Encryption at rest
Secrets are encrypted with AES-256-GCM; the master key never leaves the hub.
No secret in clear
Logs, API responses, reports and diagnostic artifacts are redacted before persistence.
Strict multi-tenant isolation
Every read is filtered by company; access to a third party's resource returns 404, never 403.
RBAC & ACL
Every action is guarded by a permission; access to controls is filtered by group rights.
EU sovereignty
Hosted on EU infrastructure (OVH, France). Checkpoints observe from your markets.
Backups & reproducibility
Immutable measurements, reproducible reports, daily database backups.
End-to-end HTTPS transport; no payment data stored (payment is externalized).
