Security & privacy
How your documents and your data are protected
You entrust us with bank statements, identity documents and signed mandates. Here is, measure by measure, what we do with them — concretely, without hollow jargon, and without displaying a single badge we do not hold.
The measures
Six protections, described without marketing
Each one answers a specific risk: interception, leakage, undue access, impersonation, disputed signatures, automation errors.
01
Encryption, in transit and at rest
Every exchange with the site and the client area runs over TLS: nothing travels in clear text between your browser and our servers. The documents you upload are then encrypted at rest: raw access to the storage is not enough to read them.
02
Hosting in the European Union
Your data and documents are hosted in the EU, with [EU HOSTING PROVIDER TO BE CONFIRMED], under GDPR jurisdiction. No production copy is stored outside the European Union.
03
Partitioned access, least privilege
Each team member accesses only what their role requires, through named accounts — never a shared login. Access to claims is logged and reviewed periodically; an access that is no longer needed is revoked.
04
Identity verified, sanctions screened
Before any filing in your name, your identity is verified and checked against sanctions and politically-exposed-persons (PEP) lists by a specialised provider: [KYC PROVIDER TO BE CHOSEN]. This is what prevents a third party from claiming your refund in your place.
05
Evidentiary electronic signature
Mandates are signed electronically through [E-SIGNATURE PROVIDER TO BE CHOSEN], with time-stamping and an evidence file. The signed copy stays available in your documents at all times — you never have to take our word for what you signed.
06
Every automated decision, logged
Our pipeline parses your statements, calculates and pre-validates automatically. Every decision is written to an audit log you can consult claim by claim: what, when, on what basis. And above €10,000 of estimated recovery, a human review is systematic before filing — that threshold is configurable, never removable.
Retention
How long we keep what
Keeping data for less time would be illegal; keeping it longer would be unjustifiable. Three categories, three clocks.
- Claim records (statements, forms, administrations' decisions)
- Life of the claim, then statutory tax and accounting retention periods — up to 10 years for some accounting records
- Identity evidence (KYC)
- Retention periods imposed by anti-money-laundering regulation after the relationship ends
- Account, preferences and login records
- As long as the account exists, then deletion or anonymisation
The full breakdown, category by category and period by period, is in the privacy policy.
Your GDPR rights, and how to exercise them
Your data remains yours. You can exercise the following rights at any time — from your account or in writing — with one honest limit: we cannot erase what the law requires us to keep before the legal retention periods expire.
- Access: obtain a copy of everything we hold about you
- Rectification: correct inaccurate data
- Erasure: delete what is no longer legally required
- Restriction and objection: freeze or refuse certain processing
- Portability: retrieve your data in a reusable format
Disclosure
Found a vulnerability?
Write to us directly: describe what you observed, without exploiting the flaw beyond demonstration and without accessing other users' data.
[SECURITY CONTACT ADDRESS TO BE CONFIGURED BEFORE PRODUCTION LAUNCH]
Our commitment: a prompt acknowledgement, a prioritised fix, feedback on what was done — and no legal action against good-faith research.
What we do not display
No SOC 2, ISO 27001 or equivalent badge appears on this site: we display no certification we have not yet obtained. The day a certification is earned, it will be published here with its exact scope and its verifiable report — not just a logo in a footer.
Judge on evidence, not on promises
The client area — the very one that will carry your documents — is open as a full demo, with fictitious data and no sign-up.
No win, no fee · Pricing 100% public · FR / EN