Toutes les plateformes vous diront que vos données sont sécurisées et isolées. Ce qui suit dit comment, en termes assez précis pour que vous puissiez les contester — la seule sorte d’affirmation qui mérite d’être lue sur une page comme celle-ci.
01
Isolation is structural, not a filter
A workspace’s records carry its identity in the data layer, and queries are scoped there rather than in each screen. The difference matters the day somebody writes a new report and forgets a where clause: with scoping in the query layer that report returns nothing extra, because there is nothing extra to return.
An audit command walks every table and every model and fails the build when one is not accounted for.
02
Your address is yours
Each workspace answers on its own hostname from the moment it is created, and session cookies are scoped to that host alone. A cookie written on one workspace cannot travel to another, which is what stops a shared browser from becoming a shared session.
Custom domains must prove ownership with a DNS record before they will resolve at all.
03
Closing an account is not losing it
A closed workspace enters a retention window rather than vanishing. During it the data can still be exported, and the name is never handed to anybody else — a former customer’s links should not start resolving to a stranger.
Export and billing stay reachable even while service is suspended, so a dispute never locks you out of the evidence.
04
Billing you can reconstruct
Usage is captured before it is priced, and every invoice line traces back to the day, the meter and the rate behind it. The ledger is double-entry and its trial balance is checked, so the books either balance or somebody is told they do not.
A day can be re-rated on its own if a rate was wrong, without rewriting the days around it.
05
La facture ne peut pas vous punir
Nulle part dans la plateforme il n’y a d’intérêts, de pénalité ni de frais de retard — et c’est une contrainte inscrite dans le code, non une politique dans un document. La balance âgée existe pour qu’on puisse vous téléphoner ; elle n’a aucune colonne qui tarifie l’attente, et un test vérifie qu’aucun des mots qui transformeraient le retard en frais n’y figure jamais.
Un test fait vieillir une facture de quatre-vingt-dix jours et vérifie que le montant reste celui du premier jour.
06
La sortie, avec ses dates
Ce sont les valeurs avec lesquelles la plateforme tourne en ce moment, pas une illustration. Chaque échelon se déclenche une fois par cycle, et l’horloge ne tourne que tant qu’un espace de travail n’a pas accès aux données — un module que vous payez pour continuer à le lire n’a aucune date de purge.
90days
held after access ends
60days
before purge, the first warning
7days
before purge, the export is delivered
La purge ne démarre pas tant qu’un export n’a pas été produit et livré, avec le nom de la personne qui l’a autorisée inscrit à côté.
A group with campuses in three countries cannot compare a Bachelor to a Licence unless something outside this software says they are the same level. These are the published specifications the platform quotes rather than invents — each one external, each one checkable, and none of them our own definition of a word.
ISCED 2011 / ISCED-F 2013
Qualification levels and academic fields are stored as the UNESCO codes, not as names somebody typed. 9 levels and 11 broad fields, so a transcript from one country can be ranked against another without a human deciding what a local title is worth.
Seeded from the standard and asserted against it in StandardsTest.
CEFR
Language attainment is held as a CEFR level, with each exam board’s own published comparison used to reach it — 4 of them. The bridge between two tests is never one we drew: the framework is the only thing they are each mapped to.
Every band is the awarding body’s published table, cited at the entry rather than averaged.
ISO 4217
Money carries its currency’s real exponent, including the 26 codes that are not two decimal places. A yen invoice is not a hundredth of the amount and a dinar one is not a thousand times it, because the minor unit is read from the standard rather than assumed.
The exceptions are listed explicitly; the common case stays the default.
ISO 20022 / ISO 13616
Bank details are collected per the identifiers a country actually uses — IBAN where an IBAN exists, the local routing field where it does not, across 8 country profiles. A payout form that asks for the wrong identifier is a payment that fails days later.
Field sets are declared per country, not one global form with optional boxes.
ISO 3166 / ISO 639 / BCP 47
Countries and languages are keyed by their standard codes throughout, and the public pages advertise their translations to crawlers with the BCP 47 tag for each — the same code the interface itself is served under.
hreflang alternates are generated from the language table, so a new language announces itself.
Data residency — GDPR, PDPL
Where a workspace’s files physically live is decided by its country, not by convenience: EU workspaces to a European region, Gulf workspaces to a Gulf one, each with the framework that governs it recorded alongside. Residency is a routing decision made before an upload is written.
RegionalStorageRouter resolves the region and its framework per tenant, under test.
HSTS — RFC 6797
Every address, apex and workspace subdomain alike, is committed to TLS for a year through Strict-Transport-Security. That closes the gap a redirect cannot: the first request of a session, typed or followed from an old link, which would otherwise travel in the clear.
Max-age and subdomain inclusion are configuration, not hard-coded, and default to the preload-eligible year.
Double-entry bookkeeping
The ledger is double-entry with a checked trial balance, which is the oldest standard on this list and the least negotiable. Every invoice line traces to the day, the meter and the rate behind it, so a bill can be reconstructed rather than believed.
The books either balance or somebody is told they do not.
What is not here is as deliberate as what is: this platform holds no ISO 27001 or SOC 2 certificate, and does not imply one. Those are audit outcomes, and we would rather you read a list you can verify than a badge you cannot.