The technical measures protecting the data you entrust to us, and how to report a flaw to us.
This policy describes the measures applied to the services we operate: the wavatec.fr website, the client portal and the Elyys360 platform. It does not cover the third-party products we resell, whose security is their publisher's responsibility.
All exchanges with our services use HTTPS. No cleartext access is offered, and certificates are renewed automatically.
Clients sign in through a single-use link, valid for fifteen minutes and sent to their work address: there is no client password to remember, and none to steal. Tokens are never kept in cleartext — only their cryptographic digest is stored, which makes a database leak useless for signing in. Administration accounts require a password, kept as a hash computed with an algorithm designed to resist brute-force attacks. Attempts are rate limited, and failures answer identically whatever their cause, so nothing is revealed about whether an account exists.
Every portal request is bound to the session's company, and filtering is applied at the source, in the data-access layer rather than in each screen. An account therefore cannot reach another company's data, even if a page contains a development error.
Audience measurement on the public site stores no IP address: only the originating network, at /24, and a daily fingerprint used to count distinct visitors. Audience data is deleted automatically after ninety days. Files uploaded by clients are stored under random identifiers and are reachable only through an authenticated route, never at a guessable public address.
Public entry points — sign-in link requests, the contact form, meeting booking — are protected by an anti-automation challenge and by per-visitor rate limiting.
If you find a flaw in one of our services, write to contact@wavatec.fr describing how to reproduce it. We acknowledge receipt, qualify the report and keep the reporter informed until it is fixed. We will take no action against research conducted in good faith, provided it involved no exfiltration of third-party data, no service degradation, and no public disclosure before the fix.
