Security & Privacy

Architecture, legal documents, deep learning/machine learning compliance and governance — every control Titane Intelligence applies to its e-commerce clients' data.

Trust Center

Applied controls

Four pillars — architecture, legal documents, algorithmic compliance, governance.

Shared responsibility model — Titane relies on AWS for the underlying cloud infrastructure. AWS certifications (SOC 1/2/3, ISO 27001, GDPR, PCI-DSS) cover the infrastructure and managed services. The controls listed below are the ones Titane actively configures and operates directly.

Architecture & Security

Infrastructure provided by AWS

EU-only hosting — AWS eu-west-3 region (Paris)

Technical controls configured by Titane

Two-layer architecture: pseudonymized analytical data lake / isolated activation vault
AES-256 KMS encryption at-rest, TLS 1.3 in-transit, distinct CMK per client
Network fortress: private VPCs + Endpoint Policies + aws:sourceVpce bucket policies
RBAC, hardware MFA for admins, IAM Identity Center, least privilege
DRP/BCP — RTO 4h / RPO 24h (1h for prod models), quarterly tests

Titane organizational policies

Pseudonymization by default — never « anonymization »
Zero Local Data policy

Legal documents

2-section privacy policy (own controller / processor art. 28)
Complete LCEN legal notice
Data Processing Agreement (DPA), Non-Disclosure Agreement (NDA)
8 art. 28 §3 clauses + 4 annexes (processing, TOMs, sub-processors, SCC)
Anti-cross-training clause in DPA clause 3.4
Public list of subsequent sub-processors (AWS, Vercel)
Breach notification commitment ≤ 12h (vs. 72h CNIL)

Algorithmic compliance

Contractual exclusion of any creditworthiness / BNPL / credit use (exits Annex III high-risk)
Model cards, datasheets, complete model lineage (dataset + code + parameters + operator)

Governance & contact

Shared external DPO — dpo@titane-intelligence.com
Security point of contact — securite@titane-intelligence.com
Rights exercise procedure (access, erasure, portability, objection)
Cascading erasure: CMS → Titane Foundry → Deep Learning → CRM → La Forge
Under NDA: Security White Paper, pentest reports, internal DPIA
Internal art. 30.2 register (public excerpt in Trust Center)
Right to lodge a complaint with the CNIL noted

Pseudonymization by default

« Pseudonymization by default. Activation identifiers stored separately in a cryptographic vault. Our algorithms process only mathematical tokens decoupled from any civil identity. The final reconciliation happens automatically within secure ephemeral functions, with no human intervention. »

Compliance roadmap

Certifications and work in progress

Public timeline of the certifications underway and the technical work in progress.

As of today, Titane Intelligence is not itself ISO 27001 or SOC 2 certified. These certifications are commitments in progress, detailed below, not achievements.

« Titane already applies the essential controls, documents its security, and is progressively building a management system compliant with recognized standards, with ISO 27001 certification targeted in the medium term (2027). Our Security White Paper is available on request under NDA. »

Titane has initiated an ISO 27001:2022 process: gap analysis completed, ISMS being structured, priority controls already applied, certification targeted for 2027.
ISO 27701 is planned as a privacy extension after the ISO 27001 ISMS is stabilized and certified.
SOC 2 Type II is on the compliance roadmap, with a preparation window estimated at 6-12 months depending on client requirements and available resources.
Periodic red teaming of ML models (ML Privacy Meter)
DP-SGD evaluation (Opacus) on customer scoring — POC in progress
Final migration to VS Code/Cursor/Antigravity Remote SSH — Zero Local Data enforced

Summary

Trust Center one-pager

One-page summary of all of Titane Intelligence's controls, legal documents and commitments.

Download the one-pager (PDF)

A question about security?

We're here to help.

DPO: dpo@titane-intelligence.com · Security: security@titane-intelligence.com