Security and data protection charter

The Opcard dashboard holds our clients' business contacts. This charter sets out our commitments to protect them. The detailed security sheet is provided on request to our clients and to organisations assessing our solution.

Article 1.Hosting and data sovereignty

• Hosted in France, with a French hosting provider.
• No transfer outside the European Union. Only the data a client chooses to send to their own tools (calendar, CRM) goes elsewhere.
• No resale, no advertising use. No advertising or audience-measurement cookies.

Article 2.Encryption

• Encryption of all exchanges between the user and the service, enforced on every page (HTTPS and HSTS).
• No secret stored in plain text: codes and passwords are only stored as encrypted fingerprints.

Article 3.Access control

• Two-factor authentication: each dashboard is protected by a personal link and the user's own access code; every new device must be authorised.
• Protection against repeated-attempt attacks, with automatic locking and an alert to the holder.
• Control by the user and the manager: signing out devices, changing the code, instantly cutting off an employee's access, controlling exports.
• Restricted administration access, protected by strong authentication and limited to interventions requested by the client or strictly necessary.

Article 4.Application and infrastructure security

• Application protections against common web attacks: request forgery, session hijacking, malicious framing, trapped files.
• Data out of reach from the Internet outside the pages intended for its holder.
• Service accounts protected by strong authentication, and server access exclusively encrypted.
• No bank details at Opcard: payment is handled by a specialised, PCI DSS certified provider.

Article 5.No access to the client's information system

• Nothing is installed on computers or phones: Opcard runs in the browser, isolated by it.
• No access to our clients' network, files or e-mail; Opcard never asks for their passwords.
• Optional links (calendar, CRM) activated only by the client, limited to what is strictly necessary and removable at any time.

Article 6.GDPR compliance

• Processor under Article 28: for its users' contacts, the client is the data controller; Opcard acts only on its instructions.
• Data breaches notified to the client without delay, and no later than 48 hours after detection.
• Individuals' rights: each contact can be edited, deleted and exported from the dashboard.
• End of service: export at any time, deletion no later than 30 days after the dashboard is deleted.
• Signed data processing agreement provided on request; audit possible by an auditor bound to confidentiality.

Article 7.Contact

To receive the detailed security sheet or the data processing agreement: contact@opcard.fr. For details of the data collected and your rights, see our privacy policy.

Opcard is a service published by Sébastien Couchard, sole trader (trading name Agence 213), 1 chemin du Prieur, 89140 Michery, France · SIRET 539 597 922 00076.