Skip to content
Security

Four independent layers. No shortcuts.

If one layer falls, the others hold. This is what is called defence in depth — and it is what lets us pass a major-group security audit without compromising the experience for field reps.

DEFENCE IN DEPTH · 4 INDEPENDENT LAYERS LAYER 1 · TRANSPORT HTTPS · Rate limits · Allowed origins LAYER 2 · AUTHENTICATION Secure PIN · Short sessions · Two-factor LAYER 3 · APPLICATION Permission checks · Audit trail · AI in safe mode LAYER 4 · DATA Database isolation · Encryption · Backups CORE Client data
Transport
Authentication
Application
Data
What you need to remember

Two readings, one single architecture.

You buy a tool for your field team. Your IT team validates it for security. This page speaks to both moments — business first, technical second.

Business view
You sign with peace of mind
  • Your data stays in Europe. Databases, files and AI run on European servers. No data ever leaves the EU.
  • Your brands are sealed off from each other. The database itself refuses to let one brand see another's numbers, even by mistake.
  • Your data belongs to you. Export it whenever you want. At the end of the contract, we hand it back in 7 days and delete our copy within 30.
  • Your people handle their GDPR themselves. Access to their data, erasure — one click from their account, no need to ask us.
Technical view
What your IT team ticks off
  • No mix-up possible between brands or countries. Separation is enforced by the database itself, across 41 tables, and verified on every release. (PostgreSQL Row-Level Security · 18 automated isolation tests)
  • Your data is encrypted end to end. In transit and at rest, with a master key stored outside the database and rotatable with no downtime. (TLS 1.3 · AES-256-GCM · hot rotation)
  • Every sensitive action is logged for two years, tamper-proof. Logins, GDPR exports, permission changes, AI runs: who, when, what, outcome. (Immutable audit · 730-day retention · monthly partitioning)
  • Our AI never does anything you have not authorised. Human validation required for every write, centralised emergency stop, automatic rollback if anything goes wrong. (Safe mode · kill switch · auto rollback)
The 4 layers explained simply

What each one does.

Business view. Technical detail (algorithms, exact intervals, standards references) is provided in the security dossier under NDA.

1 · Transport

Everything travels over HTTPS, like your online bank. The server caps the number of requests to block bots, and only accepts connections from our application.

2 · Authentication

Login by PIN code, two-factor available for sensitive accounts and mandatory for administrators. Each session is short and refreshes itself. No password ever stored in clear.

3 · Application

Before every action, the app checks that the user is allowed to perform it. Everything is logged so the history can be traced. Our AI never changes anything without a human approving first.

4 · Data

The database itself refuses to answer if asked for another brand's data. Encrypted backups daily, kept 30 days, restore tested every month.

Compliance

The boxes your security committees tick.

Here is what we tick on the first call. Detailed documentation (records of processing, register, penetration tests, business continuity plan) is sent under NDA.

GDPR ✓
OWASP Top 10 ✓
Europe hosting only
ISO 27001 (in progress)
SOC 2 Type II (in progress)

Full security pack under NDA.

Detailed architecture, GDPR processing records, incident runbooks, penetration tests, business continuity plan. Sent within 24 h after signing the NDA.

Request the security pack