Security questionnaire responses

1. Where is the tax data processed by the tool hosted?

Nowhere. The 2259-SD return (entity names, SIRENs, TINs, amounts, elections) is stored exclusively in the user's browser (IndexedDB, localStorage mirror). There is no database of returns, no transport of tax data to any server, no copy held by the publisher.

2. What data passes through the publisher's servers?

Only: the access code (no account, no user email), random technical tokens (a device token, opaque filing identifiers for quota counting — UUIDs with no content), and the SIREN queried through the Sirene proxy (public INSEE data, called server-to-server).

3. Where are the servers located, and who are the subprocessors?

Application and PostgreSQL database: Railway (US company), servers in the European Union (Amsterdam, Netherlands) — access codes and security logs only. Static editorial site: Cloudflare Pages. Access-request form: Web3Forms (relay to the publisher's mailbox). None of these providers receives tax data, which never leaves the browser.

4. Is data encrypted in transit and at rest?

In transit: TLS across all domains. At rest: tax data resides on the user's machine, under the user's own security policy. Exported backups are encrypted with AES-256-GCM using a key derived from the user's password (PBKDF2), with encryption running in the browser.

5. What trackers, telemetry or third-party services are embedded?

None in the application: no analytics, no tracker, no third-party error-reporting service. The Content Security Policy enforces connect-src 'self': the browser cannot issue any fetch/XHR request to a third-party domain (verifiable in the Content-Security-Policy header). The only third-party resources loaded: country-flag images (flagcdn.com), with no cookie.

6. How is access to the application secured?

Access by a named, invitation-issued code, limited in number of devices (a random device token per browser). httpOnly, secure, sameSite cookies; CSRF protection; per-IP rate limiting on sensitive endpoints; scripts locked by a per-request nonce (CSP strict-dynamic); frame-ancestors 'none'.

7. How is the conformity of the produced file guaranteed?

The GIR XML file is validated against the official GLOBEXML 1.0 schema and run through the DGFiP checks (Annexe 3) directly in the browser, before filing. The PDF check report and the SHA-256 hash of the file are generated locally, ready to annex to the audit file.

8. What about reversibility? How is data deleted?

The output format is the official GLOBE_OECD XML — re-importable into any conformant tool, with no proprietary format. The encrypted export allows archiving or moving to another machine. Deletion is immediate and local: clearing the browser's data removes all returns, since no server copy exists.

9. What certifications are held?

No ANSSI certification, CNIL label or SecNumCloud qualification is held or claimed to date. The security position rests on the architecture (no server-side processing of tax data), every statement above being technically verifiable by your teams.

Information document issued by Decuma SAS; it constitutes neither a contractual commitment nor legal advice. Detailed processing: privacy policy (in French) · online version: pilier2xml.com/en/securite/.