Security & sovereignty
Your data stays in France. And you can check it.
Sovereignty is not proven by a flag on a home page but by names: which company hosts, in which city, under which law, and who can technically access what. Here are ours.
Where your data physically lives
Three components, a single country.
The database
Managed PostgreSQL at Scaleway, data centres in the Paris region (fr-par). Backed up by a full export three times a day, deposited outside the production infrastructure.
The files
Attachments, images and documents on Scaleway Object Storage, also in the Paris region. No replica outside France.
Execution
The Odoo instance runs on a Scaleway Kubernetes cluster, in France. It is stateless: everything that matters is in the database and the files.
Why "French" and not just "European"
Many hosts advertise servers "in Europe" while being subsidiaries of American groups. In that case the Cloud Act lets the US administration demand data from the parent company, whatever the country where it is stored: location no longer protects anything. Our host is Scaleway, a French company of the Iliad group, with no parent company outside the Union.
Backed up three times a day, and restored for real
Three times a day
Database and files, with no intervention and no downtime window. Each backup is kept in duplicate, in two European countries and with two independent operators.
Restoration on request
A restoration is done from these backups, at your request. It is the only medium your data comes back from: we have no other.
Exportable by you
A standard PostgreSQL dump and all of your files, at any time.
Our access to your data, plainly
What we do not do
No commercial use of your data.
No AI model training on your content.
No resale.
No "support" access without a trace.
What we do
Encryption of exchanges (HTTPS/TLS) and of data at rest.
Named operating access.
Intervention on your application data only at your request.
Traced deployments.
What we sign
Scaleway (France) for hosting, Hetzner (Germany) for the remote deposit of database backups, OVH (France) for the backup copy of files and for e-mail, Cloudflare for anti-bot protection of the sign-up journey. No transfer outside the European Union, and none of these providers has a parent company outside the Union.
Any data breach is notified to you without undue delay, with the facts, their effects and the measures taken, under Article 33 of the GDPR, carried into our data processing agreement.
We hand you a complete backup, database and files, in a format directly usable by Odoo. Your data is kept thirty days after termination to allow this handover, then deleted from production and from the backup repositories. We certify it in writing on request.
We announce no guaranteed availability rate. A percentage not measured in front of you commits nobody, and we prefer to describe what we actually do: priority recovery from interruptions, maintenance announced by e-mail, and your requests handled within 30 business minutes.