Sovereignty
Sovereignty is built into the design of DataBait: the solution rests on an exclusively French and European chain of control (company, directors, host, infrastructure) and on a strict data minimisation principle. At no point does your data leave your information system.
Sovereignty by design
Three questions determine which legal regime your data falls under: who owns the vendor, under which law the infrastructure runs, and what is actually stored. At DataBait, all three answers are French, and the third one is “nothing”.
End-to-end French chain of control · No transfer outside the European Union
Chain of control
The principal, the qualified host, and the certified operator all fall under the same sovereign jurisdiction. No link in the chain escapes French and European law.
DataBait is registered with the Paris RCS and wholly owned by French interests: its founders and their entities. No foreign shareholding, no non-European control: it falls exclusively under French law and European Union law, GDPR included.
The infrastructure is hosted on a platform qualified SecNumCloud by ANSSI, the highest French standard for trusted cloud: data located exclusively in France, French and European law applying to the exclusion of all others, immunity to extraterritorial laws, including the US CLOUD Act.
Operations are run by a company incorporated under French law and certified ISO 27001, 100% owned by French entities and individuals. The certification is audited and renewed by an independent external body.
Data minimisation
Your database and your files are never sent to us and never leave your information system.
The only things retained on our infrastructure are the inbound emails and SMS received by the fictitious accounts, when their sender is not on the allowlist you define. In other words, we retain only messages that originate outside your organisation and are potentially unlawful, precisely the elements that make up the evidence being sought.
What this means for your compliance. The messages retained contain, by construction, no business data belonging to your organisation. Your exposure surface at a third party is therefore nil: there is nothing on our side that could constitute a leak of your data.
Verifiable by third parties
Our sovereignty commitments do not rest on our word alone: they are written into the contract and audited by independent bodies.
Sovereignty foundation
SecNumCloud · ANSSI
Data hosted in France, on infrastructure qualified at the highest level of the French trusted cloud framework.
ISO 27001
Certified operator, incorporated under French law, audited and renewed by an external body.
Audit rights · Terms of Service
The Terms of Service give the Client the right to request a technical audit of the Solution (art. 9.3), by a qualified independent auditor.
Extraterritorial laws
No transfer outside the EU, immunity to the CLOUD Act and to non-European orders.
Reversibility
At the end of the contract, the messages retained are returned to you on request. No residual data of yours.
Frequently asked questions
On infrastructure qualified SecNumCloud by ANSSI, located exclusively in France. No transfer outside the European Union. The SecNumCloud qualification is the highest French standard for trusted cloud.
No. The SecNumCloud qualification guarantees that French and European law alone applies, and immunity to extraterritorial laws, notably the US CLOUD Act. The chain of control is French end to end: vendor company, qualified host, and certified operator all fall under French jurisdiction.
DataBait stores none of your data. Your database and your files are never sent to us. The only things retained are the inbound emails and SMS received by the fictitious accounts when their sender is not on your allowlist, that is, messages originating outside your organisation and potentially unlawful, which contain no business data belonging to your organisation.
Yes. The Terms of Service give the Client the right to request a technical audit of the Solution (article 9.3), carried out by a qualified independent auditor, within a written and binding framework. This contractual audit stacks on top of the assurances given by independent third parties: the SecNumCloud qualification issued by ANSSI and the operator's ISO 27001 certification, both audited and renewed by external bodies.
All retained messages are returned to you on request. Since none of your organisation's data was ever copied there, no residual data of yours exists to recover or erase.
Get in touch
We would be glad to introduce the team and the product to you in detail at a meeting, and to answer all your questions about sovereignty and the protection of your data.
Reply within 24 business hours