Theme
Finance
This theme covers material related to financial soundness, internal controls and governance. Financial statements and audit reports are available on request as part of a due-diligence process.
Documents
Download our compliance artifacts
Public documents are available instantly. Gated ones require a short NDA.
Public
Legal
Cookie Policy
This cookie policy explains what cookies are, which cookies are used on this website, for what purposes, for how long, by whom the data may be processed, and how you can manage your consent.
Updated May 2026
ViewLegal & corporate information
Legal information
Entity identification, data hosting and published contractual documents.
SAS
Legal form
545 444,50 €
Share capital
2008
Founded
France
Data hosting
Company identity
- Legal name
- APROVALL
- SIREN
- 503829368
- Trade & companies register (RCS)
- 503 829 368 R.C.S. Evry
- DUNS number
- 26-000-4250
- EU VAT number
- FR69503829368
- Business code (APE/NAF)
- 5829C
- Registered office
- 27 Avenue Carnot, 91300 Massy, France
Theme
Cybersecurity
This theme covers our information security policy and our responsible vulnerability disclosure process. It is complemented by the technical and organizational controls in place and the list of our sub-processors.
Areas covered by our security policy
The scope of our information security policy, aligned with ISO/IEC 27001.
Governance & organisationSecurity awarenessAccess managementNetwork securitySecure developmentVulnerability managementRisk managementBusiness continuityIncident responseSupplier securityPersonal-data protectionAI management
Certifications
Frameworks
DORAISO/IEC 27001
Our approach
Security
AES-256 encryption at rest, TLS 1.3 in transit, enforced MFA, 24/7 monitoring, annual penetration tests.
Privacy
GDPR-compliant, EU hosting (France), data minimisation.
Availability
99% quarterly SLA. Annually-tested business continuity plan. RPO 24h, RTO 72h.
Compliance
ISO 27001 · ISO 27701
Security controls
Defense in depth, across the stack
A summary of the controls continuously monitored in our compliance program.
Access Control
- Unique user identification
- Multi-factor authentication enforced
Cryptography
- Data at rest encrypted (AES-256)
- Data in transit encrypted (TLS 1.3)
Human Resources
- Security awareness training
Incident Response
- Documented incident response plan
Vulnerability Mgmt
- Monthly vulnerability scans
Sub-processors
Sub-processors
Full list of our sub-processors. Subscribe to be notified of additions or changes.
| Name | Purpose | Location | Certifications | DPA | Since |
|---|---|---|---|---|---|
OVHcloud FR | Primary hosting — application data, databases, and uploaded files | France | ISO 27001ISO 27701 | Signed | 2025-07 |
Scaleway FR | Encrypted backups of databases and files | France | ISO 27001 | Signed | 2025-07 |
YouSign FR | Electronic signature — signatory names, email addresses, signed documents | France | eIDAS | Signed | 2025-07 |
Mistral AI FR | AI document analysis — document contents submitted for analysis | France | — | Signed | 2025-07 |
Amazon SES FR | Transactional email — email addresses and message metadata | France (eu-west-3) | Signed | 2025-07 | |
Google Gemini BE | AI document analysis — document contents submitted for analysis | Belgique (europe-west1) | Signed | 2025-12 |
Ethics & compliance
Business ethics & compliance
Integrity, prevention of corruption and conflicts of interest, and responsible supplier relations.
0
Tolerance for corruption & conflicts of interest
2025
Responsible Supplier Relations Charter
2019
UN Global Compact signatory
2022
Code of conduct & whistleblowing channel
Ethical commitments
- Zero tolerance for corruption, active or passive
- Conflict-of-interest prevention
- Integrity in business & supplier relations
- Confidential whistleblowing channel
- Code of conduct issued to every employee
Charters & frameworks
- Responsible Supplier Relations Charter — signed April 2025 · 10 commitments
- UN Global Compact — signatory since 2019 · 10 principles
Environmental responsibility
Carbon footprint 2025
Our carbon assessment, computed per ISO 14064-1 across the entire value chain.
303
tCO₂e
Total emissions, all scopes combined
0
tCO₂e · 0%
Scope 1 — direct
2.86
tCO₂e · 1%
Scope 2 — energy
299.81
tCO₂e · 99%
Scope 3 — value chain
99% of our emissions come from Scope 3: our impact is borne almost entirely by the value chain, not by our own operations.
Breakdown by post
- Purchases & services228.68 tCO₂e · 76%
- Product use26.88 tCO₂e · 9%
- Travel & commuting23.49 tCO₂e · 8%
- Other posts23.09 tCO₂e · 7%
Carbon intensity
kgCO₂e per k€ of revenue
10.4
2023
baseline
22.7
2024
20.1
2025
SBTi target based on carbon intensity, to decouple our growth from our impact.
Standard: ISO 14064-1Database: Base Carbone® ADEMEApproach: 37.5% physical / 62.5% monetaryView the report
Human rights & social
Human rights & social responsibility
Our commitments build on the major international frameworks, applied internally and across our entire value chain.
2014
Diversity Charter signatory
2019
UN Global Compact signatory
8
ILO fundamental conventions upheld
6
Internal commitment areas
Internal commitments
- Non-discriminationCode of conduct since 2022
- Anti-harassment & anti-violenceWhistleblowing channel since 2022
- Freedom of association & collective bargainingSocial dialogue through the works council
- Privacy & personal dataRight to disconnect guaranteed
- Decent pay & trainingTraining access for everyone
- New technologies & AIGoverned use of AI
International frameworks
- International Bill of Human Rights
- OECD Guidelines for Multinational Enterprises
- UN Guiding Principles on Business & Human Rights
- ILO 8 fundamental conventions
- Diversity Charter — signatory since 2014
- UN Global Compact — signatory since 2019
Across our value chain — We apply the same ethical standards to all our stakeholders and expect our suppliers to share these commitments.
Policy owned by Executive Management, HR and the CSR lead.Read the policy
Service status
Uptime over the last 90 days, powered by our external monitoring.
Frequently asked questions
Everything you need to know before requesting access.