Data security and processing policy

1. Purpose, Scope and Reference Framework

The implementation of the General Data Protection Regulation (GDPR) and the constantly evolving landscape of digital threats require software provider to maintain absolute vigilance and transparency. To meet its regulatory obligations and guide its teams’ actions, Axelor enforces this Data Security and Processing Policy. This document formalizes and outlines all the technical and organizational commitments made by the company to guarantee the protection of applications and data hosted as part of its SaaS offerings.

This protective framework applies uniformly to all services provided to our clients and partners, as well as to all Axelor employees, whether permanent, temporary, or external contractors. To establish the legitimacy and effectiveness of these measures, Axelor has structured its security governance around an Information Security Management System (ISMS) certified compliant with the ISO/IEC 27001:2022 standard. This policy is aligned with our overarching Information Security Policy, which defines executive management’s strategic vision, and our Information System Security Policy (ISSP), which governs our organization’s daily operational rules.

2. Security Objectives and Security Governance

The security of Axelor’s hosting platforms and software suites relies on four guiding principles, collectively referred to as global security criteria. Availability ensures that production environments, attachments, and databases remain accessible whenever our clients’ business operations require it, in accordance with our service-level commitments. Integrity guarantees that stored information remains accurate, complete, and protected against any accidental or malicious alteration. Confidentiality restricts access to sensitive data so that only authorized personnel can view it. Accountability systematically logs and audits all administrative actions performed on our infrastructure.

This policy is proactively managed by the Chief Technology Officer (CTO), who acts as the Chief Information Security Officer (CISO), supported by a qualified alternate. Executive management is directly involved in this process through a strategic review and an annual risk assessment based on the EBIOS methodology. At the operational level, technical and application compliance is evaluated during monthly DevSecOps committees, while overall system effectiveness is measured annually through independent internal audits and external surveillance audits conducted by accredited certification organizations.

3. Organizational Discipline and Team Security Awareness

Because human vigilance is the first line of defense in cybersecurity, Axelor strictly manages the professional lifecycle of its teams. Starting at the recruitment stage, a progressive onboarding process verifies new hires’ qualifications and carefully provisions their logical access rights. Every employee formalizes their commitment by signing a confidentiality clause integrated into their employment contract, alongside formal acknowledgement of the company’s IT Charter. Upon the end of a mission or an employee’s departure, a strict offboarding protocol is triggered to recover physical equipment and immediately revoke all access rights to Axelor’s digital resources.

Security training is delivered through a continuous awareness program. Axelor partners with the Riot learning platform to deliver regular security awareness modules to all staff. This educational program is supplemented by realistic phishing simulations designed to test and sharpen employees’ vigilance against modern social engineering techniques. Through these initiatives, Axelor embeds a strong security culture into its teams’ daily routines.

4. Access Control and Identity Management

Access to Axelor’s administrative infrastructure is strictly governed by the principle of least privilege. Access rights to production servers and client databases are never granted by default or based on hierarchical status; they are provisioned solely on a strictly vetted, business-need-to-know basis. Internal company secrets and technical API keys/credentials are stored and shared securely using end-to-end encryption via the Passbolt professional password manager.

To secure our systems’ perimeter, multi-factor authentication (MFA) is mandatory for all remote connections, hosting consoles, and sensitive administrative environments. Technical interventions on databases and application containers are conducted exclusively through the Teleport security bastion. This system generates short-lived access certificates and records all administrative sessions, ensuring absolute accountability and seamless traceability of all operations.

5. Infrastructure Security and Cloud Hosting

To deliver its SaaS services, Axelor relies on the highly secure physical infrastructure of world-class cloud providers, certified ISO/IEC 27001 and compliant with the strictest international security standards.

Amazon Web Services (AWS): Hosted cloud services are located within the Europe Region, guaranteeing data sovereignty within the European Union. The system architecture on AWS utilizes a multi-Availability Zone (Multi-AZ) deployment. The Amazon Aurora relational database is replicated synchronously across multiple physical sites, enabling automatic failover to a standby instance without data loss or manual intervention in the event of hardware failure.
Dedicated Server Infrastructure: Axelor utilizes OVHcloud data centers located in France (specifically Gravelines, Roubaix and Strasbourg). These physical facilities are secured by continuous CCTV surveillance, individual RFID badge access controls, and advanced fire detection and suppression systems. OVHcloud secures network connections against distributed denial-of-service (DDoS) attacks through its high-capacity mitigation infrastructure.

6. Operational Resilience, Backups and Incident Management

The sustainability of our clients’ data is backed by a rigorous, automated backup strategy. On AWS infrastructure: Aurora’s continuous, incremental backups are paired with AWS Backup, which takes two daily snapshots retained for seven days, alongside weekly and monthly backups archived for up to twelve months. On OVHcloud infrastructure: Databases and application attachments are backed up twice a day using our internal tool, Backuppc, and stored on an isolated server in a geographically separate data center. These mechanisms allow us to guarantee a Recovery Point Objective (RPO) of no more than 14 hours.

Our platforms are monitored 24/7/365. The performance and availability metrics of our servers and applications are tracked in real-time using Datadog and Grafana telemetry. If a critical anomaly is detected, automated alerts are routed to our on-call engineering team for immediate remediation. Additionally, Axelor maintains documented Business Continuity (BCP) and Disaster Recovery (DRP) Plans, along with a formalized crisis management procedure to coordinate incident response and keep clients informed during major events.

7. Secure Development and Application Compliance

Axelor integrates security requirements at the earliest stages of software design, adhering to a “Security by Design” approach. Our development lifecycle builds the DevSecOps methodology directly into our GitLab pipeline. Code changes undergo systematic peer reviews and automated static analysis to prevent vulnerabilities, such as those identified in the OWASP Top 10. Our development, testing, and production environments are strictly segregated. Finally, every release follows a validated deployment protocol and includes a formalized fallback strategy to ensure continuous service stability.

8. Axelor’s Role as a Data Processor (GDPR)

When customers run our software suites, Axelor acts strictly as a Data Processor under Article 28 of the GDPR, while the Customer remains the Data Controller. Consequently, Axelor undertakes to process hosted personal data solely on documented instructions from the Customer, and exclusively for the purposes of performing service delivery and technical support.

To formalize this relationship, a Data Processing Agreement (DPA) is systematically appended to our commercial agreements. This agreement outlines our commitments to assist with data subject requests (DSRs), transparently notify the controller of any personal data breach, govern the engagement of sub-processors, and securely return or delete data upon contract termination.