Where is Evalmee hosted?

We are hosted by cloud service providers such as Scaleway (France) and AWS France (France). Our hosting providers apply strict infrastructure security measures and hold numerous certifications, which you can find on their respective websites:

• AWS: https://aws.amazon.com/security/

• Scaleway: https://www.scaleway.com/en/security-and-resilience/

Is customer data encrypted?

Yes, all customer data is encrypted at rest and in transit:

• In transit: we use the HTTPS protocol (TLS 1.2 / TLS 1.3) to encrypt all traffic to end users.

• At rest: sensitive data is encrypted at rest (AES-256) or hashed, in line with industry standards.

Which other third-party services process the data?

We only share your data with certain companies that help us improve our services for you. You can see here the complete list of our subprocessors.

How does Evalmee protect itself against common web application vulnerabilities?

Our infrastructure includes the following protections:

• All services run behind Cloudflare, which provides built-in DDoS protection and rate limiting

• All traffic is routed over HTTPS

• Our infrastructure is spread across multiple zones and is secured through:

  • The use of virtual private clouds (VPCs)

  • A firewall that controls incoming and outgoing network traffic

• Server access is limited to authorized members of the Evalmee team and uses a username and key, to rule out brute-force password attacks

• Evalmee is automatically notified of vulnerabilities found in the software components we use, so that we can apply the necessary updates quickly

• All members of our team are familiar with common web application vulnerabilities, and we always design our systems and code with a defense-in-depth approach

In short, we follow OWASP best practices and regularly review our infrastructure and code for vulnerabilities.

Data Processing Agreement (DPA)

We offer a Data Processing Agreement (DPA) that clearly defines the respective responsibilities and obligations regarding the protection of personal data, in accordance with GDPR requirements. The DPA is available at this link.

To get a signed copy, please contact us at support@evalmee.com .

Is Evalmee GDPR compliant?

Yes, Evalmee is fully GDPR compliant. The security of your personal information and respect for your privacy rights are extremely important to us.

We are fully committed to protecting personal data and ensuring compliance with the General Data Protection Regulation (GDPR).

If you would like to know more about your data, change something, or even ask us to delete it, we are here to help. You can chat with us live on our website or send us an email at support@evalmee.com