1. Encryption of sensitive data
Your patients' personal information (name, email) is encrypted in the database using the AES-256-GCM algorithm, the encryption standard used by government and financial institutions. This encryption ensures that even in the event of unauthorized access to the database, patient data remains unreadable and unusable.
2. Encrypted communications
All communications between your browser and our servers are encrypted using the HTTPS/TLS protocol. This ensures that the data exchanged cannot be intercepted or modified in transit.
3. HDS-certified hosting
We store only the data strictly necessary for the service. This data is hosted by Scaleway, a French provider certified HDS (Hébergeur de Données de Santé, certified health data host). This certification guarantees the highest level of security for health data, in accordance with French and European regulatory requirements. No patient data is shared with third parties.
4. Monitoring and incident detection
We use monitoring tools to detect and respond quickly to any suspicious activity. Errors and anomalies are tracked in real time, allowing us to take immediate action if a problem occurs.
5. Secure payments
Financial transactions are handled entirely by Stripe, a global leader in online payments, certified PCI-DSS Level 1. We never store your banking information on our servers.
6. Restricted access to data
Access to production data is restricted to a single person, which considerably limits the risk of leaks or unauthorized access. No external service provider has access to your data. Every access is logged and auditable.
7. Updates and security monitoring
Our application and its dependencies are regularly updated to fix known vulnerabilities. We follow OWASP recommendations and constantly monitor security threats.
8. Protection against brute-force attacks
Our authentication system includes protection against malicious login attempts. After several consecutive failures, the account is temporarily locked for a period that increases progressively. This measure prevents attackers from guessing your login codes while remaining transparent to legitimate users. Our team is alerted in real time to any suspicious activity.
9. Securing your mailbox
Questionnaire results are sent to you by email. Make sure your mailbox is secure: we recommend using encrypted services such as ProtonMail. If you prefer not to receive the scoring by email, you can turn off this option in "My account".
10. Security contact
If you discover a security vulnerability or have questions about our security practices, contact us at contact@mentaal.fr. We take every report seriously and are committed to responding as quickly as possible.