# Sovereignty and data protection This page states where your data lives on Bastide, who processes it, which law applies and what Glowsoft commits to do in case of an incident. It is written to be reused in a security questionnaire: each guarantee is precise, and what is not acquired yet is named. ## The operator Bastide is designed and operated by Glowsoft SAS, a company under French law, with share capital of €1,500, registered with the Nevers trade register under number 993 347 335, whose registered office is 7 B rue du 13e de Ligne, 58000 Nevers, France. ## Where the data is Applications, databases, files and backups are hosted on dedicated servers located in France. During the beta, Bastide runs in a single region, in France. No data you host is transferred outside the European Union in the default configuration. Should a mode allowing a transfer ever be offered, enabling it would require your explicit acceptance, displayed before activation and logged. ## Subprocessors The data processing agreement comes with a list of subprocessors, which gives for each the service, the data concerned, the processing location and the country of the registered office, so that you can assess exposure to a foreign law. For the data you host on Bastide: | Subprocessor | Service | Location | Registered office and governing law | | --- | --- | --- | --- | | OVH SAS (OVHcloud), Roubaix | Hosting of the platform's servers | France | France | | French operator distinct from the main host | Storage of encrypted backups | France | to be named in the list | | to be named | Sending your applications' transactional emails | to be named | to be named | For Glowsoft's own processing, which does not touch the data you host: Mollie B.V. (Netherlands) for payment and card verification, and a French accredited platform for transmitting electronic invoices. Any addition or replacement of a subprocessor is notified to you by email 30 days in advance. You may object on legitimate grounds; an unresolved objection allows termination without penalty, with a free export and a pro rata refund. > **Note.** The subprocessor list and the contractual documents are under legal review before publication; the « to be named » lines will be filled in the published version. ## GDPR and the data processing agreement For your users' data, you are the controller and Glowsoft is the processor within the meaning of article 28 GDPR. The data processing agreement is part of the contract; it provides for: - processing on your instructions only: the contract, and what you do through the console, the API or your agent; - confidentiality of the authorised staff; - isolation between tenants, encryption in transit and at rest, sealed secrets, backups, an audit log, under an enhanced best-efforts obligation; - assistance with data subject requests, impact assessments and consultations of the supervisory authority, free for what the console does in self-service; - an audit on request, at most once a year, with 30 days' notice, by an independent auditor bound by confidentiality, at your expense, without access to other customers' data; - what happens to the data at the end of the contract: return through the full export, then deletion with a certificate (see [Leave Bastide](leave.md)). An agency reselling Bastide to its customers is itself their processor: Glowsoft is then a second-tier subprocessor, and only takes instructions from the agency. The edge access logs contain your visitors' IP addresses. For that processing, carried out for the security of the service and the host's legal obligations, Glowsoft is a controller, not a processor. > **Attention.** Bastide is not certified to host health data. Do not place health data collected for prevention, diagnosis, care or medico-social follow-up on it (article L. 1111-8 of the French public health code). ## The CLOUD Act and extraterritorial laws The large application hosting platforms are American: even when data is stored in Europe, their operator remains subject to US law, including the CLOUD Act. Bastide is operated by a French company, on the servers of a French host, in France. Glowsoft only discloses your data to a competent authority, on a lawful request. What this does not cover: a subprocessor on the list whose registered office would be outside the Union. That is why the list gives each one's country. ## Glowsoft's access to your data A Glowsoft operator does not access a project's data on their own initiative. They request access; the project's Owner or Administrator decides, in **Réglages** (Settings), « Accès » (Access) section. Nothing opens without that agreement, an open access is revoked in one action, and every action taken under it enters the project's **Audit** tab, in the operator's name. An agent reads and revokes these requests with the `access_request_list` and `access_request_revoke` tools. Glowsoft does not examine the content of your data, except on a report, at an authority's request or to check a technical signal, with a recorded reason (see [Acceptable use](acceptable-use.md)). ## In case of a data breach Glowsoft notifies you of any personal data breach without undue delay and at the latest 48 hours after becoming aware of it, with the information it has, then completes it as it goes. This notification leaves you time to notify the supervisory authority yourself within the 72 hours the GDPR requires of you. ## No AI model on your data The platform runs no language model. It is your agent, at the provider of your choice, that drives Bastide over MCP, with the rights you give it: Bastide does not read your data to train or query a model. Your users' data only serves to run your application. ## A verifiable software supply chain Every deployed version is a signed image, with its software bill of materials and a vulnerability scan. Builds and executions are isolated, the network is partitioned, and no inbound port is open on the runtime servers. See [Security](security.md). ## What is not acquired yet - Certifications such as ISO 27001 are planned and not obtained. They will be announced when they are. - The numeric availability commitment is not in force during the beta. - The contractual documents (terms, data processing agreement, subprocessor list, reversibility procedure) are under legal review before publication. See also: [Security](security.md), [Audit log](audit.md), [Acceptable use](acceptable-use.md), [Leave Bastide](leave.md), [Organisations](organizations.md).