Trust center
Trust center: BEAROPS platform security, in verifiable facts
Updated on .
This page brings together the technical facts about the security of the BEAROPS platform: data location, hosting, sub-processors, encryption, access control, development, continuity and vulnerability disclosure. For each point, we state what is published here and what is available on request. The principles of sovereignty are explained on a dedicated page.
- French software vendor
- Evidence, not fear
- Documents available on request
What this page covers
This page describes how the platform of the BEAROPS product suite is built and operated: where the data is, who processes it, how it is protected. The reasons for our choices, our sovereignty criteria and the question of the CLOUD Act are covered on our sovereignty page. The two pages complement each other.
Architecture and data location
Knowing where the data is located is the first question in a supplier review. Here we state, environment by environment, where platform data is processed and stored: production, backup, support, AI processing. The detailed description of the architecture is provided on request, as part of a security review.
- Production: data hosted in France, in OVHcloud data centres.
- Backups: hosted in France, in OVHcloud data centres.
- Support: provided by the BEAROPS teams.
- Artificial intelligence: AI models hosted and audited in France.
On request
- Architecture description, under a non-disclosure agreement.
Hosting
Hosted in France on OVHcloud infrastructure certified ISO/IEC 27001. This certification belongs to the hosting provider, not to BEAROPS: it covers the infrastructure on which the platform runs. The role of the hosting provider and the organisation of operations are set out below.
- Hosting provider: OVHcloud, in France, in its data centres.
- ISO/IEC 27001 certification: held by OVHcloud; its scope is defined and published by the hosting provider. See the sources
- Platform operations: run in-house by the BEAROPS teams, with no outsourcing of operations.
Sub-processors
A supplier never works alone: it relies on providers of its own. We publish the list of sub-processors that may process platform data, with their function and location. Any change to this list is dated on this page.
List up to date as of .
| Sub-processor | Function | Processing location | Data concerned |
|---|---|---|---|
| OVHcloud | Hosting of the platform infrastructure | France | Platform production data and backups |
Outside the platforms, the website links to Calendly (Calendly LLC, United States) for booking meetings: this service is not a sub-processor of platform data.
Encryption in transit and at rest
Encryption protects data while it travels over the network and while it is stored. This section states what is encrypted on the platform in both situations. The technical description of the mechanisms applied is provided on request, under a non-disclosure agreement.
- In transit: platform data is encrypted while it travels over the network.
- At rest: platform data is encrypted while it is stored.
On request
- Technical description of encryption, under a non-disclosure agreement.
Access control and authentication
Two questions arise: how your users authenticate to the platform, and who, at BEAROPS, operates it. Here we describe the authentication provided, role management and the organisation of operations.
- Authentication: the suite portal applies single sign-on for access to the products.
- Roles and permissions: permissions managed by product and by role; each team sees only its own scope.
- BEAROPS teams: operations and support run in-house, with no outsourcing of operations.
On request
- Security policy, under a non-disclosure agreement.
Secure development and platform vulnerabilities
A cybersecurity vendor must hold its own platform to the standard it recommends to its customers. This section states who develops the platform, how vulnerabilities reported to us are handled and which information on its security is available on request.
- Development: technology developed in France by the BEAROPS teams, on proprietary engines, with no core component under a foreign licence.
- Reported vulnerabilities: handled under our coordinated disclosure policy. Report a vulnerability
On request
- Results of the platform’s penetration tests, under a non-disclosure agreement.
- Security policy, under a non-disclosure agreement.
Continuity and backups
The continuity of a service is measured by its ability to recover after an incident. Here we state where backups are kept and how you retrieve your data at the end of the contract. The business continuity plan is provided on request, under a non-disclosure agreement.
- Backups: hosted in France, in OVHcloud data centres.
- Reversibility: retrieval of your data at the end of the contract, provided for by a contractual reversibility clause.
On request
- Business continuity plan, under a non-disclosure agreement.
Report a vulnerability
If you believe you have found a vulnerability in the BEAROPS platform or website, report it to us confidentially before any publication. We acknowledge receipt, analyse the report and keep you informed of its remediation. Our policy and our security contact are also published in the security.txt file.
- Security contact: contact@bearops.fr
- Scope: the BEAROPS platform and the bearops.fr website.
- Coordinated disclosure: describe the vulnerability, its impact and the steps to reproduce it, and do not make it public before it is fixed.
- /.well-known/security.txt file, in RFC 9116 format: it contains this contact and this policy.
Our commitments and their evidence
Each commitment below is linked to the evidence that supports it: published on this page or on a third party’s website, or available on request under a non-disclosure agreement. A line without available evidence is not shown. The table is dated.
Updated on .
| Commitment | Available evidence | On request |
|---|---|---|
| Hosted in France on OVHcloud infrastructure certified ISO/IEC 27001. | OVHcloud’s public certification page (see Sources) | Architecture description |
| List of sub-processors published and dated | Sub-processors | Not applicable |
| Data encrypted in transit and at rest | Encryption in transit and at rest | Technical description of encryption |
| Access rights by product and by role, operations run in-house | Access control and authentication | Security policy |
| Platform developed by the BEAROPS teams and subjected to penetration tests | Secure development and vulnerabilities | Results of the platform’s penetration tests |
| Backups in France and continuity | Continuity and backups | Business continuity plan |
| Retrieval of your data at the end of the contract | Contractual reversibility clause | Not applicable |
| Coordinated vulnerability disclosure | /.well-known/security.txt file | Not applicable |
Documents available on request
For a supplier review, a security questionnaire or a regulatory requirement, we provide additional documents under a non-disclosure agreement. State your needs in your request: we send you the documents available and answer your questionnaires within a timeframe agreed together.
- Architecture description.
- Technical description of encryption.
- Security policy.
- Business continuity plan.
- Results of the platform’s penetration tests.
- Answers to your supplier security questionnaire.
Sources and references
Frequently asked questions
Where is BEAROPS platform data hosted?
Hosted in France on OVHcloud infrastructure certified ISO/IEC 27001. Production data and backups are hosted in France, in OVHcloud data centres, and operations are run in-house by the BEAROPS teams. The detailed description of the architecture is provided on request, as part of a security review or a supplier review.
Is BEAROPS ISO/IEC 27001 certified?
The ISO/IEC 27001 certification cited on our website is that of our hosting provider, OVHcloud, and covers the infrastructure on which the platform runs. It must not be presented as a BEAROPS certification. We prefer this clarification to ambiguous wording.
How do I report a vulnerability?
Write to our security contact, contact@bearops.fr, also listed in the website’s security.txt file. Describe the vulnerability, its impact and the steps to reproduce it, without disclosing it publicly before it is fixed. We acknowledge receipt, analyse the report and keep you informed of how it is handled.
Can I obtain the list of sub-processors and a security file?
Yes. The list of sub-processors is published on this page, and additional documents are available under a non-disclosure agreement as part of a supplier review. State your needs through the contact form: we send you the documents available.
What is the difference between this page and the sovereignty page?
The sovereignty page explains our criteria and our choices: ownership of the technology, applicable law, the CLOUD Act, reversibility. This page describes the technical facts of the platform: hosting, sub-processors, encryption, access, continuity. The first explains why, the second shows how, with evidence.
Need to take your review further?
Security questionnaire, supplier review, DORA requirement: request our security file. We send you the documents available and answer your technical questions.