FREN
Let's talk, 30 min

Security and compatible tools

Certifications, sovereign hosting, access rights and traceability: Formality is built for the most demanding organizations, and connects to your tools and your AI agents.

Key points In detail Integrations

Key points

Certifications

ISO 27001 & SOC 2 Type II, renewed every year.

Hosting

Sovereign: data stored in Europe or France (Scaleway).

AI models

Never trained on your data. Agents operate within a secure perimeter.

Access rights

Granular, for humans and agents alike: everyone only sees what they should see.

Traceability

Every answer is sourced back to its original clause and every agent action is logged: no “black box” effect.

Encryption

AES-256 at rest, TLS 1.3 in transit.

Reversibility

Full export available, in a usable format. One Clause signatory.

In detail

How we protect your contracts

A summary of our security file. The full file is available on request.

01

Data isolated per customer

Each customer has its own storage space and its own database. No public access, least-privilege principle.

02

Encryption everywhere

AES-256-GCM at rest, encrypted network flows, including inside private networks. Sensitive data (tokens) is encrypted in the database.

03

Your choice of hosting

AWS Europe (Ireland) or Scaleway France (Paris), across several availability zones. Daily backups, kept for 7 days.

04

Tightly controlled access

Google or Microsoft SSO, or a secure link sent by email: no password to manage, access cut off as soon as it is disabled on your side. At Formality, only accredited members approved by you can access your workspace.

05

Monitored infrastructure

Multi-zone Kubernetes (EKS) with separate roles, web application firewall (WAF), images updated at least monthly and scanned daily for vulnerabilities.

06

AI: you choose the provider

Mistral AI (EU, 30 days max.), Google Gemini (EU, 180 days max.) or OpenAI (United States, 30 days max.), all under a DPA. Your data is never used to train the models.

Incident management

A 7-step plan, from preparation to lessons learned. In the event of an incident: immediate notification via Slack or email, regular updates (every 24 hours) until resolution, and a full post-incident report.

Data retention

Logs kept for more than 12 months, backups for 7 days, workspace data deleted at the latest one month after the end of the contract. Error tracking (Sentry) hosted in the EU, kept for less than 3 months.

Integrations

Compatible with your tools and AI agents

AI agents · MCP

  • Claude
  • ChatGPT
  • Microsoft Copilot
  • Mistral
  • Other agents

Storage

  • SharePoint
  • DocuWare

Signature

  • Docusign
  • Universign
  • Yousign

Collaboration

  • Word
  • Outlook
  • Teams
  • Slack

CRM

  • Salesforce
  • HubSpot

ERP and internal tools: API and webhooks.

Let's talk, 30 min

FAQ

Frequently asked questions

Where is my data stored?

Data and documents can be stored in France through our partnership with Scaleway, or in Ireland, within the European Union.

Are my contracts used to train AI models?

Never. Formality's agreements with all of its AI providers explicitly prohibit any training on your data.

What happens in the event of a security incident?

You are notified immediately via Slack or email: what happened, which data is affected and what actions are under way. You then receive regular updates until it is resolved, followed by a full post-incident report.

Who can access my data at Formality?

Only accredited members of the Customer Success team, approved by you, can access your workspace. Infrastructure access is limited to four named administrators, through SSO with two-factor authentication.

Accelerate your contracts
with AI under control

Let's talk, 30 min
  • A quick diagnosis of your contract processes
  • The priority use cases for your teams
  • Usage examples from comparable companies