Security, compliance and admin

Enterprise SSO (Enterprise plan): OIDC and SAML, compatible with Microsoft Entra ID, Okta, Google, OneLogin, JumpCloud, Ping Identity and ADFS. Configured per workspace, on the company’s verified email domains. Accounts can be created at first login if the workspace allows it. Google sign-in available to everyone.
‍
SCIM 2.0 provisioning (Enterprise plan) : members and their roles sync from the company directory (Microsoft Entra ID, Okta, OneLogin, JumpCloud, SailPoint).• Two-factor authentication: TOTP app (Google Authenticator, Microsoft Authenticator…), single-use backup codes, trusted devices for 30 days. A code that has already been used is rejected. It applies to email and password sign-in; with Google or SSO, the company’s identity provider handles it.

Roles and access: each workspace assigns a role to its members (owner, admin, collaborator, member) and project access is granted project by project. Permissions are checked server-side on every request.

Login protection: login attempts are rate-limited.

REST API (Enterprise plan): token authentication, keys managed by workspace owners and admins, quotas, rate limits, usage log and documentation.

MCP server: compatible with Claude, ChatGPT and Gemini CLI. A connected assistant acts with the permissions of the user who authorized it, within the limits of the permissions granted.• Tokens: stored as a SHA-256 hash, shown only once, when created.

IP address restriction (Enterprise plan): each API and MCP server token can be limited to a list of IP addresses.

Partner apps: access to a workspace only with the approval of an owner or admin, read-only, revocable from the Security tab.






‍

The application and its database are hosted on Amazon Web Services, in the Paris region (eu-west-3).
‍
Traffic goes through Cloudflare, which may process data outside the European Union.
‍
Some processing takes place outside the European Union, mainly in the United States: AI model providers, payment, CRM, messaging. The public list of subprocessors is available on request.
‍
A designated data protection officer (DPO), a data processing agreement (DPA), a record of processing activities and a data retention policy.

Traffic encrypted with TLS.• Passwords stored as bcrypt hashes.• Sensitive secrets (two-factor authentication, SSO, OAuth connections) encrypted with AES-256-GCM.

Each workspace and project is isolated: users only access what has been opened to them.• Activity log (Enterprise plan): exportable workspace log, can be collected by the company’s SIEM with dedicated keys, integrity guaranteed by daily sealing.





‍

Continuous database backups, encrypted before being sent to AWS storage in the European Union.





‍

‍

AI model providers receive the tracked prompts and, depending on the analysis, the collected answers and project information (brand, competitors, website content). Never put confidential information or personal data in a tracked prompt.
‍
DeepSeek is only queried for projects that choose it; it is not enabled by default.•

The website chatbot and the in-app Meteor assistant run through Microsoft (Azure OpenAI service).

ISO/IEC 27001:2022 certification in preparation, targeted for 2027.

Roadmap:
Q4 2026: first security management review, first internal audit, external penetration test, launch of the in-app trust center
2027: ISO/IEC 27001:2022 certification audit (stages 1 and 2)