Theme
Finance
This theme covers material related to financial soundness, internal controls and governance. Financial statements and audit reports are available on request as part of a due-diligence process.
Security and Compliance, Our Commitments
Aprovall is committed to protecting your data with the highest standards of security and confidentiality. Discover our certifications, security practices and our transparent approach to compliance.
Documents
Download our compliance artifacts
Public documents are available instantly. Gated ones require a short NDA.
Public
Audit report
Aprovall Annual Sustainability Report 2025
Aprovall's 2025 Sustainability Report shows a shift from strategic intent to formalized governance: four new policies, RFAR Charter signature, an EcoVadis upgrade to silver, and our carbon assessment 2025 ISO 14064-1.
Updated Aug 2026
DownloadPublic
Other
Carbon Footprint 2025
Carbone footprint 2025 Aproval included scope 1, scope 2 and scope 3
Updated May 2026
DownloadPublic
Policy
Responsible Disclosure Policy
Responsibly report security vulnerabilities
Updated May 2026
ViewPublic
Legal
Cookie Policy
This cookie policy explains what cookies are, which cookies are used on this website, for what purposes, for how long, by whom the data may be processed, and how you can manage your consent.
Updated May 2026
ViewNDA
Policy
Supplier Code of Conduct
Principles and commitments expected from our suppliers regarding ethics, human rights, cybersecurity and the environment.
Updated May 2026
RequestNDA
Policy
Social & Human Rights Policy
Aprovall's commitments regarding non-discrimination, anti-harassment, freedom of association, privacy, fair compensation and new technologies.
Updated May 2026
RequestNDA
Policy
Responsible Purchasing Policy
Aprovall's and its suppliers' commitments to responsible purchasing: environment, human rights, ethics and data protection.
Updated May 2026
RequestLegal & corporate information
Legal information
Entity identification, data hosting and published contractual documents.
SAS
Legal form
545 444,50 €
Share capital
2008
Founded
France
Data hosting
Company identity
- Legal name
- APROVALL
- SIREN
- 503829368
- Trade & companies register (RCS)
- 503 829 368 R.C.S. Evry
- DUNS number
- 26-000-4250
- EU VAT number
- FR69503829368
- Business code (APE/NAF)
- 5829C
- Registered office
- 27 Avenue Carnot, 91300 Massy, France
Theme
Cybersecurity
This theme covers our information security policy and our responsible vulnerability disclosure process. It is complemented by the technical and organizational controls in place and the list of our sub-processors.
Areas covered by our security policy
The scope of our information security policy, aligned with ISO/IEC 27001.
Governance & organisationSecurity awarenessAccess managementNetwork securitySecure developmentVulnerability managementRisk managementBusiness continuityIncident responseSupplier securityPersonal-data protectionAI management
Certifications
Frameworks
DORAISO/IEC 27001
Our approach
Security
AES-256 encryption at rest, TLS 1.3 in transit, enforced MFA, 24/7 monitoring, annual penetration tests.
Privacy
GDPR-compliant, EU hosting (France), data minimisation.
Availability
99% quarterly SLA. Annually-tested business continuity plan. RPO 24h, RTO 72h.
Compliance
ISO 27001 · ISO 27701
Security controls
Defense in depth, across the stack
A summary of the controls continuously monitored in our compliance program.
Access Control
- Unique user identification
- Multi-factor authentication enforced
Cryptography
- Data at rest encrypted (AES-256)
- Data in transit encrypted (TLS 1.3)
Human Resources
- Security awareness training
Incident Response
- Documented incident response plan
Vulnerability Mgmt
- Monthly vulnerability scans
Sub-processors
Sub-processors
Full list of our sub-processors. Subscribe to be notified of additions or changes.
| Name | Purpose | Location | Certifications | DPA | Since |
|---|---|---|---|---|---|
OVHcloud FR | Primary hosting — application data, databases, and uploaded files | France | ISO 27001ISO 27701 | Signed | 2025-07 |
Scaleway FR | Encrypted backups of databases and files | France | ISO 27001 | Signed | 2025-07 |
YouSign FR | Electronic signature — signatory names, email addresses, signed documents | France | eIDAS | Signed | 2025-07 |
Mistral AI FR | AI document analysis — document contents submitted for analysis | France | — | Signed | 2025-07 |
Amazon SES FR | Transactional email — email addresses and message metadata | France (eu-west-3) | Signed | 2025-07 | |
Google Gemini BE | AI document analysis — document contents submitted for analysis | Belgique (europe-west1) | Signed | 2025-12 |
Ethics & compliance
Business ethics & compliance
Integrity, prevention of corruption and conflicts of interest, and responsible supplier relations.
