Where your data is
- Your data is hosted on Google Cloud, Paris region (europe-west9), inside the European Union.
- Backups are stored in the same region.
- No customer content, neither files nor databases, leaves the European Union.
Security and compliance
Where your data sits, who can reach it, how it is backed up, and who our subprocessors are. This page only describes what is in place today. Anything still to come is dated and marked as planned.
Last updated: 12 September 2026
Encryption
- Encryption in transit over TLS for every access to the platform and to your services.
- Encryption at rest with AES-256, provided by the cloud provider.
- The connection credentials of your managed services are encrypted by NidApp before they are stored.
Access control
- In the console, access to an organisation and its projects is granted by role: owner, administrator, reader.
- On the NidApp side there is a single infrastructure administrator, with a named account. No shared account.
- Each customer service runs in an environment isolated from the other customers.
Planned
- Deny by default network segmentation and resource quotas per plan, December 2026.
- Removal of the last technical access keys in favour of keyless authentication, December 2026.
Backups and reversibility
- The file volumes of the services in production have been backed up every night since 12 August 2026, with a 30 day retention, in the Paris region.
- You can ask for an export of your data at any time and at the end of the contract.
- No restore time is announced as long as the procedure has not been exercised.
Planned
- Daily backup extended to the databases and to the configuration files, with a 15 day retention and a daily copy of the databases to separate storage, before November 2026.
- First traced restore test, then one test per quarter, before November 2026.
- Maximum data loss of 24 hours on all data, once the databases are part of the daily backup, before November 2026.
Monitoring and incidents
- The metrics and logs of your services are collected on the platform and kept for 10 days.
- Business-hours support, 9am to 6pm Monday to Friday, 4-hour response.
- There is no on-call outside business hours, and NidApp sells no figure based availability commitment.
Planned
- External availability check and an immediate alert channel, before November 2026.
- Automatic alerts on availability, disk saturation and certificate expiry, plus a monthly availability report, November 2026.
- Formal data breach procedure, with the customer notified within 24 hours and the CNIL within 72 hours, November 2026.
Subprocessors
This is the complete list of the subprocessors that may handle data as part of the service, as of 30 September 2026. It is updated whenever one is added.
| Subprocessor | Purpose | Location | Data concerned |
|---|---|---|---|
| Google Cloud EMEA Limited | Hosting of the services and of the backups | Ireland, infrastructure in Paris (europe-west9) | All the data hosted on your behalf |
| Google Ireland Limited | Google Workspace Sheets, log of the demo requests from this website | Ireland | Name, email, company and message of the demo request |
| OVH | DNS and outgoing email | France | Email addresses of the contact requests |
| GitHub | Code repositories and deployment manifests | United States, Data Privacy Framework | Deployment configuration, no customer content |
| Pennylane | Invoicing and accounting | France | Identification and billing data of your company |
| Telegram | Internal technical alerts for the operations team | Outside the European Union | Organisation and service names, no customer content |
Compliance
- The Google Cloud infrastructure is certified ISO 27001 and SOC 2; those certifications cover the infrastructure provider. NidApp holds neither and does not claim to.
- NidApp is a simplified joint-stock company under French law, company number (SIREN) 101 988 962, Paris Trade and Companies Register, registered office at 58 rue de Monceau, CS 48756, 75380 Paris Cedex 08, France.
- The service is governed by French and European Union law. You may lodge a complaint with the French data protection authority (CNIL).
Planned
- Data processing agreement (article 28 of the GDPR), record of processing activities and a detailed security questionnaire, available on request from November 2026.
A question about security?
For any question about this page, about our subprocessors, or to request a document, write to us.