Security and data protection in Boussole

Strict data isolation: each client only sees their own data.
Organisations and roles: you decide who in your team can access what.
Deletion on request: your data can be deleted on simple request.
Compliant cookie banner: no advertising tracking.
No AI, no black box: the score relies on explicit, readable rules.

Boussole is hosted and run by me. Here is what governs your data, and what remains to be specified before launch.

The principles

Topic	Information
Hosting	OVH SAS (virtual private server); Strasbourg (SBG) region, France
Access to your Google accounts	Read-only access to Google Search Console; read and reply access to reviews on Google Business Profile. Access is granted by you via OAuth and can be revoked at any time from your Google account or by disconnecting the account in Boussole.
Backups	Daily automatic backups, encrypted (our storage providers never access them in clear text), kept off the production server, in the European Union and Canada (an adequate country), tested for restorability; retention aligned with the source data.
Technical security	Encryption in transit (TLS); hashed passwords; revocable sessions; logging of access and sensitive actions; secrets kept out of the repository.
Processors	OVH (hosting, France), Stripe (payment), Brevo (email), Google (Search Console and Business Profile APIs, at your initiative), Cloudflare (anti-bot protection and encrypted backup storage, EU), Backblaze (encrypted backup storage, Canada).
Retention periods	Retention limited to the legal minimum; after cancellation, operational data is removed by the automatic purges (within three months) and emails after your request has been handled.
Contact for your rights	dpo@arketips.fr

For business customers: a GDPR-compliant data processing agreement (DPA) is provided on request.

Write to me: I will answer before you subscribe.