0
Tolerance for corruption & conflicts of interest
2025
Responsible Supplier Relations Charter
2019
UN Global Compact signatory
2022
Code of conduct & whistleblowing channel
Ethical commitments
- Zero tolerance for corruption, active or passive
- Conflict-of-interest prevention
- Integrity in business & supplier relations
- Confidential whistleblowing channel
- Code of conduct issued to every employee
Charters & frameworks
- Responsible Supplier Relations Charter — signed April 2025 · 10 commitments
- UN Global Compact — signatory since 2019 · 10 principles
Environmental responsibility
Carbon footprint 2025
Our carbon assessment, computed per ISO 14064-1 across the entire value chain.
303
tCO₂e
Total emissions, all scopes combined
0
tCO₂e · 0%
Scope 1 — direct
2.86
tCO₂e · 1%
Scope 2 — energy
299.81
tCO₂e · 99%
Scope 3 — value chain
99% of our emissions come from Scope 3: our impact is borne almost entirely by the value chain, not by our own operations.
Breakdown by post
- Purchases & services228.68 tCO₂e · 76%
- Product use26.88 tCO₂e · 9%
- Travel & commuting23.49 tCO₂e · 8%
- Other posts23.09 tCO₂e · 7%
Carbon intensity
kgCO₂e per k€ of revenue
10.4
2023
baseline
22.7
2024
20.1
2025
SBTi target based on carbon intensity, to decouple our growth from our impact.
Standard: ISO 14064-1Database: Base Carbone® ADEMEApproach: 37.5% physical / 62.5% monetaryView the report
Human rights & social
Human rights & social responsibility
Our commitments build on the major international frameworks, applied internally and across our entire value chain.
2014
Diversity Charter signatory
2019
UN Global Compact signatory
8
ILO fundamental conventions upheld
6
Internal commitment areas
Internal commitments
- Non-discriminationCode of conduct since 2022
- Anti-harassment & anti-violenceWhistleblowing channel since 2022
- Freedom of association & collective bargainingSocial dialogue through the works council
- Privacy & personal dataRight to disconnect guaranteed
- Decent pay & trainingTraining access for everyone
- New technologies & AIGoverned use of AI
International frameworks
- International Bill of Human Rights
- OECD Guidelines for Multinational Enterprises
- UN Guiding Principles on Business & Human Rights
- ILO 8 fundamental conventions
- Diversity Charter — signatory since 2014
- UN Global Compact — signatory since 2019
Across our value chain — We apply the same ethical standards to all our stakeholders and expect our suppliers to share these commitments.
Policy owned by Executive Management, HR and the CSR lead.Read the policy
Service status
Uptime over the last 90 days, powered by our external monitoring.
Maintenance in progress
99.92%Scheduled maintenance will take place on Friday, August 14, 2026, from 4:00 PM to 10:00 PM CEST. (Update: ON HOLD)
Update : The scheduled maintenance this Friday has be cancelled. It will be scheduled for another time. Scheduled maintenance will take place on Friday, August 14, 2026, from 4:00 PM to 10:00 PM CEST. During this maintenance window, all applications, APIs, and reporting services will be unavailable. We apologize for any inconvenience and thank you for your understanding.
- 100%Authentification systemhttps://auth.e-attestations.com/auth/realms/ea-users
- 99.9%API / 360 Apphttps://edge-internal.e-attestations.com/actuator/health
- 99.86%Portalhttps://portal.aprovall.com/api/actuator/health
90 days agotoday
Frequently asked questions
Everything you need to know before requesting access.