Security Policy

Enabled for Godia.ai administrator accounts. Each client can require it for all accounts of its organisation; it can also be enabled individually (Profile, Security). 6-digit code at each login, compatible with common authenticator apps, 10 backup codes generated at activation. For Google or Microsoft sign-in, two-factor authentication is that of the organisation's identity provider.

OAuth 2.0 / OpenID Connect with Google and Microsoft, Authorization Code flow with PKCE.

Three roles: Owner (full access), Admin (administration and configuration), Member (operational use), complemented by 8 granular permissions (canViewAnalytics, canManageAgents, canViewConversations, canViewProspects, canManageTeam, canManageBilling, canExportData, canViewCopilot). The canExportData permission is checked server-side for every export (HTTP 403 refusal).

Daily job: warning after 60 days of inactivity (INACTIVITY_WARNING event), revocation of all sessions after 90 days. Each event is timestamped in the audit log.

All connections are encrypted with HTTPS (TLS). HSTS enabled (max-age=31536000; includeSubDomains; preload); any HTTP request is redirected to HTTPS. The connection between the application and the database is also encrypted.

OAuth tokens, integration credentials, secrets and two-factor keys: application-level AES-256-GCM encryption before storage. Passwords: bcrypt hashing (12 rounds). Database: encryption at rest by the hosting provider. Encrypted backups.

Signed with RS256, with automatic rotation of signing keys and immediate revocation of invalidated tokens. Never transmitted in clear text.

AES-256-GCM master key (32 bytes, scrypt-derived) kept as an environment secret at the hosting provider, never in the code. Planned annual rotation and immediate rotation upon a security event.

Format godia_live_<32 bytes base64url> (or godia_test_). Only the SHA-256 hash is stored; the key is shown only once, at creation.

Global: 3,000 requests per 15 minutes per IP address. Login: 5 attempts per 15 minutes, then a 30-minute block. API v1: 1,000 requests per hour per key. Audit log exports: 10 per hour per organisation. Godia Pilot module: 60 changes per minute per IP address. Agent messages: per-visitor hourly cap.

HSTS, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Content-Security-Policy with default-src 'self', object-src 'none', base-uri 'self' and frame-ancestors ('self' on the portal, open on widget routes for embedding in clients' websites). unsafe-inline is still tolerated for the portal; a move to a nonce-based policy is planned. X-Frame-Options: DENY on the portal and API. Restrictive Permissions-Policy (camera, geolocation, payment and USB disabled; microphone reserved for the optional voice agent).

Synchroniser token checked server-side on every route that changes data; session regenerated at login.

Strict allow-list of origins; only the widget APIs are open, so that it can be embedded in clients' websites.

Mistral AI models called through its European endpoint; training on our data disabled; experimental models disabled; zero retention of conversation content at Mistral AI.

Replies grounded in the knowledge base validated by each client; automatic check of sensitive facts (opening hours, deadlines, contact details) before display; a barrier that blocks any attempt to make an agent reveal its internal instructions.

In case of an error on a model, automatic switch between Mistral models (small, medium, large). No silent switch to another provider.

Four tables that cannot be modified from the interface: auth_events (logins, two-factor authentication, revocations), 90 days; access_logs (access to sensitive data, administrator actions), 90 days; client_activity_logs (portal actions), 30 days; alert_history (security alerts), 90 days.

JSON or CSV export from the portal, filtered by period and event type, limited to the organisation and subject to the canExportData permission, compatible with common SIEM tools.

Five active rules: brute-force login attempts, CSRF violations, breaches of client separation, invalid tokens, suspicious activity; plus daily detection of inactive accounts. Immediate email notification.

npm audit on every code change and every week (workflow security-audit.yml); the pipeline fails on any high or critical vulnerability.

Critical: 48 hours. High: 7 days. Medium: 30 days. Low: next release.

Internal audit against the OWASP Top 10:2025 and the OWASP Top 10 for large language model applications (February 2026, updated April 2026). Report available upon request, under a confidentiality undertaking.

Internal security testing at each major release. A penetration test by an independent external provider is part of our planned improvements.

Programme described on our dedicated page. Report to legal@godia.ai, reply within 48 hours.

Zod schemas on API routes; non-conforming data is rejected.

Parameterised queries through the Drizzle ORM.

Every sensitive change (authentication, client separation, cryptography, agent behaviour) is independently verified and tested before going to production, with immediate rollback available.

Hosting provider environment variables, never in the code or the repository.

Production and development are separated (distinct databases and variables). A dedicated staging environment is planned.

Contractual recovery time: 4 hours at most. Maximum data loss: 24 hours, with point-in-time restore. Automatic application restart for common incidents.

99.5 % per month, guaranteed; 99.9 % by contract. See our SLA. Real-time status: status.godia.ai.

Daily encrypted backups, managed by the database provider, replicated within the European Union.

Detection through alerts, qualification, information of affected clients (within 4 hours for a critical incident), remediation, post-incident report.

Available in the client portal, with timeline, impact and corrective measures.

For data processed on behalf of a client, Godia.ai informs the client without undue delay and provides the information it needs to notify its supervisory authority within 72 hours (Article 33 GDPR). For processing for which Godia.ai is the controller, notification is made to the CNPD.

Level 1: ticket from the portal. Level 2: support@godia.ai. Level 3: technical management. Security emergency: legal@godia.ai (4 hours for a critical incident).

DPIA-GODIA-2026-001, version 1.2 (October 2026): six processing operations described (conversations, collection of requests, visitor files, accounts and logs, API keys, connected mailboxes), risks assessed before and after measures, healthcare and public sector section. Available upon request. Next review: October 2027.

Available before any contractual relationship: DPA, signed version upon request at legal@godia.ai.

Register of ICT providers, post-incident reports and audit log export available to clients subject to the DORA regulation.

Complete data export upon request within 30 days of termination, permanent deletion within 60 days, unless a legal obligation applies. Data exportable in JSON or CSV, standard PostgreSQL format.