Security
Your data is protected, and you see who touches it
Servers in France, partitioned workspaces, two-factor authentication, an audit log: this is what is in place today. We hold no security certification (ISO 27001, SOC 2…) at this time; we would rather describe the measures than display a badge.
14 days of Solo free, no card.
Audit log
Who did what in your workspace, you can find it
Every change is recorded: who, when, on which resource. You filter by actor, category or period, and export the whole log as CSV.
- Reserved for the workspace's owners and administrators
- Entries are kept for 12 months; no request content or IP address is recorded
- Your own sign-ins and security changes are in Account, Activity, with a "Not me?" link
AI assistants and connectors
You cut an app's access in one click
When you plug in an assistant such as Claude, ASAP shows what it asks for before you authorize it. Afterwards, your connections list shows each app, its permissions and its last use.
- The permissions are the ones you grant, in the workspace you choose
- An app can be disconnected at any time, and its access is revoked immediately
- The revocation appears in the audit log
Your data
You export your data and delete your account whenever you want
The export is a ZIP archive of your personal data as JSON, with a file that explains every field. Deletion takes effect after 30 days, during which you can change your mind in one click.
- No secret (password, backup codes) in the export
- A workspace's documents are exported from each app
- Finalized invoices are kept for 10 years, as the law requires, with no link to your sign-in identity
What protects ASAP under the hood
Servers in France
The platform runs in Docker containers on a virtual private server from PrivateHeberg (ANCELADE SAS), located in France. No inbound port is open: traffic arrives through a Cloudflare tunnel.
Encryption in transit
Traffic with asap.cool, app.asap.cool and the API is encrypted with TLS (HTTPS), with HSTS enabled on the application.
Passwords and secrets
A password is never kept in clear, only as an argon2id hash. Your two-factor secret is encrypted before it is saved, and operating secrets are encrypted with sops and age.
Partitioned workspaces
The tables that hold a workspace's data are protected by PostgreSQL Row-Level Security. A query can only read the rows of the workspace the session is opened for.
Payments by Stripe
Card numbers are entered in Stripe's own components and neither pass through nor are stored at ASAP. Notifications from Stripe are accepted only after their signature has been verified.
Encrypted backups
The database is backed up by a script that produces an encrypted export (age). The backup and restore are replayed every week on an empty database, to check that data, schema and isolation rules come back correctly.
Two-factor authentication
Turn on two-factor authentication (TOTP) with an authenticator app. Ten single-use backup codes are generated so you can get back in if you lose your phone, and passkeys sign you in without a password.
Devices and alerts
A trusted device skips the two-factor code for 30 days; you remove them one by one or all at once. A sign-in from a new browser triggers an alert email.
Lockout and sessions
Five failed sign-ins lock the account for 15 minutes, and the authentication routes are rate-limited. Sessions are opaque tokens kept on the server, in a cookie that page scripts cannot read, with CSRF protection.
Subprocessors
The providers that process data for ASAP
These are the providers involved, with their role and location. The detail is in the privacy policy (in French).
- Stripe
- Subscription payments (Ireland / United States (SCCs))
- Resend
- Transactional emails (United States (SCCs))
- Cloudflare
- Content delivery and network protection (European Union / United States (SCCs))
- Mistral AI
- AI assistance features (invoicing assistant, e-mail drafts) (Paris, France (hosted in the European Union))
- Sentry
- Error monitoring (United States (SCCs))
- Axiom
- Technical logs (United States (SCCs))
- PrivateHeberg
- Platform hosting (France)
Responsible disclosure
Report a vulnerability
Found a flaw? Write to us (French or English) describing the problem and how to reproduce it, without accessing or changing other people's data. Give us a reasonable time to fix it before any public disclosure.
- We acknowledge receipt and come back to you as soon as we can
- Out of scope: denial of service, social engineering and any breach of others' data
- There is no bug bounty programme; we are happy to thank the people who would like that
Frequently asked questions
Security — what people ask us
Where is my data hosted?
On a virtual private server from PrivateHeberg (ANCELADE SAS), in France. A few providers operate outside that server (payments, email, monitoring, network): they are listed above with their location.
Is ASAP ISO 27001 or SOC 2 certified?
No. ASAP holds no security certification at this time. This page describes the measures in place; we would rather do that than display a badge.
Can anyone else see my workspace's data?
Each workspace is partitioned in the database by PostgreSQL Row-Level Security: a query can only read the rows of the workspace the session is opened for. In your workspace, the audit log shows owners and administrators who did what.
What happens if I lose my phone?
When you turn on two-factor authentication, ASAP generates ten single-use backup codes. Each one signs you in once if you lose your authenticator app, and ASAP warns you when only a few are left.
Do my card numbers go through ASAP?
No. Payments are processed by Stripe: you enter your card in Stripe's own components, and it neither passes through nor is stored at ASAP.
How do I export my data or delete my account?
From Account, Data and privacy: you download a ZIP archive of your personal data, or schedule the deletion of your account. It takes effect after 30 days, and you can cancel it until then.
Last updated: 2026-10-13