Security in our processes.

The measures we have adopted to make security our priority in our actions and decisions.

Regulation of data usage

As defined in our Personal Information Management Policy, our employees are required to use data only to the extent necessary for the performance of their duties, subject to sanctions.

Example of an acceptable use: using the contact details of a user to provide technical support.

Example of prohibited use: accessing the contact information of a user for personal purposes.

Our employees are also bound by a confidentiality agreement. Disclosure of data to any external third party is prohibited without the express authorization of our Privacy Officer.

In addition, our internal policies are complemented by mandatory training courses and a documentation center on proper data use.

Incident management

The incident management process we observe is largely based on the ISO/IEC 27001:2013 guidelines. Our Information Security Incident Management Policy provides a framework for the process to be followed when a security incident is identified.

More precisely, the Policy establishes:

• The responsibilities of each stakeholder, including incident identification, classification, communication, resolution, prevention, and disciplinary action.
• How to identify a security incident.
• How to classify the risk (low, medium, high) associated with a security incident.
• The steps to follow once an incident has been identified to resolve it and to ensure the continuity of affected services, if applicable.
• What can be done to prevent a recurrence, and what lessons can be learned.

Subprocessor and third-party provider management

Third-party suppliers or data processors represent software, associations, or stakeholders with whom we work to provide and improve our services. Our selection process ensures that our suppliers:

• Have access only to data that is necessary and for the time necessary to achieve the purpose for which it is shared.
• Maintain information security standards that meet our requirements.

When evaluating any given third-party supplier, we pay particular attention to the scope of the data concerned, if any, and to the potential security risks should the supplier be compromised.

Learn more about our subprocessors

Employee background checks

We perform routine background and criminal record checks before approving each hire.

Physical and material security

Our Physical Access Management Policy defines the rules we follow to protect our employees and prevent unauthorized access to our offices and work tools. In particular, this Policy details procedures for managing locks, alarm systems, and visitors.

Both our hardware and software are required to be password-protected at all times. In the event of loss or theft, we are able to remotely erase data stored on a computer.

In addition, our databases are hosted off-site, in highly secure data centers managed by Amazon.

Learn more about AWS data centers security

Requests

Should you have any questions or requests regarding data security or use, please reach out to our Privacy Officer at [email protected].