Security and compliance

Everything your audit will check. Point by point.

With supporting documents.

Infrastructure

Hosted on AWS, in Paris.

Your data is stored in the AWS eu-west-3 (Paris) region. Every request first goes through CloudFront and an AWS WAF application firewall: SQL injections, malicious addresses and denial-of-service attacks are stopped at the door.

AWS eu-west-3CloudFrontAWS WAFAmazon RDSTLS 1.2+ · HSTS

Isolation

A dedicated environment per client.

Each client has its own environment: private network, servers, database, storage, encryption key, entry point and firewall. Its payments go through its own Stripe account. Its data stays within this perimeter.

Dedicated VPCDedicated serversDedicated RDS databaseDedicated KMS keyDedicated CloudFront + WAFDedicated Stripe Connect

Encryption

Encrypted at rest, encrypted in transit.

Personal data is encrypted field by field with AES-256, with an HMAC-SHA256 integrity check: name, email, phone, address, bank details. Databases and backups are encrypted with AWS KMS, and the browser talks over TLS 1.2 minimum.

AES-256HMAC-SHA256AWS KMSTLS 1.2+

The rest, point by point.

Access

OpenID Connect SSO on your directory, passkeys (WebAuthn), sign-in link single-use, valid five minutes. Fine-grained roles for each team.

Monitoring

AWS GuardDuty and Security Hub (CIS benchmark), signed CloudTrail logs, Wazuh SIEM on every server. Alerts reach our security team continuously.

Backups

Automatic backups of each database, encrypted and kept 15 days, with point-in-time restore.

GDPR

Record of processing, list of subprocessors, data export on request, zero advertising trackers. Accounts anonymised 30 days after closure; retention of 1 year for logins, 3 years for messages, 10 years for accounting.

DAC7

Seller due diligence, alert before the thresholds (30 sales or €2,000 a year), file for the tax authority, summary sent to every seller.

Accounting

Accounting space with timestamped, sealed archives, standard exports for your ERP, Pennylane and Qonto links, automatic credit notes.

Payments

Stripe Connect, PCI DSS level 1 certified. Identity check of every seller before their first payout.

Automated processing

Photo reading, writing help, moderation: you choose the provider, including options hosted in Europe.

Quality

More than 3,000 automated tests on every code change, continuous dependency (Dependabot) and code (SonarCloud) analysis.

Reversibility

Full export of your data at any time. At contract end, everything is deleted, except accounting records kept 10 years as the law requires.

The documents, on request.

  • Security and architecture note
  • Data processing agreement
  • List of subprocessors
  • Works council documents: purposes, data processed, retention periods
Request the documents
Site publisher

TIMELESS LOOP
Single-shareholder simplified joint-stock company (SASU)
Share capital: €1,000.00
Registered office: 58 rue de Monceau, 75008 Paris, France
SIREN: 940 398 035
SIRET (head office): 940 398 035 00011
RCS: 940 398 035 R.C.S. Paris, registered on 06/02/2025
RNE: registered
EU VAT number: FR42940398035
Publication director: Brice Guignard
Contact: contact@timelessloop.com

Hosting

o2switch
222-224 Boulevard Gustave Flaubert, 63000 Clermont-Ferrand, France
+33 4 44 44 60 40

Intellectual property

All content on this site (texts, images, graphics, logo, icons, sounds, software…) is the exclusive property of TIMELESS LOOP or its partners. Any reproduction, distribution, modification, adaptation, retransmission or publication of these elements is strictly prohibited without the express written consent of TIMELESS LOOP.

Governing law

This site and this legal notice are governed by French law. In the event of a dispute, the French courts shall have sole jurisdiction.

In accordance with the General Data Protection Regulation (GDPR, EU 2016/679) and the amended French Data Protection Act of 6 January 1978, TIMELESS LOOP is committed to protecting the personal data of its users.

Data controller

TIMELESS LOOP, SASU, 940 398 035 R.C.S. Paris
Represented by Brice Guignard
DPO / personal data contact: contact@timelessloop.com

Data collected

Through the contact form, we collect: first name, last name, business email address, phone number (optional), organisation name, job title, plan under consideration, and any information you choose to provide in the free-text field, including the configuration prepared in the configurator. This data is collected when the form is submitted.

To protect the form against automated submissions, the Google reCAPTCHA service analyses technical information about your browsing (IP address, browser characteristics, interactions with the contact page).

Purposes of processing

The data collected is used exclusively to: respond to your request, follow up on your request commercially, contact you in the course of studying your project, and protect the form against automated submissions. Form data is never used for unsolicited commercial prospecting.

Legal basis

The processing of your request is based on your consent (Article 6.1.a GDPR), given when you submit the contact form. Protecting the form against automated submissions is based on our legitimate interest in keeping the site secure (Article 6.1.f GDPR).

Retention period

Data is kept for a maximum of 3 years from the last contact, in line with the recommendations of the CNIL (the French data protection authority) for B2B prospect data.

Recipients of the data

Your data is intended exclusively for the TIMELESS LOOP team. It is never sold, rented or transferred to third parties. It is processed by the following providers, solely for the purposes described above:

- o2switch (France): website hosting and email delivery;
- Attio (United Kingdom): customer relationship management;
- Google (United States): reCAPTCHA on the contact page, which sends it your IP address;
- Calendly (United States): only if you choose to book a call from the contact page.

Transfers to the United States are governed by the EU-US Data Privacy Framework, to which these providers adhere, or failing that by the European Commission's standard contractual clauses.

Cookies and trackers

This site uses no audience measurement or advertising cookies. No third-party analytics tool (Google Analytics or equivalent) is installed. Only technical cookies are set:

- a language cookie (tl_lang_choice), which remembers your language choice for one year;
- a session cookie on the contact page, which secures the form submission;
- Google reCAPTCHA cookies and trackers, on the contact page only, to tell a human from a bot.

Visit measurement. Pages viewed and time spent are measured on our servers, anonymously. When you arrive through a personal link we sent you, this measurement is linked to your name to follow up on our exchanges (legitimate interest, Article 6.1(f) GDPR).

Your rights

Under the GDPR, you have the following rights over your personal data:
- Right of access (Article 15)
- Right to rectification (Article 16)
- Right to erasure / "right to be forgotten" (Article 17)
- Right to restriction of processing (Article 18)
- Right to data portability (Article 20)
- Right to object (Article 21)
- Right to withdraw your consent at any time

To exercise these rights, contact us at: contact@timelessloop.com. You may also lodge a complaint with the CNIL (www.cnil.fr).

Updates

This privacy policy may be updated at any time. The date of the last update is shown at the bottom of the page. Last updated: October 2026.