Introduction:
Smart Tribune, an independent French software company, designs its AI and knowledge management solutions to meet the needs of large enterprises. Your data is hosted in France and never leaves the European Union, even for AI processing. Our security is continuously monitored as part of our ISO 27001 certification process.
At a Glance:
Governance and Certifications
Smart Tribune's security is based on an information security management system built in accordance with the ISO 27001 standard.
- ISO 27001: The certification process is underway, with support from a specialized consulting firm.
- ISO 42001 (AI management system): an upcoming initiative to provide a framework for the lifecycle of our AI features.
- Continuously Monitored Compliance: Our security controls are continuously monitored on a dedicated compliance platform, including policies, access reviews, vendor onboarding, and audit evidence.
- Identified responsibility: The technical management team oversees information system security and serves as the direct point of contact for our clients' security teams.
- Trained employees: Regular awareness training for all teams on cyber risks, including phishing, and an IT policy signed by each employee.
- Secure workstations: centrally managed fleet with disk encryption, automatic security patches, and a robust password policy.
- Formalized policies: Our security policies are drafted, approved, and tracked in Vanta, our compliance platform. [To be enabled: An up-to-date list is available in the Trust Center]
Certifications of Our Hosting Providers
Our cloud providers—Amazon Web Services, Microsoft Azure, and Google Cloud—hold their own certifications, including ISO 27001, ISO 27017, ISO 27018, SOC 2, and HDS. These certifications cover their infrastructure, not Smart Tribune as a software provider. Details are available on the compliance pages forAWS, Microsoft Azure, and Google Cloud.
Hosting, Business Continuity, and Resilience
All of our production workloads are hosted on Amazon Web Services in the Europe (Paris) region, distributed across multiple availability zones. Your production data is stored in France, and its backup copies are replicated in Frankfurt, without ever leaving the European Union. Other cloud providers are used solely for AI processing.
- Infrastructure: A Kubernetes platform hosted on AWS, covering production and acceptance testing environments, as well as cross-functional services such as observability and AI-powered tracing. The infrastructure incorporates automatic scaling mechanisms and standardized deployments via our CI/CD pipeline.
- High availability: An architecture designed to ensure end-to-end resilience, with an orchestrated infrastructure distributed across multiple availability zones, enabling redundancy and automatic recovery of application services. Components requiring persistent state rely on managed services that include native replication, backup, and high-availability mechanisms.
- Backups: Continuous, encrypted database backups, with a maximum RPO of 5 minutes for primary databases, and recovery copies replicated to Frankfurt (EU).
- File storage: encrypted at rest, with automatic versioning of objects and cross-region replication of data as needed, in accordance with standardized governance rules.
- Disaster Recovery Plan: A documented DRP that is reviewed and tested annually; each test results in a report and corrective actions. In the event of a major disaster in the Paris region, recovery relies on replicas stored in Frankfurt, with a recovery time objective (RTO) of 12 hours.
- Separate environments: Development, testing, and production are strictly separated; development and testing are reserved for Smart Tribune teams, with no access for external contractors.
- Threat monitoring and detection: centralized logs, metrics, and traces; external availability monitoring; logging and archiving of network traffic for auditing and forensic analysis; and threat detection (AWS GuardDuty) integrated with alerts from the technical team.
Data Protection and Access Control
Your data is encrypted in transit and at rest, and access to it is limited to what is strictly necessary.
- Encryption in transit: TLS for all traffic, with a configuration reviewed quarterly (A+ rating on SSL Labs).
- Encryption at rest: Databases, files, and backups encrypted using AES-256, with keys managed in AWS Key Management Service.
- Customer-based isolation: Each customer has access only to their own data, including in AI processing.
- Roles and permissions: five client-side roles (administrator, database administrator, contributor, supervisor, agent), with access restricted by knowledge base.
- Single Sign-On (SSO): Available as an option via OpenID Connect; compatible with Okta, Google, and Microsoft Entra ID. Your authentication policies, including multi-factor authentication, then apply to your users.
