FRRequest a demo
Request a demoLire en français

Security, confidentiality and GDPR.

Klimat gathers what employees say about their work. That data deserves the utmost care: here is how it is protected, who can access it and where it is hosted.

Respondent confidentiality

  • Results are always aggregated: an answer is never shown on its own.
  • No result is displayed for a group with fewer respondents than the confidentiality threshold set with you. A participation threshold can be added.
  • No one in your organisation can access individual answers: Empreinte Humaine hosts the data as a trusted third party.
  • The invitation link is personal so that we know who has already answered and only remind the others. Depending on your needs, an access code or an anonymous link can replace it.
  • Comment boxes remind respondents not to write anything that could identify them. A consent page can precede the questionnaire.

Hosting and architecture

  • Dedicated servers at OVH: Gravelines (France) for European clients, Beauharnois (Canada) for North American clients. Administration and backups are hosted in Strasbourg (France).
  • Each client has its own application instance and its own database.
  • Encrypted connections (HTTPS / TLS), firewall and resource monitoring.
  • Daily incremental backups, a full backup every week, and a disaster recovery plan on the backup server.
  • Invitation emails are sent through Mailgun, from servers located in Europe for European clients and in the United States for North American clients.

Access and permissions

  • Distinct profiles: administrator, advisor, team administrator, manager (read-only on their scope). Respondents have no access to the platform.
  • Rights are set organisation by organisation: visible tabs, unit scope, access to overall results and to segmentation.
  • Single sign-on with Microsoft Entra ID (OpenID Connect) or any SAML 2.0 provider (ADFS, Keycloak…). No account is created on the fly.
  • Hashed passwords, protection against common attacks (CSRF, XSS, SQL injection), sensitive operations logged and kept for twelve months.
  • The platform has undergone penetration testing, followed by remediation plans.

GDPR

  • The employer is the data controller; Empreinte Humaine acts as a processor within the meaning of Article 28 of the GDPR.
  • Data processed: first and last name, work email address or employee number, unit, profile information used for segmentation, and questionnaire answers.
  • Purposes: measuring quality of work life and preventing psychosocial risks.
  • Retention periods are set out in the Klimat privacy statement and in your contract.
  • Data subjects exercise their rights (access, rectification, objection, erasure, portability) with their employer or with Empreinte Humaine.

Documentation available on request

Technical, security and GDPR file; information security policy; security governance; Klimat privacy statement. Your IT, security and data protection teams can ask us for them to assess your project.