Security policy
Last updated:
This document is also available in French. In the event of any discrepancy between the two versions, the French version prevails.
On this page
At GRENIER SOLUTIONS, we take a pragmatic and transparent approach to security. We understand that every project is unique: the protective measures put in place on our infrastructure, our hosting and the platforms we develop are proportionate to the sensitivity of the data being processed and to the specific agreements made with our clients.
Our security posture
Proportionate security and encryption
We apply basic industry standards for web communications (HTTPS/TLS). However, encryption of data at rest and high-security architectures depend on how critical the platform is. Not all of our systems require, or include, end-to-end encryption by default.
Development and integration
We apply development best practices suited to each mandate. We do not perform systematic penetration testing on all of our platforms, unless it is explicitly included in a specific service contract with a client.
Authentication and access
When integrating with third-party services (e.g., Google, Microsoft), we use standard sign-in protocols (such as OAuth) to limit the exposure of passwords. Our clients' administrators remain responsible for managing their own users' access.
Monitoring
We have standard monitoring tools to check the availability of our hosted infrastructure and of our client portal, as well as to detect basic traffic anomalies. We respond to technical incidents according to the agreed service levels.
Our own infrastructure
We apply to our own systems what we recommend to our clients: strong authentication on our accounts and access (two-factor authentication, passkeys, hardware security keys such as YubiKeys, or SSH keys for servers), a network segmented with VLANs behind a firewall, administrative access through VPN only, backups kept off-site with tested restores, and availability and error monitoring hosted on our own servers.
Vulnerability disclosure program (VDP)
While we adapt our security to each project, we remain open to the community. If you find a vulnerability on our public website, our portal or any of the platforms hosted by GRENIER SOLUTIONS, we invite you to report it to us responsibly.
Incident / vulnerability report
Please include the steps to reproduce. We will review your report as soon as possible, based on the severity of the issue.
Authorized scope and rules of conduct
For your research to be considered ethical and lawful, you must strictly follow these rules:
- Only test accounts and systems that belong to you or that you are authorized to test.
- The use of automated scanners or any denial-of-service (DDoS) attempt that affects our performance is strictly prohibited.
- Exfiltrating, modifying or destroying client data (whether secured or not) is a serious violation and is entirely excluded from this program.
- Give us a reasonable amount of time to fix the vulnerability before discussing it publicly.
We do not have a reward program ("bug bounty"). For a valid and significant report, we may nevertheless offer a thank-you, at our discretion.
Security file (security.txt)
- Preferred languages
- French, English
- Document expiry
- 2027-08-31T18:00:00.000Z
- security.txt URI
- /.well-known/security.txt
Changes to the security policy
The rapid evolution of technologies and of IT threats requires our practices to adapt continuously. GRENIER SOLUTIONS reserves the absolute right to modify, revise or update this security policy at any time, at its sole discretion and without notice. Changes take effect upon their publication on this page. Continued use of our services and platforms following such changes constitutes your full acceptance of them.