Privacy policy
We collect as little personal data as the service needs, keep it for a limited time, and never sell or share it for marketing.
Last updated 2026-09-24
1. Who is responsible
The data controller is [Raison sociale] (Portolan Sec), [Adresse du siège social, code postal, ville], France, registered under [RCS Ville 000 000 000]. For any question about your personal data, write to [privacy@domaine.fr]. We have not appointed a data protection officer, as this is not required for our activity; requests are handled directly by the company's director.
2. What we process, why, and for how long
This policy applies to the website and to the client portal, under the General Data Protection Regulation (EU 2016/679, "GDPR") and the French loi Informatique et Libertés of 6 January 1978.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering the contact form and preparing a proposal | Name, work email, company, topic, message, IP address | Steps taken at your request before a contract (art. 6.1.b); our legitimate interest in following up (art. 6.1.f) | 3 years after the message, then deleted |
| Client portal account | Email, name, organisation, role, a hash of a key derived from your password (never the password itself), your public key and your password-encrypted private key, the encrypted two-factor secret, sign-in and API token dates | Performance of the contract with your organisation (art. 6.1.b); our legitimate interest in securing access (art. 6.1.f) | While the account is used. After 12 months without sign-in or API use you receive a warning email; the account is deleted after 18 months of inactivity (at least 30 days after the warning). You can delete it yourself at any time. |
| Engagements: findings and their screenshots, comments, risk decisions, reports | Names of the people who commented or decided, and what they wrote | Performance of the contract (art. 6.1.b) | Until the end of the retention period of the engagement: by default 12 months after the report is delivered, unless the contract sets another period. Everyone concerned is warned 30 days before deletion. |
| Exchanging files | Encrypted file contents and names (readable only by your organisation's members and Portolan Sec), size, uploader, dates | Performance of the contract (art. 6.1.b) | 30 days by default, then deleted from disk and database |
| Notifications | Notification titles, read and email dates, your email preferences | Performance of the contract (art. 6.1.b) | 6 months |
| Security of the service | Audit log of sign-ins, failed sign-ins, downloads and changes (action, date, IP address); portal sessions | Our legitimate interest in detecting and investigating abuse (art. 6.1.f) | Audit log: 12 months. Sessions: 12 hours at most. |
Invoices and contracts are kept separately for the periods required by French commercial and tax law (10 years for accounting documents).
3. End-to-end encryption and AI-assisted analysis
Files are encrypted in your browser for the people allowed to read them before they are uploaded; the server only stores ciphertext. Finding texts and their screenshots are not end-to-end encrypted, so that reports can be generated — see Security & privacy. When code you send us is analysed with the help of a language model, the model runs on hardware operated by Portolan Sec or, only for an engagement where this has been agreed, on a dedicated virtual machine rented from OVHcloud in the European Union. That machine is created for the analysis, runs the model itself and is deleted when the analysis ends. In both cases your code is not sent to third-party AI services, and it is not used to train any model. The report of an engagement can state when, where and with which model its code was analysed.
4. Who receives your data
Only Portolan Sec and, within the portal, the members of your organisation. We use the following processors, bound by data processing agreements under article 28 GDPR:
- Hosting: [Nom de l’hébergeur] ([Adresse de l’hébergeur]).
- Temporary analysis machines, for the engagements where they have been agreed: OVHcloud (OVH SAS, 2 rue Kellermann, 59100 Roubaix, France).
- Transactional email: our email provider. Portal notifications never contain engagement details; the one exception is the certificate attesting that an engagement's files were destroyed, sent as an attachment to the members of your organisation.
Data is hosted in the European Union and is not transferred outside it. We never sell personal data or use it for advertising. Data may be disclosed to authorities only when French law requires it.
5. Cookies and local storage
The website sets no cookie. Signing in to the portal sets a single session cookie (__Host-ps_session, 12
hours at most), and the browser keeps your non-extractable private key in IndexedDB and the fingerprints of your
colleagues' keys in local storage. These are strictly necessary for the service you ask for and are therefore exempt
from consent (article 82 of the loi Informatique et Libertés). There is no analytics, advertising or third-party
content; fonts are served by this website.
6. Your rights
You have the right to:
- access your data and receive a copy in a portable format — the portal's Account › Download my data does it instantly;
- have it rectified;
- have it erased — customers can delete their account from Account › Delete my account;
- restrict or object to processing based on our legitimate interest;
- give instructions on what happens to your data after your death (article 85 of the loi Informatique et Libertés).
For anything else, write to [privacy@domaine.fr]. We answer within one month and may ask for proof of identity if we cannot otherwise verify that the request comes from you. You can also lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr).
7. Security
Access is by invitation only and validated by us; passwords never leave your browser; two-factor authentication is available to every user; all traffic is encrypted. Details are on the Security & privacy page. If we suffer a personal data breach likely to affect you, we notify the CNIL within 72 hours and inform you without undue delay.
8. No automated decisions
We make no decision producing legal or similarly significant effects based solely on automated processing.
9. Changes
We will update this page when our processing changes, and tell portal users about significant changes by notification.