Legal information
Trust & Security
Effective date: June 14, 2026 — v1.1
Our commitment
The security and confidentiality of the data entrusted to us are at the heart of how Scell.io is designed. Our platform processes tax documents, electronic invoices and signatures with evidentiary value: this data demands a rigorous, documented and enforceable level of protection.
Our approach rests on four structuring principles:
- Security by design: security is built into every feature from the outset, not bolted on afterwards.
- Defence in depth: several independent layers of controls protect each resource. No single mechanism is a point of failure.
- Least privilege: each component, user or API key holds only the access strictly required for its function.
- Zero trust: no request is implicitly trusted. Every access is authenticated, authorised and logged.
This document sets out our concrete commitments regarding hosting, encryption, access control, integrity, continuity and compliance. It is intended to inform our customers' finance leaders (CFOs), security officers (CISOs) and data protection officers (DPOs).
Hosting and data sovereignty
The entire platform and all processed data are hosted within the European Union.
| Item | Detail |
|---|---|
| Infrastructure provider | Scaleway |
| Location | fr-par datacenter (Paris, France) |
| Jurisdiction | European Union |
| Transfers outside the EU | None |
Scell.io performs no transfer of personal or tax data outside the European Union. Data is stored, processed and backed up exclusively on infrastructure located in France. This sovereignty guarantees the applicability of European law (GDPR) and the absence of exposure to extraterritorial data-access regimes.
Encryption
Data is encrypted at all times, both at rest and in transit.
Encryption at rest
- Columns containing sensitive data (integration secrets, banking identifiers, confidential personal data) are encrypted with AES-256 through application-level encryption (Eloquent
encryptedcast). - Database backups are encrypted.
- Archived documents are stored on encrypted object storage.
Encryption in transit
- All communications with the platform are protected by TLS 1.3.
- No data is exchanged in clear text over the network.
Secrets management
- API keys (
sk_*,pk_*) are hashed in a non-reversible manner: we never store the plaintext value. Only the prefix and trailing characters are kept for identification. - Configuration secrets are encrypted and are never exposed on the client side nor logged.
Access control and authentication
Multi-tenant isolation
The platform partitions data by tenant at multiple layers: a tenant isolation scope applied to every request at the application level, combined with PostgreSQL Row Level Security in FORCE mode on sensitive tables (billing, tax ledger). This defense-in-depth prevents one tenant from accessing another tenant's data, with application-level and database-level isolation reinforcing each other.
Authentication
| Mechanism | Implementation |
|---|---|
| MFA TOTP | Mandatory for administrator accounts |
| Sessions | HttpOnly cookies (Sanctum), CSRF protection |
| API keys | Scoped (sk_ server-side, pk_ client-side), restricted permissions |
| Rate limiting | Per IP, per user and per endpoint |
Two-factor authentication (TOTP) is mandatory for any account with administration privileges. API keys are segmented by use: secret keys (sk_) are restricted to server-side use, publishable keys (pk_) to restricted client-side use.
Integrity and immutability
Scell.io guarantees the integrity and immutability of tax documents through a chain of reinforced technical controls.
ISCA integrity chain
- Each fiscal entry is recorded in an immutable ledger chained by SHA-256 hash (Integrity, Security, Conservation, Archiving — ISCA).
- Anti-mutation PostgreSQL triggers prevent, at the database engine level, any modification or deletion of an entry once recorded.
- The integrity of the chain can be verified at any time; any break is detected.
Scell.io is self-certified on the basis of an internal tax-compliance attestation. The platform is not NF525-certified.
Timestamping and anchoring
- Closures are anchored via OpenTimestamps on the Bitcoin blockchain (best-effort, a free and public additional layer). An anchoring failure never affects the integrity guaranteed by the internal chain.
Reliable Audit Trail (PAF)
- The platform implements a Reliable Audit Trail (Piste d'Audit Fiable) in accordance with Article 289 of the French General Tax Code, ensuring documented traceability of the flow between the transaction and the invoice.