- Secure sessions: registered accounts, hashed passwords (bcrypt), short session tokens that are automatically renewed, and re-authentication required after 12 hours.
- Access for Smart Tribune teams: privileged accounts accessible only via SSO with two-factor authentication, least privilege, centralized and tracked access requests, periodic review of access permissions, and deactivation upon an employee’s departure. Internal services are accessible only via VPN.
- Secret management: Infrastructure and application secrets are stored in a dedicated secret vault and encrypted using AWS KMS, separately from employee passwords.
GDPR and Personal Data
Smart Tribune acts as a data processor for its clients within the meaning of Article 28 of the GDPR, under a Data Processing Agreement (DPA).
- Designated DPO: can be contacted at dpo@smart-tribune.com
- Processing log (Article 30) kept up to date.
- Retention periods defined by data category: for example, technical logs are retained for one year, and IP addresses used for voting are hashed and then deleted after 24 hours.
- Subcontractors of subcontractors: governed by contract; a list of these subcontractors and their locations is provided upon request.
- Personal Data and AI: Our AI features include personal data detection. Data masking is applied based on the nature of each feature.
- Reversibility: At the end of the contract, your data can be returned to you for two months, after which it is deleted. Copies stored in encrypted backups and previous versions of files are deleted at the end of their retention period: 7 days in most cases, up to 14 days.
When using Smart Tribune solutions, two categories of cookies may be used:
1. Necessary functional cookies
Some Smart Tribune products, particularly those that require authentication through a personal account—such as Smart Knowledge—use cookies that are strictly necessary for the service to function.
These cookies are used, in particular, to manage user sessions and ensure that authenticated features function properly. They are essential for using the service in question and are not used for analytics or audience measurement purposes.
Their use complies with applicable data protection requirements and the CNIL’s recommendations regarding strictly necessary cookies.
2. Optional analytics cookies
Smart Tribune solutions remain fully functional regardless of whether the user accepts or rejects analytics cookies.
When these cookies are rejected, certain data related to the use of the service is not collected. This may limit the statistics and analyses that help us better understand how the solution is used.
The activation of audience measurement tools is based on the user’s selection. In particular, a “cookieoptin” setting allows users to control the activation of cookies associated with Google Analytics.
When Google Analytics is used, the anonymization mechanisms configured by Smart Tribune are designed to limit the collection of directly identifiable data, particularly regarding IP addresses.
Smart Tribune can also use Piano Analytics for audience measurement, depending on the selected configuration and in compliance with applicable data protection regulations.
These mechanisms allow us to accommodate users' privacy preferences while maintaining the proper functioning, security, and statistical tracking capabilities of Smart Tribune solutions.
For more information, please see our privacy policy.
Trustworthy AI
Our AI capabilities generate reliable, traceable, and controlled responses, without ever sending your data outside the European Union.
Where and How Your Data Is Processed
- Exclusively within the EU, with a focus on France: language models are accessed via Microsoft Azure OpenAI (GPT family), Google Cloud Vertex AI (Gemini family), and Amazon Bedrock (notably Anthropic and Mistral). Other regions of the EU are used only for redundancy or to access a specific model.
- Understanding and vectorization on our infrastructure: In our search and response (RAG) features, embeddings, intent detection, and entity recognition are computed by our own models, hosted on AWS in Paris. Only the final generation step involves a third-party model provider.
- Minimization: In search and response (RAG), only the excerpts necessary for the response are sent to the model. For the analysis of complex documents by computer vision models, only the parts of the document that are required are sent, depending on the document’s composition.
- Multi-vendor AI gateway: A single gateway routes requests and automatically switches to a backup model or provider. The result: service continuity and no dependence on a single model.
- Your data is not used to train any models: prompts and responses are never used to train our providers’ models (Azure OpenAI, Google Cloud, Amazon Bedrock). Their technical logs are retained—for some providers, for up to 30 days—solely for the purpose of detecting abuse and resolving incidents.
- Ownership: You remain the sole owner of your data and the content generated by the AI.
- Imported documents: stored in encrypted form (AES-256) in the Paris region, with encrypted replication in Frankfurt.
