Security and privacy: our commitments

Why this page exists

Editorial tools handle two kinds of sensitive data: yours (drafts, briefs, still-confidential ideas, internal documents) and your readers' (email addresses, preferences, reading behaviour). A platform that does not treat both families seriously has no place in a professional team.

Here are our commitments, in plain language, without jargon.

European hosting

All services that handle your data are hosted in the European Union, with a provider subject to European law. Concretely, this means your data does not leave the European Economic Area without your consent, and no extra-European jurisdiction can access it by default.

This is a structural choice, not an option. It has a cost, but we believe the trust it enables justifies that cost.

GDPR compliance

GDPR governs how we collect, store and use personal data. We comply on the key points:

• Minimisation: we collect only what is strictly necessary for the service.
• Purpose: every piece of data has a reason to be stored, and we don't repurpose it.
• Retention: data is kept for the necessary duration, then deleted.
• Rights: access, rectification, deletion, portability — all GDPR rights are accessible from your account.

Access control

Within your organisation, you decide who can do what. We offer several permission levels (read, write, approval, administration) and a role system that lets you separate what should be separated: writers don't need to see billing, administrators don't need to edit briefs.

This granularity matters as the team grows. A tool that doesn't distinguish roles becomes a risk past three or four people.

Strong authentication

We support two-factor authentication and strongly recommend enabling it on all administrator accounts. The password alone is no longer sufficient protection in 2026, and we won't pretend otherwise.

Google sign-in is also available to ease day-to-day use without compromising security, and every new account is verified at signup with a one-time code sent by email — so an address that can't receive mail can't open an account.

Encryption

Data exchanged between your browser and our servers is encrypted in transit with TLS. Stored data is encrypted at rest with AES-256. This doesn't exempt us from every other good practice, but it's a non-negotiable foundation.

What this looks like day to day

Imagine a newsroom preparing an investigation into a local public contract. The team uses the platform to collect documents, draft the brief and write the first version. A few things happen along the way:

• The two reporters on the story can write; the section editor can approve; the freelance photographer only needs to see the brief, so they get read access and nothing more.
• An intern joins the desk for the summer. Their account doesn't give access to billing or to organisation settings, because nothing in their work requires it.
• When the investigation is published and the freelancer's contract ends, an administrator removes their access the same day.
• The administrator who manages all of this has two-factor authentication enabled, so a leaked password on its own isn't enough to take over the account.

None of this is exotic. It is ordinary hygiene, and it only works if the tool makes it easy and the team makes it a habit.

Your side of the work: a checklist for administrators

Security is shared between the platform and the people who use it. Here is what we recommend every organisation checks regularly:

• Two-factor authentication is enabled on every administrator account, and ideally on every account.
• Roles match reality. Review who has which permission at least once a quarter, and whenever someone changes jobs.
• Leavers lose access on their last day. Former staff and freelancers are among the most common forgotten accounts.
• Nobody shares a login. Shared accounts make it impossible to know who did what.
• Sensitive details stay out of briefs unless they are needed. A source's personal phone number rarely belongs in a shared document.
• Contact details are current, so that any security notice reaches someone who can act on it.

Exercising your GDPR rights

You don't need to write a formal letter to use your rights. In practice:

1. Sign in and open your account settings, where access, correction, export and deletion are available.
2. If your request concerns data you can't see there, or if you are a reader rather than a customer, contact us through the dedicated form.
3. Say clearly what you want (a copy, a correction, a deletion) so we can handle it without back-and-forth.

Questions to ask any editorial tool

Whether you are evaluating us or someone else, these questions are worth asking before you trust a platform with drafts and reader data:

• Where is the data hosted, and under which jurisdiction?
• Is data encrypted in transit and at rest, and with what?
• Can permissions be separated by role, or does everyone see everything?
• Is two-factor authentication available for all users?
• How, and how quickly, will you be told about a security incident?
• What happens to your data when the contract ends?
• Is your content used for any purpose other than providing the service to you?

A vendor who answers these clearly and in writing is usually one you can work with.

Transparency

In the event of a security incident, we commit to inform you quickly and honestly. No corporate fog, no minimisation: direct information lets each side take appropriate measures.

It is an easy promise to make and a hard one to keep. We prefer to write it here rather than quietly forget it.

And beyond?

Perfect security does not exist. Our job is to reduce risks as far as possible, stay vigilant, and acknowledge that what was sufficient yesterday won't be sufficient tomorrow. It's continuous work.

For specific questions about our practices, contact us through the dedicated form.

Key takeaways

• Your data is hosted in the European Union, under European law.
• Data is encrypted in transit with TLS and at rest with AES-256.
• Roles and permissions let you give each person only the access they need.
• Two-factor authentication should be on for every administrator.
• Security is shared: review access regularly and remove leavers promptly.