SECURITY, HOSTING AND DATA
Four perimeters, and what separates them.
People often merge four different things: the site you are reading, the message you send us, the site assistant, and your company’s decision file. They are hosted and processed differently.
This page describes what can be verified on the published site, and sets out the substance of the commitments made on your file. Those commitments themselves are made in your contract.
PERIMETER 1
The public website
innovatio.io is a static site: pages are built in advance and served as they are. It runs no business processing and holds no client data.
- Host
- Vercel Inc., a Delaware corporation, United States, registration number 5857312, 440 N Barranca Ave #4133, Covina, CA 91723.
- Nature of the site
- Pre-built static pages. No account, no signed-in area, no visitor database.
- Transport protection
- HTTPS enforced, strict transport security, a content security policy, and protection against framing inside a third-party site.
- Audience measurement
- Google Analytics 4 only after explicit consent, which you can refuse and withdraw. The choice is kept for six months. No URL parameter is sent or recorded.
You can refuse audience measurement without losing access to anything on this site.
PERIMETER 2
The data you send us
What you type into the contact form, or the address you add to the newsletter. Nothing is sent until you submit it yourself.
- What is transmitted
- For contact: name, company, email address, decision context and the path of the originating page. For the newsletter: email address and the language you chose, with mandatory email confirmation.
- Technical recipient
- Brevo, to deliver the message to Innovatio and to run the newsletter. Brevo’s processing is governed by its own terms.
- Retention
- The site creates neither an account nor a customer record. Messages are kept for as long as it takes to handle and follow up the exchange. The newsletter address is kept until you unsubscribe.
- What is never transmitted
- No free-text field from the form is sent to audience measurement. No personal data is placed in a page address.
Access, rectification, erasure, objection: write to contact@innovatio.io.
PERIMETER 3
Artificial intelligence processing
The site provides for an assistant able to answer from published pages. It is not active today, and no provider has been retained.
- Current state
- The assistant is switched off. No question is sent to an AI provider, and no provider name appears anywhere on this site.
- On the day it is switched on
- The provider retained will be named on the legal pages before any use, together with its country of establishment.
- What the assistant will be able to see
- Your question and excerpts from pages that are already public. Nothing else: not the form fields, not a document you sent us, and not one element of a client file.
- Behaviour when in doubt
- The answer is built from quotations verified word for word against the site’s pages. Without a verifiable source, the assistant declines to answer rather than invent.
No client file data feeds or trains a model.
PERIMETER 4
Our clients’ decision files
This is the most sensitive perimeter. This site carries none of it: the commitments that cover it are made in your contract, and here is what they say.
- What this site does not contain
- No document, figure, scenario, assumption, score or arbitration belonging to a client. The examples and screenshots published are demonstration sets, built for illustration.
- Where the files live
- In the suite’s spaces, on a technical perimeter separate from this public site, with no read path between the two.
- Data location
- The infrastructure hosting the files is settled in the contract, with a written commitment to a location within the European Union. That commitment covers your files, not the public site, which is hosted in the United States and described in perimeter 1.
- Backups, retention, export
- Set in the contract, file by file: backups, retention period, export formats and terms, and definitive deletion at the end of the engagement.
- Return and erasure
- On a simple written request, Innovatio returns all the data in a usable format and deletes the copies it has kept, within the period agreed in the contract.
- What stays off this page
- The technical measures specific to your own deployment: they depend on your perimeter and are given to you in writing before signature. We do not publish a generic arrangement or period that would not hold for your file.
If your IT department or data protection officer has a questionnaire, send it: we answer it on your file, in writing.
A SPECIFIC QUESTION
Preparing a security review?
Write to us with the exact perimeter you have to cover. We reply in writing within two working days, on your file rather than from a generic template.
Write to us