01
Security
Defense in depth, least privilege and a secure development lifecycle. Program aligned with ISO/IEC 27001 Annex A controls, audited internally.
Trust center
Trust is
built in
Your core data is hosted in France and the EEA. We follow GDPR principles, encrypt communications and comply with the applicable requirements of the AI Act.
Trust baseline
Operational safeguards
Data in France and the EU
Core services hosted with OVHcloud in France and the European Economic Area.
Encryption in transit
All communications are encrypted over HTTPS / TLS.
Multi-tenant isolation
Each organisation's data is isolated from every other.
48-hour notification
For a client data breach, notification where reasonably possible within 48 hours.
Our approach
Concrete safeguards at every level
02
Privacy
GDPR legal bases, bounded retention periods, data-subject rights and an Article 28 data processing agreement (DPA).
03
AI Act compliance
Honax follows the applicable AI Act requirements through transparency, human oversight and risk management principles.
04
Documented subprocessors
Providers selected for their role and held to our security and privacy requirements.
Documentation
Documents
Available to our clients once signed in. Prospects: ask us for the package.
0102030405060708
Accord de traitement des données (DPA)
Client accessNotre accord de sous-traitance au titre de l'article 28 du RGPD, intégré aux Conditions Générales d'Utilisation.
FAQ sécurité
Client accessLes réponses aux questions les plus fréquentes des questionnaires de sécurité.
Gestion des incidents
Client accessNotre processus de réponse aux incidents et de notification des violations de données sous 72 heures.
Mesures techniques et organisationnelles
Client accessLes mesures de sécurité mises en oeuvre pour protéger les données traitées (annexe au contrat de sous-traitance).
Rétention et effacement
Client accessNos durées de conservation par catégorie de données et nos engagements d'effacement.
Sécurité de la plateforme
Client accessArchitecture défensive, authentification, isolation des données, chiffrement et cycle de développement sécurisé.
Sous-traitants
Client accessLa liste nominative de nos sous-traitants, leur rôle et les services auxquels ils contribuent.
System card de l'agent vocal
Client accessCe que fait l'assistant vocal, ses garde-fous, sa transparence IA et le traitement des données d'appel.
FAQ
Frequently asked questions
The essential answers for assessing our security and privacy approach.
01Where is the data hosted?
With OVHcloud, with core data in France and the European Union.
02Is the data encrypted?
Yes, all communications are encrypted in transit over HTTPS / TLS.
03Do you sign a data processing agreement (DPA)?
Yes. Our Article 28 GDPR data processing agreement is incorporated into the Terms and is available in the client Trust Center.
04Can I retrieve my data at the end of the contract?
Yes, data reversibility and export are provided. Details are in our documents.
05What happens in the event of a data breach?
We follow an incident response process and notify affected clients, where reasonably possible, within 48 hours after becoming aware of a breach.
06Do you hold an ISO 27001 or SOC 2 certification?
Our program is aligned with ISO/IEC 27001 Annex A controls and audited internally. No certification is claimed at this stage.
Security team
A security question?
Our team answers security requests and vulnerability reports.