Trust is not declared. It is verified.
This page contains only mechanisms present in the code or the infrastructure, with their real values, and a verification date. When something does not exist yet — a certification, a public sandbox — we write that too. The rest of the site sells; this page describes.
AES-256-GCM at rest, TLS in transit
Sensitive data — documents, identities, assessment elements, report contents — live in columns encrypted with AES-256-GCM (the schema's _enc columns). All surfaces are served over TLS.
One firm, one tenant — enforced by the database, not the code
Each firm is isolated through PostgreSQL Row Level Security in forced mode, ancillary tables included: the database refuses to serve another firm's row, even to faulty application code. The network cockpit aggregates indicators; no suspicious activity report ever appears on a shared surface (art. L.561-18 of the French CMF).
A chained register, anchored with a third party, verifiable without us
Each file keeps a SHA-256 chained integrity register; the roots are anchored with a third-party timestamping authority (RFC 3161 protocol). The verifiers are published and work offline, without a Vigilae account: an inspector — or a competitor — can recompute the chain from /verif/. The evidence does not depend on the subscription.
TOTP, demanding passwords, epoch-based sessions
The TOTP second factor is available on every account and can be made mandatory for an entire firm. Passwords are 12 characters minimum, with an entropy check — twelve times the same letter does not pass. Sessions are epoch-based: a logout or a reset immediately invalidates every token issued before it, on every device.
Strict CSP wherever personal data lives
Surfaces that display personal data are served with a strict Content Security Policy — no inline script, no third-party origin, no audience measurement. The public site is measured without cookies.
Encrypted, 3-2-1, restoration tested every week
Encrypted restic backups, following the 3-2-1 rule: three copies, two media, one off-site. An automated restoration drill runs every week — a backup that has never been restored is only a hope. Published retention: dailies kept 90 days, weeklies 52 weeks; data erased from the database therefore disappears from all backups at most 12 months after erasure — the period we indicate under our data processing agreement. Secrets are escrowed in repositories separate from the data.
Enabled here since 5 September 2026, declared residency, boot-time guard
On this service, AI assistance is enabled: the model is Claude, from Anthropic, running on Google Cloud (Vertex AI) in region europe-west1. It receives the content of the documents submitted for extraction and the text of the questions put to the copilot; that data is not used to train any model, and prompts are kept for sixty days at most, for the sole purpose of abuse detection. Nothing leaves without an explicitly set lock — in a fresh installation, AI perception is inert, and everything else, screening, risk rating, register, runs without it, on deterministic engines. Two controls keep this page honest: a boot-time guard refuses to start the server if the effective provider or region differs from the declaration, and a deployment check refuses the release if the list of processors does not follow what is actually enabled. The detail: AI usage policy.
This list is produced from the service's actual configuration.
OVH SAS (hosting, France); Hetzner Online GmbH (backups, Germany); OVH SAS (backups, France); Google Cloud (AI assistance — Anthropic's Claude model, European Union); Stripe Payments Europe, Ltd. (subscription payments, Ireland); HubSpot Ireland Ltd (public site forms, Ireland); Brevo (transactional e-mail, France); OVH SAS (supporting document storage, France); Google Ireland Ltd (website analytics, Ireland). The full list — purposes, data, safeguards — is generated from the service's configuration: /sous-traitants/. A provider not on it processes nothing for us. Screening itself runs locally: no client name is ever sent to a data vendor.
A report read by the people who run the service
Think you found a flaw? Write to contact@vigilae.org with "Security" in the subject: the message reaches the team operating the platform directly. Describe what you observed without exploiting the vulnerability beyond the demonstration and without accessing data that is not yours; we acknowledge, fix, and keep you informed of the outcome. A dedicated address will be published here when it exists — not before.
No certification claimed — because none is held
You will find neither logo nor certification acronym here: we hold none to date, and displaying one would be a lie. Our procedures — logging, tested backups, security reviews, processing records — are built to be auditable by a third party; the day a certification is obtained, it will appear here with its exact scope and date. Until then, the mechanisms above can be verified without a badge.
Verified on 20 August 2026, against the code and the declared production configuration. This page is updated when the mechanisms change — not on a fixed schedule. No tool can guarantee total compliance or the absence of incidents; what we can do is show you where to look.