Quality and Security of Responses
- Source-cited answers: The AI generates responses based on your content and displays its sources. Your teams retain control over approval workflows and content freshness.
- Continuous evaluation: the quality of responses is measured to detect hallucinations and deviations, using AI-specific logging and periodic human reviews.
- Model security: filtering prompt injection attempts, protections against data extraction, and no new models in production without prior evaluation of security, privacy, and quality.
- In line with the AI Act: classification of uses, risk analysis by module, notification of end users when they interact with AI, availability of human oversight, and traceability of responses.
- R&D: Smart Tribune conducts applied research in artificial intelligence and natural language processing through its in-house laboratory, using experimental methodologies and resulting in scientific publications. This research is subject to the same security, confidentiality, and data localization requirements as our operational environments, with all processing carried out exclusively within the European Union.
Application Security and Vulnerability Management
Security is built into every stage of development, from writing code to deployment.
- Proven technologies: React and TypeScript, Rust, Go, Python, and PHP, with dependencies updated regularly based on their criticality.
- Secure continuous integration: Every change goes through a GitLab CI pipeline that includes static code analysis (SAST), dependency analysis, and container image scanning (Trivy).
- Code review: Every piece of code is reviewed before deployment, including code generated by AI tools, the use of which is governed by internal rules. A development charter is signed by the entire technical team.
- Automated testing: unit, functional, end-to-end, mutation, and performance tests before each deployment to production.
- Security testing: Regular dynamic testing (OWASP ZAP) in accordance with the OWASP guidelines.
- Penetration tests: Conducted at least once a year by an independent third-party service provider, commissioned by one of our clients or, failing that, by Smart Tribune. The scope of each campaign is defined based on risks (exposed components, recent changes) to ensure that the entire platform is covered over time.
- Patches: The goal is to fix critical vulnerabilities (CVSS score ≥ 9) within 7 days, with a workaround provided if necessary.
- Vulnerability reports: Send them to vulnerabilities@smart-tribune.com, where they are handled directly by the DevOps team and technical management. Each report is assigned a ticket and tracked until it is resolved.
Incident Management
Every incident follows a formalized process: detection, assessment, handling, communication, and lessons learned.
- Detection: continuous monitoring, threat detection (AWS GuardDuty), and automatic multi-channel alerts.
- Reporting: via a dedicated email address or through customer support; each report is tracked in a ticket until it is resolved.
- Escalation and Resolution: Prioritization based on the impact on customers and immediate mobilization of the technical team.
- Communication: Direct notification of affected customers.
- Personal data breach: Notify the customer without undue delay, and no later than 48 hours after becoming aware of the breach, to allow the customer to notify the CNIL within the statutory 72-hour deadline.
- Lessons Learned: Post-incident analysis and corrective actions following each major incident.
Availability and SLA
Smart Tribune guarantees a monthly service availability of at least 99.5%, calculated as follows:
\text{Monthly availability} = 100 \times \frac{\text{calculation period} - \text{service downtime}}{\text{calculation period}}Response times and fault resolution times are detailed in Appendix 1 of our General Terms and Conditions of Sale. Specific terms may be set forth in the special terms and conditions of each contract.
Audits and Transparency
We make our practices verifiable by our clients and their security teams.
- Audits: security audits of our infrastructure, conducted either internally or by external auditors, who are often commissioned by our clients.
- Client Audit Rights: Our clients may audit the platform once a year, with one month’s advance notice, at their own expense, and within a scope agreed upon in advance (dates, participants, content). Additional audits may be conducted following a security incident or at the request of a regulatory authority. If our teams are required to work for more than one day, we will bill for the support provided.
- Safety Committee: An annual meeting can be held between your safety liaison and our technical management team.
- Technical and security documentation —including architecture, backups, security policies, responsible AI, and service commitments—is detailed in this document, which is provided upon request.
- Security questionnaires: Our standard security package (technical documentation and answers to frequently asked questions) covers the key elements of supplier evaluation forms and is provided to you upon request. For specific questionnaires, we will agree on a response deadline together.
