Security and data protection
We build applications and AI agents that handle business data, sometimes sensitive. Here is how we protect it, with evidence.
HDS and ISO 27001 certified hosting providers, an architecture approved by the IT department of an international pharmaceutical company, a healthcare application in production for a public hospital: details below.
Your data stays in France or the European Union
Depending on your needs, your application is hosted:
- with an HDS-certified host for health data, HDS being the French certification for health data hosting (Scalingo, certificate no. 38436-2, valid until 11 September 2028);
- with ISO 27001 hosting through our partner WebCapsule;
- on OVHcloud servers in France;
- or directly in your environment: your cloud, your servers, behind your VPN.
A certification covers the hosting provider and its scope, not automatically the application. For each project, we check and document the chosen offer.
An architecture approved by the IT department of a large group
For an international pharmaceutical company, our architecture was reviewed and approved by its IT architecture committee before we were listed as a supplier. The application now runs in the client’s environment, behind its VPN and bastion host.
Health data: protection by design
For the emergency department of a public hospital, we took over and put into production a patient application that prepares a report for the doctor. Health data is protected by design:
- anonymous patient session: no identifying data is requested;
- doctor access to the report through a QR code, valid for 24 hours;
- logging of access to the report;
- documented security audit;
- automatic security scanning of the code and its dependencies on every change: a critical vulnerability blocks any update until it is fixed;
- data breach procedure and exit plan written for the project.
Security audits on the applications we take over
On an application we took over for an insurance broker, our security audit uncovered three critical vulnerabilities, which we fixed as a priority.
AI without losing control of your data
- European AI models (Mistral) when your data requires it.
- Automations hosted on your side when possible, as at Imalize, where n8n runs on the client’s infrastructure.
- Human validation where a mistake is costly: AI prepares, a person decides.
Our own services
On this website and its back office, which we run ourselves:
- an encrypted backup every day, stored with a different provider from the host;
- an automatic restore test every week;
- controlled releases: automated tests, a backup before any database change, rollback possible;
- cookie-free audience measurement, with a data processing agreement signed with our analytics provider.
You stay in control
- The code belongs to you.
- We transfer knowledge throughout the project, so your teams can take over.
- For sensitive projects, a documented exit plan.
Insurance and documents
Scroll holds professional liability insurance with Hiscox. We answer supplier security questionnaires and provide on request:
- our current insurance certificate;
- the certificates of the chosen hosting providers;
- a description of your project’s architecture and security measures.
Contact: contact@agence-scroll.com · +33 6 48 03 90 27