Hosting in France
Application data and backups hosted by OVHcloud, in France.
Security and trust
Your security gaps are sensitive data. We treat them as such.
Hosting in France, documents kept on your side, two-factor authentication available for every user and proportionate security measures.
A supplier questionnaire to fill in?
Send it to us: we answer it, distinguishing measures in place from planned measures.
Send us your questionnaireOur six commitments
-
01 -
02 Your documents stay with you
Evidence is referenced by link: no file is stored, your source documents stay in the document system you manage.
-
03 Business data only
The platform is not intended for passwords, technical secrets, health data or classified information.
-
04 Proportionate security
Access control, monitoring, backups, logging and incident management.
-
05 Transparency
We always distinguish measures in place from planned measures, including in our answers to your questionnaires.
-
06 Controlled access
Two-factor authentication available for every user; administrator, contributor, reader and consultant roles.
Measures in place
- Communications encrypted over HTTPS
- Passwords hashed with bcrypt
- Multi-factor authentication available to users
- Strengthened authentication for administration tools
- Control of roles and permissions
- Sign-out after a period of inactivity
- Progressive limiting of login attempts
- Firewall and protection against brute-force attacks
- Logging and monitoring
- Off-site backups and integrity checks
- Separation of environments
- Incident management procedures
Backups and continuity
- Backups
- Daily, with 7 and 30-day retention.
- Recovery
- Service restored within 48 to 72 hours.
- Availability
- Monitored continuously on our status page (new tab).
What CompliKey keeps
- Your controls, assessments and maturity levels
- Your findings, remediation, tasks and decisions
- Links to your evidence, with their date
- The history needed for the next review
What CompliKey must not contain
- Your source documents: they stay in your own spaces
- Passwords and technical secrets
- Classified data
If you connect an AI assistant
The CompliKey MCP server lets an AI assistant (Claude, ChatGPT, Copilot) work on your data. The connection uses OAuth2, the assistant acts with your account permissions, its actions are recorded in a dedicated log, and publishing an audit requires your approval.
CompliKey's hosting in France does not cover the data your AI assistant reads: it passes through its provider's service, under that provider's own terms.
The MCP server in detailReversibility
Controls, levels and tasks export to CSV, the statement of applicability and reports to PDF, at any time. After the contract ends, you can still request an export for 30 days; backup copies are deleted no later than 90 days afterwards (terms of sale, article 11).
The GDPR data processing agreement (article 28) is part of the contract; it is sent to you on request. Payment by card or SEPA direct debit.
Subprocessors
| Provider | Purpose |
|---|---|
| OVHcloud | Hosting of data and backups, in France |
| Crisp | Support |
| Stripe | Payment and invoicing |
| Calendly | Demo scheduling |
| HubSpot | Customer relationship management |
A question about our security?
Write to us: we answer precisely, without jargon.