Security & privacy

Security tailored to the project

INOBIC combines software development, cloud architecture and targeted technical reviews. Least privilege, environment separation, secrets management and traceability guide our recommendations. Applicable measures are agreed with the client based on their context.

Test authorisation

Before any engagement, the scope and written authorisation identify applications, resources, environments, accounts, permitted methods and exclusions. An operational contact and stop conditions are defined. The client must hold the necessary rights; third-party systems are not tested without their owner’s authorisation.

Environment access

Requested access is limited to the engagement’s needs and duration, and is read-only where sufficient. Named accounts and multifactor authentication are preferred where supported. End-of-engagement revocation and exceptional access are agreed with the client.

Information confidentiality

Confidentiality arrangements, deliverable recipients and transfer channels are agreed before receiving sensitive material. Do not send source code, secrets or production data through the public form. A suitable channel is agreed for technical exchanges.

Handling sensitive data

Data reviewed and evidence collected are limited to what is necessary. Report evidence is stripped of secrets and unnecessary personal data. Storage location, authorised people, retention periods and deletion or return are defined for the engagement. Any use of an external tool to process confidential information must be agreed in advance.

Findings and responsible disclosure

Findings are used to prioritise and verify fixes. Vulnerabilities found in a client’s systems are shared with authorised contacts; exploitable details and client data are not published without agreement. To report an issue on this website, email contact@inobic.fr with the URL and a general description, without secrets or personal data. A suitable exchange will be arranged if sensitive details are needed. This contact does not authorise testing.

Report a security issue

Company identity and services

INOBIC is a French simplified joint-stock company (SAS), SIREN 100546175, registered at 200 Rue de la Croix Nivert, 75015 Paris. Services are scoped according to available skills and resources. This page describes the proposed engagement framework; it is neither a certification nor a guarantee that vulnerabilities are absent.

View our Azure certifications · Check the company’s identity

Discuss your needs

Request an audit

Legal notice · Website privacy policy

Documented, verifiable changes

See how we improved the security of our own website: configuration changes, HTTP checks on the live site and form tests. The documented case study is accompanied by a separate .NET learning lab.

Evidence-backed audit practices

Written authorisation, risk-based checks, collection of only the evidence needed, and verification of fixes. Our method also records checks that were not performed and risks that remain unresolved.