Security and data hosting

Last updated: 1 August 2026

This is a translation. Wyncove's legal documents are drafted in French, and the French version is the only binding one. This English text is provided so that an English-speaking reader can review the terms; in the event of any discrepancy between the two, the French version prevails.

You entrust us with confidential contracts. This page describes what is actually in place, and what is not yet. For a vendor security questionnaire, write to contact@wyncove.fr: our data and AI governance policy can be shared, and it is dated and versioned.

1. Where your data lives

• Database and files: Paris (Supabase, eu-west-3 region). No data at rest outside the European Union.
• Processing: Paris (Vercel functions, cdg1 region). This choice is not cosmetic: the host's default region is Washington, which would have sent the text of every contract through the United States on every analysis.
• Encryption in transit (TLS) and at rest, on the database as well as on file storage.

2. Separation between organisations

Every business record carries the identifier of its organisation, and that identifier comes from the session — never from a URL parameter or a form field. A request therefore cannot be redirected to another customer's data by editing an address.

The internal corpus used to measure extraction quality is a separate organisation, subject to the same separation: no customer document can end up there by accident, and it contains only synthetic or anonymised documents.

3. Account access

• No passwords. Sign-in uses a single-use link valid for fifteen minutes. There is therefore no password to steal, to reuse elsewhere or to find in a breach dump.
• Sessions revocable server-side. They are stored in the database rather than in a self-contained token: cutting off an account's access is a write, immediate and provable — not a wait for expiry.
• Explicit allow-list. Authorised accounts are enumerated, and the default behaviour is to refuse: a missing configuration does not open the door, it closes it.
• Named, logged invitations, with three roles (administrator, member, read-only).
• Audit log of access and changes: who confirmed, corrected or deleted what, and when.
• The only access without a session is the calendar feed, and it is treated as such. It is off by default, is only enabled by an administrator, and contains no amounts and no contract excerpts — the counterparty name, the reference, the date, the notice period, a link. Its address is cryptographically signed and is not stored by us: it is recomputed on every read. Regenerating it always produces a fresh address, never an old one put back into service.

4. What the AI sees, and what it does with it

• The text of the contract is sent to the model provider for the duration of the analysis. Nothing is retained on their side to train a model: that is a contractual commitment, not a statement of intent.
• No information is invented. A value absent from the contract is presented as absent. An uncertain value is submitted for human confirmation instead of being asserted.
• Every value cites its source, and the quote is verified word for word against the document text: a quote that cannot be found forces human review. You can see the passage highlighted in the document, in its sentence.
• Documents scanned without a text layer are refused explicitly rather than processed approximately — a misread contract is more dangerous than an unprocessed one.

5. Backups and continuity

Encrypted database backups with a 30-day rotation. Previous versions of the application remain deployable, which makes a rollback a single action. A destructive migration ships with its own rollback migration, written at the same time.

6. Development

• Every change goes through review and continuous integration: type checking, unit tests, and a measurement of extraction quality against a reference set that blocks the merge if quality regresses.
• No secret is stored in the code. No token capable of modifying the code lives in the application environment.
• Technical logs never contain the content of a contract, and tests verify that.

7. Incidents

In the event of a data breach likely to create a risk: notification to the CNIL within 72 hours, direct information of affected customers, and an incident register kept internally. To report a vulnerability, write to contact@wyncove.fr — a good-faith report will not be met with legal action.

8. What is not in place

This section exists for the same reason as the product's confidence score: saying what you are unsure of is better than letting someone assume.

• No certification. Wyncove is neither ISO 27001 certified nor SOC 2 attested. The architecture is designed in alignment with ISO 27001 requirements, and that trajectory is documented internally — which is not the same thing as a certificate, and we will not write it as if it were.
• No quantified availability commitment (SLA) at this stage.
• Processing agreements being signed with our hosting and AI subprocessors. They will be signed before the first real customer data is processed.
• Data protection impact assessment to be carried out before commercial launch.

Purposes, legal bases, retention periods and subprocessors are set out in the privacy policy.