What we do, and what we don’t promise.
For the IT lead or data protection officer who needs to form a view. No reassuring slogans: the facts, and their limits.
Signing in
There’s no password: you prove your address each time, with a six-digit code valid for 10 minutes, five attempts, single use, or through your Google or Microsoft account. A second factor is added if your account has one. Signing out closes every product at once. On Max and Full, sign-in can go through your company directory, with OIDC or SAML: we check this with you at setup.
Permissions
A role can read, create, change and bin, object by object. A hidden field stays hidden on the record, in lists, in the chat and for connected assistants. Only people who can read an inbox can read its emails, and an artefact stays private until its author shares it, administrators included.
Agents and assistants
What a third party writes reaches a Mail agent marked as data, never as an instruction, and an agent’s key never carries the right to approve. A connected assistant acts with the signed-in person’s permissions; sending email through it is off by default. A connection left unused for 14 days removes itself. No defence of this kind is absolute, which is why anything sent outside the company always waits for approval.
Logs
Every change carries the signature of the signed-in person and leaves a line in the log. Every assistant call, refusals included, is kept for six months: who, from which device, which tool, what result.
Encryption
Traffic is encrypted with TLS. Inbox connection tokens and API keys are encrypted in the database. The copy of backups that leaves the server is encrypted before it goes, with keys its custodian does not have.
Separation between customers
| Plan | How your data is kept apart |
|---|---|
| Online | One workspace per company, in a shared database. Each workspace is isolated by rules the database itself enforces, and its documents have their own storage, in France. |
| Max | A machine that is yours alone, run by us. |
| Full | Your server: one installation per company. |
If you must rule out any shared database, choose Max or Full.
Publisher access
We host your workspace on your behalf. We only open a session in it at your written request, limited in time and logged, or to meet a legal obligation. On your own server, we do not receive your data and open no inbound connection: your installation fetches its own updates, and our update tool’s access is written into the contract.
AI
The model receives the question and the passages it needs; to analyse an email, that email. By default it’s hosted in France, in the EU, by Scaleway. A model outside the Union only opens if an administrator chooses it, after a warning. A failing AI key is flagged clearly, with no silent switch to another provider.
Backups
| Data and Pro | Max | Full | |
|---|---|---|---|
| Backup | Every night | Every night | On your machine |
| Restore on request | An Escouade Day, started within 2 working days | Included, four a year | Counted in days, on your machine |
| How far back | 14 days at most | 14 days of local copies, 12 months of monthly off-site copies, 12 months of monthly off-site copies | Depends on your setup |
On Free, your export is your backup.
What we don’t promise
- A recovery point finer than the previous night.
- An uptime percentage, or a guaranteed time to restore service.
- On-call cover at night or at weekends, Max included.
- A certification: Escouade has neither ISO 27001 nor SOC 2 today.
- End-to-end encryption: the server reads your documents to file and search them.
- A penetration test by a third party: there has not been one so far.
- Automatic account provisioning from your directory (SCIM).
Documents for your file
A security question, or a vulnerability to report: contact@escouade.io. Personal data: dpo@escouade.io.