Konverso is hosted on Microsoft Azure cloud infrastructure, primarily located in France (Azure France Central region). This ensures that customer data remains within the European Union and benefits from Azure’s high security and compliance standards. Azure infrastructure used by Konverso is certified under internationally recognized frameworks such as ISO 27001 and HDS (Health Data Hosting). Backup data is geographically replicated within France (e.g., France Central and France South) to ensure resilience and business continuity.

Konverso implements a defense-in-depth security approach to protect customer data. All data transmitted between users, systems, and APIs is encrypted using TLS 1.2 or higher, while data stored in databases and storage systems is encrypted using AES-256. Access to the platform is controlled through strong authentication mechanisms, including SSO and multi-factor authentication (MFA). Strict access controls, environment segregation, monitoring, and centralized logging further ensure the confidentiality, integrity, and availability of customer data.

Yes. Konverso undergoes an annual SOC 2 Type II audit conducted by an independent third-party auditor (Prescient Security). This certification evaluates the effectiveness of Konverso’s security, availability, and confidentiality controls over time. The audit verifies that internal processes, infrastructure protections, and operational practices meet recognized industry standards.

Yes. Konverso conducts annual penetration tests performed by an independent cybersecurity firm (Cacilian). These tests evaluate the platform’s resistance to real-world attack scenarios and identify potential vulnerabilities. Any findings are documented, prioritized, and remediated as part of Konverso’s continuous security improvement process.

Konverso maintains clear disaster recovery objectives to ensure service continuity. The Recovery Time Objective (RTO) is 2 hours, meaning that services can be restored within two hours in the event of a major incident. The Recovery Point Objective (RPO) is 24 hours, defining the maximum acceptable data loss window. These objectives are supported by automated backups, geographic replication across Azure regions in France, and regularly tested disaster recovery procedures.

Yes. Konverso fully complies with the General Data Protection Regulation (GDPR). Konverso includes GDPR-compliant Data Processing Agreements (DPAs) in its contracts. The platform processes only the data necessary to deliver the service and implements strict security controls to protect personal data. Data subject rights such as access, rectification, and deletion are supported through formal procedures managed by Konverso’s Data Protection Officer (DPO), Amédée Potier.

No. Customer data is strictly isolated within each client environment and is not reused across customers. Konverso does not use client data to train shared AI models. When AI models are fine-tuned for a specific customer, the training data remains confined to that customer’s dedicated environment. Additional anonymization or pseudonymization options can also be implemented upon request.

Konverso retains system and application logs for up to one year (12 months). Logs are centralized, encrypted, and accessible only to authorized security personnel in read-only mode. This retention period supports security monitoring, incident investigation, and compliance requirements while ensuring traceability of system activities.

Customers can contact Konverso through several support channels, including a secure ticketing portal and dedicated support email. Standard support hours are Monday to Friday from 9:00 AM to 6:00 PM (CET). In addition, the platform is continuously monitored 24/7/365, and on-call technical teams are available to respond to critical incidents affecting service availability or security.