Who processes your data, what for, and from where.
Before entrusting due diligence files to a tool, you have the right to know exactly who handles them. This page is generated from the actual configuration of the service: a provider that does not appear here processes nothing for us.
Score out of 100 in 2 minutes · No credit card · No commitment
Vigilae, in 55 seconds.
From a scattered file to a sealed registry: the AI perceives, the engine classifies, you decide, the evidence is sealed.
55 seconds · French voiceover · subtitles available · sound on
Our processors, in full.
Each line states what the provider does, which data it sees, where it processes them and under what safeguards. Nothing more, nothing less.
| Provider | Purpose | Data concerned | Location | Safeguards |
|---|---|---|---|---|
| OVH SAS | Hosting of the application servers and of the database. | All service data, encrypted at rest. | France European Union | Processing carried out solely on facilities located in the European Union. No transfer outside the EU. |
| Hetzner Online GmbH | Retention of an encrypted backup copy in a country other than the one where the service is operated, in order to allow restoration after an outage, accidental destruction or a cyberattack. | Service database and supporting documents submitted by the firms' clients. | Germany European Union | Backups are encrypted before transmission and kept encrypted; the decryption key remains on the servers operated by Vigilae and is not disclosed to Hetzner Online GmbH. |
| Google Cloud (Vertex AI) — modèle Claude d'Anthropic | Assisted extraction of supporting documents and documentary copilot, where the firm has enabled the function. | Content of the documents submitted for extraction and text of the questions put to the copilot. | European Union European Union | europe-west1 region. The model runs within the Vertex AI infrastructure; the data is not used to train any model. Prompts and responses are retained for no more than sixty days, solely for the purpose of abuse detection, and are then deleted. |
| Stripe Payments Europe, Ltd. | Collection of subscription payments and management of payment methods. | Billing address and payment identifiers. Vigilae stores no card number. | Ireland European Union | European entity of the provider; card data processed by it alone. |
| HubSpot Ireland Ltd | Recording and follow-up of requests sent through the site's public forms (online audit, demo). | Requester's e-mail address, declared audit result and context of the request. No client file data. | Ireland European Union | Data hosted in the European Union (HubSpot's European environment); data processing agreement compliant with article 28 GDPR. |
| Brevo (Sendinblue SAS) | Delivery of transactional e-mails: request for documents from the client, audit report, digest and reminders. | Recipient's address and name, subject and content of the message, attachments (up to 6 MB). | France European Union | Provider established in France; no due diligence file data is attached to the message, apart from a document expressly exported by the professional. |
| OVH SAS — stockage objet | Retention of the supporting documents in the due diligence files for the statutory period of five years. | Documents submitted by the professional or by their client: identity, home address, proof of source of funds. | France European Union | Documents encrypted before deposit; the decryption key does not leave the servers operated by Vigilae. Versioning on the container is suspended, so that deletion at the end of the five years genuinely erases the documents. |
| Google Ireland Ltd (Google Analytics 4) | Audience measurement of the public pages of the marketing site, after the visitor's explicit consent. | Pages viewed and browsing data of the visitor to the public site. No due diligence file data, no application content. | Ireland European Union | Tracker subject to prior consent: nothing is measured until the banner has been accepted, refusal being the default state. The cookieless audience measurement also in use is self-hosted. |
The core of the service never leaves our servers.
It is the most concrete difference between two compliance tools: the one that sends your client names to a data vendor, and the one that does not.
- Screening against sanctions, asset freezes and politically exposed persons. The official lists (European Union, United Nations, French Directorate General of the Treasury) are downloaded onto our servers, and the comparison is performed locally. No client name is sent to a third party to be screened.
- Risk rating, beneficial owner computation, evidence registry. Deterministic engines running on our servers. No external call, no artificial intelligence.
The contract that goes with it.
A processing agreement within the meaning of article 28 GDPR is made available to you. It sets out the documented instructions, the duration, the security measures and the fate of the data at the end of the contract.
Read the data processing agreement
Any recourse to a new processor is notified to you before it goes into service, in accordance with article 28(2) of the Regulation. This page is updated at the same moment.
A question about a specific processing operation?
Write to us: we answer with the technical detail, not with a formula.
No credit card · No commitment · Guided onboarding
Vigilae assists the professional with their AML/CFT obligations. The tool perceives, structures, screens and documents; the professional remains the sole decision-maker and the sole party reporting to the FIU.