This page covers the technical side without unnecessary jargon. It is aimed at CIOs, CTOs and CISOs who must approve Orée — and at commercial leaders who want to understand the guarantees they are signing. Every technical term is translated into plain English.
No exotic critical third-party services. Everything is built on PostgreSQL and Node.js — two proven building blocks, deployable on European sovereign infrastructure.
React + PWA — the installable smartphone app works without a network (surveys are stored locally and encrypted, then synchronised as soon as the connection returns). No data loss in store, even in basements.
The field rep takes a shelf photo; the AI detects products, stock-outs and facings (share of shelf). Proprietary retail vision model, EU-hosted, complemented by a visual similarity engine (pgvector) built into the database.
Every morning, the AI pre-organises each field rep's route: store order, priorities, promo alerts. The field rep approves or adjusts — they never start from a blank page.
Node.js 20 + PostgreSQL 16. AsyncLocalStorage (a mechanism that automatically attaches the client context to every request) ensures that data from one tenant cannot end up in another tenant's response, even in the event of an application bug.
European sovereign infrastructure (OVHcloud / Scaleway, customer's choice). No transfer outside the EU. Daily encrypted backups, 30-day retention, monthly tested restores.
JWT token login (12 h) + secure cookie. Optional two-factor authentication (2FA) per role, mandatory for administrators. Enterprise single sign-on (SAML 2.0 / Azure AD) on the Enterprise plan.
Many vendors separate customers "at the code level". We do it at the database level: it is PostgreSQL itself that refuses a cross-tenant read, not the developer who has to remember.
Strict isolation enforced at the database level — not by application code. If a query tries to read another client's data, Postgres blocks it. End of story.
PostgreSQL RLS + explicit application check on every write. If one fails, the other catches it. 18 isolation tests re-run on every deployment.
Tamper-proof log of who did what (logins, GDPR exports, admin actions, support in user-impersonation mode). 730-day retention, monthly partitioning.
TLS 1.3 in transit, AES-256 at rest (database, backups, offline smartphone queue). No customer data in clear text on disk.
What your IT team will want to see: SLA, observability, incident management, updates.
Contractual uptime commitment on the Business and Enterprise plans. Automatic service credits if missed. Public real-time status page.
Application metrics, traces and logs centralised. 24/7 alerting on the API and the database. Dedicated client dashboard on Enterprise (you see what we see).
Formal incident management process: customer notification within 1 h for major incidents, written post-mortem within 5 business days, corrective action plan.
Continuous deployments, no service interruption. Several releases per week on average. Database migrations protected by a multi-instance lock (zero corruption possible).
Tamper-proof log of sensitive actions, 730-day retention. Export on request for your internal or external auditors.
Monthly quotas per client + automatic freeze at 100% usage. No unpleasant invoice surprises, manual unlock is logged.
Daily encrypted backups, 30-day retention, restore tested every month. RPO 24 h, RTO 4 h on Enterprise.
We follow recognised market standards. Some certifications are still in progress, and we say so clearly rather than displaying misleading logos.
Records of processing, signable DPA, user exports, automated right to erasure. Sub-processors listed and notified. Strict EU hosting.
The worldwide reference list of the 10 most common web vulnerabilities — we systematically test against each one. Quarterly internal security reviews.
International information-security management standard. Audit scheduled Q4 2026. Policies and procedures already aligned, gap analysis completed.
Audit standard that proves security controls operate effectively over time (12 months). Auditor selected, observation window open.
Detailed architecture, GDPR processing records, incident runbooks, latest pen-tests, business continuity plan, SBOM (software bill of materials), sub-processor registry. Sent within 24 h after signing.
Request the technical pack under NDA