicated address will be published here when it exists — not before.
No certification claimed — because none is held
You will find neither logo nor certification acronym here: we hold none to date, and displaying one would be a lie. Our procedures — logging, tested backups, security reviews, processing records — are built to be auditable by a third party; the day a certification is obtained, it will appear here with its exact scope and date. Until then, the mechanisms above can be verified without a badge.
Verified on 20 August 2026, against the code and the declared production configuration. This page is updated when the mechanisms change — not on a fixed schedule. No tool can guarantee total compliance or the absence of incidents; what we can do is show you where to look.