GDPR In place
Compliant by design
DPA applies to every plan, signed copy on request. Retention limited by plan, sub-processors public and dated.
Trust center Updated 3 November 2026
OKStatus security, no grey areas.
Where your data lives, who can reach it, what is in place and what is not yet. The answers we give to security reviews, openly available.
Published by ClearCloud SAS · Dijon, France · SIREN 539 932 731
Frameworks
What is in place, and what is on the way.
No badge we have not earned. What is on the roadmap is marked as such.
EU HOSTING In place
Account data in France
Platform and database at Scaleway in Paris, backups at OVHcloud in Gravelines.
NIS2 · DORA Support
Support for your obligations
Timestamps, severity classification, an external communication channel. Your own reports to your authority remain yours to file.
SOC 2 TYPE II Roadmap
No certification today
Timestamped history, documented retention, external incident communication: the direction is set, the audit is not done yet.
ISO 27001 Roadmap
No certification today
Same roadmap as SOC 2. A direction, not yet a certification.
PENETRATION TEST Roadmap
Internal test done, third party planned
Internal test in production on 3 November 2026: 7 findings, all fixed and verified the same day. A test by an independent pentester is planned.
Controls
32 controls in place, across 8 areas.
Each measure in detail, and what is not in place yet, in the Controls tab.
Infrastructure5 Platform hosted in FranceBackups at another provider See details →Encryption4 TLS 1.2+ everywhereCustomer secrets encrypted at rest See details →Access & identity4 Keycloak sign-inSAML / OIDC SSO See details →Audit trail4 Full audit logCSV export of the log See details →Backup & continuity4 RPO 15 minutes · RTO 4 hoursRestore tested every quarter See details →Software supply chain4 Images rebuilt from pinned basesVulnerability scan in CI See details →Data & privacy4 Retention limited by planJSON export at any time See details →Responsible disclosure3 security.txt publishedAcknowledged within 2 business days See details →
Sub-processors
8 sub-processors. Your account data stays in France.
Every addition or replacement is announced 30 days in advance, with a right to object (DPA, art. 2.4). 3 only take part if you turn the feature on.
- OVHcloud Backups, London probe, status pageFRUK
- Scaleway Platform, Paris probe, e-mailsFR
- Stripe PaymentsIEUS
- Google · GitHub · GitLab Social sign-inUS
- Cloudflare DNS of status.okstatus.euWW
- Browser push services Push notificationsUS
- UpCloud Regional probesDEESNLPL
- OVHcloud SMS SMS alertsFR
EU Adequacy decision Outside the EU, standard contractual clauses
Publisher & continuity
Who is behind OKStatus, and what happens if something stops.
OKStatus is published by a small team. Here is what protects your monitoring and your data.
The publisher
ClearCloud SAS, Dijon (France), SIREN 539 932 731. The managing director designs, builds and runs the service; contractors work under confidentiality agreements. The whole infrastructure is described in Git repositories.
Your data stays recoverable
JSON export at any time, on every plan. On Max and Enterprise, the REST API and the Terraform provider also retrieve the configuration. At the end of the contract, data is deleted or returned within 30 days.
If we stop the service
90 days' notice by e-mail to each organisation's owner. The service and the export stay open; prepaid amounts are refunded pro rata (Terms, article 9.3).
If the infrastructure goes down
The database is backed up continuously at another provider, kept 30 days. At most 15 minutes of data lost, back up within 4 hours at most. Restores are tested every quarter.
If OKStatus itself is down
status.okstatus.eu runs at another host, on another site, with its own probes. It stays readable when the platform is not, and publishes availability over 24 h, 7 days and 30 days.
What we do not have yet
Not yetNo certification (SOC 2, ISO 27001), no third-party penetration test yet (internal test done on 3 November 2026).
Responsible disclosure
Found a vulnerability? Write to us.
Send the steps to reproduce. Acknowledged within 2 business days, followed up, and credited if you wish. Good-faith research, without data destruction, privacy violations or service disruption, will not lead to legal action.
In scope
okstatus.eu, api.okstatus.eu, public status pages and the Rust agents.
Out of scope
Denial of service, social engineering, third-party services we do not operate.
/.well-known/security.txt Open ↗
Contact: mailto:contact@clearcloud.fr
Preferred-Languages: fr, en
Canonical: https://okstatus.eu/.well-known/security.txt
Policy: https://okstatus.eu/trust#disclosure
A security review to fill in?
Questionnaires already filled in, policies, incident plan and a signed DPA, whatever your plan.