Security and compliance

Last updated: Oct 22, 2026

About ReachReport

ReachReport is a cloud-based PR coverage reporting platform operated by Laurent Bedubourg EI, 3 avenue des Pyrénées, 44400 REZE (France), SIREN 539947960. ReachReport is designed for reporting on published media coverage.

Security and privacy contact: Laurent Bedubourg, co-founder and technical lead, privacy@reachreport.io

Hosting and infrastructure

• ReachReport is hosted by Scaleway in Paris, France. Scaleway is ISO/IEC 27001:2022 certified.
• Physical security of the servers is managed by Scaleway; we do not operate our own data center.

Network security

• Servers are protected through network isolation: services run in containers on private Docker Swarm overlay networks, and only the services that must be public are exposed. Everything else is unreachable from outside the cluster.
• Databases are not exposed to the public internet. Administrators access them only through SSH with key-based authentication (password authentication disabled), and applications reach them only through private Docker Swarm overlay networks.

Data security

• Data in transit is encrypted using HTTPS/TLS.
• Backups are made every hour and kept for 7 days.
• Deleted data is removed from backups within 7 days.
• Database backups are stored encrypted.

Access control

• Two-factor authentication is enforced on all administrative and infrastructure systems.
• Access to production systems and customer data is limited to the founders.
• Everyone with access to customer data is bound by confidentiality obligations.

Development practices

• All code changes are reviewed before release.
• Changes are tested in a separate staging environment before deployment to production.
• Automated tests run on every release.
• Releases can be rolled back immediately if needed.
• Third-party dependencies are monitored and patched when security updates are released.

User accounts

• Users sign in with email and password, or with Google single sign-on.
• Passwords must meet minimum requirements: 12 characters, lower case, upper case, number, special character.
• Inactive sessions are signed out automatically after 12 hours.
• Account administrators can assign user roles: admin, editor.
• Two-factor authentication for users: available in settings (team enforcement planned for Q1 2027).

Data retention, deletion and export

• Customers can export all their data as CSV at any time.
• When a paid subscription or trial ends, the account moves to the free plan and its data is kept.
• Accounts without an active paid subscription and with no login for 365 days are deleted, together with all associated data.
• When a customer requests deletion (privacy@reachreport.io), we verify that the request comes from the account owner. The account and all associated data are then deleted within 7 days.
• Billing records are retained as required by law.

Incident response

If we become aware of a security incident affecting customer data, we notify affected customers without undue delay and within 72 hours.

Reporting a vulnerability

Security issues can be reported to privacy@reachreport.io. We investigate every report and respond promptly.

Personal data

Personal data is limited to user account details (name and work email) and technical logs such as IP addresses. No sensitive or special-category personal data is processed.

Artificial intelligence

AI (OpenAI) is only used to extract data from uploaded PDFs. OpenAI retains API inputs and outputs for up to 30 days for abuse monitoring. Customer data is not used for model training.

International data transfers

Customer data is hosted in the EU. Some sub-processors (OpenAI, Google Workspace, Stripe, Calendly) may process data outside the EU, mainly in the USA. These transfers are covered by Standard Contractual Clauses in each provider’s data processing terms.

Payments

We do not store card data. Payments are processed by Stripe, which is PCI DSS compliant.

Sub-processors

Certifications

ReachReport does not hold its own ISO 27001 or SOC 2 certification. Our hosting provider Scaleway is ISO/IEC 27001:2022 certified.

Documents

• Privacy policy
• Terms of service
• Data Processing Agreement: available on request.