Archiving with evidentiary value
| Characteristic | Value |
|---|---|
| Technology | Object storage in Object Lock COMPLIANCE mode |
| Retention period | 11 years |
| Mode | Read-only, immutable |
Invoices are retained for 11 years in immutable, read-only form: once written, they cannot be modified or deleted — including by an administrator — throughout the legal retention period.
Backups and continuity
| Item | Detail |
|---|---|
| Database | Daily and hourly encrypted backups |
| Retention | 30 days |
| Monitoring | Automatic backup freshness alerting |
Backups are encrypted and retained for 30 days, with hourly frequency to minimise potential data loss (RPO). An automatic freshness-alerting mechanism immediately notifies our teams in the event of a backup failure, ensuring rapid detection of any anomaly.
The platform relies on Scaleway's managed infrastructure, complemented by continuous supervision (monitoring and alerting via Sentry, hosted within the European Union).
Application and supply-chain security
The security of our software chain is continuously controlled, on every code change.
| Control | Tool / Mechanism |
|---|---|
| Dependency auditing | Dependabot, composer audit, npm audit |
| Static analysis (SAST) | CodeQL |
| Vulnerabilities & secrets | Trivy (dependency CVEs, secret detection) |
| Software inventory | SBOM in CycloneDX format |
| License compliance | Automated license checking |
| Integration pipeline | Blocking CI on any HIGH or CRITICAL vulnerability |
No release is possible if a vulnerability of HIGH or CRITICAL severity is detected: our continuous integration automatically blocks the deployment. Software inventories (SBOM) are generated continuously to ensure traceability of every third-party component.
Compliance and certifications
Current compliance
| Framework | Status |
|---|---|
| GDPR (Regulation EU 2016/679) | Compliant — DPA (Article 28) available on request |
| eIDAS | Simple electronic signature (EU-SES) |
| Factur-X / EN 16931 | Compliant electronic invoice format |
| EU hosting | 100% European Union, no transfer outside the EU |
A Data Processing Agreement (DPA) compliant with Article 28 of the GDPR, governing our role as processor and the list of our sub-processors, is available to our customers.
Planned certifications
For the sake of transparency, we clearly distinguish our achieved compliance from our ongoing efforts. The items below are planned and have not yet been obtained:
| Initiative | Target date |
|---|---|
| External penetration test | Q3 2026 |
| ISO 27001 gap assessment | Q3 2026 |
| ISO 27001 certification | In preparation |
| SOC 2 Type II | 2027 |
We claim no ISO 27001 or SOC 2 certification at this stage. These initiatives are underway and their progress will be communicated.
Incident management and reporting
Incident response plan
Our security incident management process follows a structured cycle:
Detection → Containment → Eradication → Recovery → Post-mortem
Each incident is subject to a post-mortem analysis aimed at durably strengthening our controls.
Data breach notification
| Commitment | Deadline |
|---|---|
| Notification to the Customer | Within 24 hours of qualification |
| Notification to the CNIL (by the Customer as controller) | Within 72 hours (GDPR, Article 33) |
In the event of a personal data breach, we undertake to notify the affected Customer within 24 hours, so as to enable them to fulfil, where applicable, their obligation to notify the supervisory authority (CNIL) within 72 hours under Article 33 of the GDPR.
Vulnerability reporting (responsible disclosure)
We welcome security reports submitted responsibly. If you identify a potential flaw, please contact us at security@scell.io. We undertake to acknowledge receipt, investigate, and remediate confirmed vulnerabilities as promptly as possible. Please do not publicly disclose a vulnerability before it has been fixed.
Your rights and contacts
| Subject | Contact |
|---|---|
| Security, vulnerability reporting | security@scell.io |
| Data Processing Agreement (DPA) | dpa@scell.io |
| Personal data protection (DPO) | privacy@scell.io |
For any question regarding our security commitments, the platform's compliance, or to obtain our documentation (DPA, SBOM, security fact sheet), our teams are available at the addresses above.
Trust & Security — QR Communication SAS — Scell.io
QR Communication SAS — 23 rue de Richelieu, 75001 Paris, France Security contact: security@scell.io — Website: https://scell.io