Legal
Security
Last updated: October 9, 2026
Our approach
Security and sovereignty are foundations of cocoPIM, not options: the service is designed, developed and operated with end-to-end data protection requirements, from hosting in France to the fine-grained permissions in your organization.
Measures in place
Sovereign hosting
Site and service hosted in France (OVHcloud). Your catalogs stay in the European Economic Area, except for the recipients you choose yourself (connectors, API, exports). Only our payment provider and our email service may transfer billing or correspondence data outside the EEA, with the safeguards described in the privacy policy.
Encryption
Exchanges with the service (browser, API, integrations) and with the database are encrypted (TLS); internal traffic travels over an isolated private network. Infrastructure secrets are stored encrypted in a dedicated vault.
Per-customer isolation
Each organization is strictly isolated from the others, with several independent layers of defense down to the database.
Access control
Password sign-in confirmed by a one-time code sent by email, two-factor authentication available, enterprise SSO (SAML 2.0, OpenID Connect), fine-grained permissions per role and per workspace.
Audit log
Sensitive actions performed in your organization are logged and can be viewed by your administrators.
Backups & reversibility
Daily database backups, included in all plans. Full export of your catalog at any time, in standard formats.
European AI
Generative AI features rely on a European provider (Mistral AI), hosted in the European Economic Area. Your data is not used to train third-party models.
Least privilege
Internal access limited to what is strictly necessary, administrative changes logged, secrets never shared in plain text.
Personal data protection
Details of the processing operations, of the processors and of your rights are set out in the privacy policy. For the data in your catalogs, the data processing agreement (DPA) governs our role as processor.
Responsible disclosure
Think you have found a vulnerability? Write to us at the dedicated address security@cocopim.fr, describing the problem (steps to reproduce, estimated impact), without exploiting the flaw or accessing other customers' data. We acknowledge receipt within 5 business days, keep you informed of how it is being handled, and undertake not to take legal action against good-faith research carried out within this framework.