Security and commitments

Who gets in, where your data goes, how to leave.

Leaving

Stopping: No minimum term and no notice period: you can stop with a simple email.
Export: In your settings, at any time, without telling us.
If we stop the service: You are told in writing three months in advance, and direct debits stop on the day of the announcement. Your workspace stays open for reading and export for ninety days after the shutdown.

The password vault: It never leaves the device where you filled it in: it is neither synced, nor backed up by us, nor exported. It is encrypted in the installed application, not in the browser: we advise you not to put a critical secret in it.
Calendar, clients, invoices, notes: Our server on Render, then a PostgreSQL database on Supabase. Everything that travels between your devices and the server is encrypted (HTTPS).
The application's emails: They are sent through Resend. We keep a record that they were sent; the text of the message is not kept.
Another client: You only read what they write in the Hall, and only if your organisation has joined it.

The people you invite: With the role you give them.
Our team: Through a support session, which ends on its own after one hour. Each time they enter, it is written to the log, under the person's name.
Our console: Without a support session: it opens your account on the first day, and can create an account in your workspace, resend an access link or set a temporary password. Each action is written to the log.
Our automated processes: They post our announcements and your monthly report there.

A certification: None (ISO 27001, SOC 2). No auditor has checked this page yet.
The full list of processors: With the country where each one processes your data: not published here yet. Ask for it through the form, and we will send it to you in writing.

Last updated: 24 October 2026.