Security and infrastructure

Defense in depth, validated by government audits.

HelloSpot applies a defense-in-depth strategy, validated by government audits (ANTS, the French secure documents agency) and aligned with the recommendations of ANSSI, the French cybersecurity agency, to keep your critical operations running.

Start for free Request a demo

A security shield and data icons above a tablet

Two-factor authentication

Two-factor authentication, at every login

Two-factor authentication (2FA) strengthens the security of access to HelloSpot systems.

Internal administration interfaces
2FA is mandatory for all access to internal administration interfaces, combined with a VPN connection.
Staff logins
2FA is available to all staff and can be made mandatory by the platform administrator. Three methods to choose from: authenticator app (TOTP), SMS and email.

A phone displays a two-factor authentication confirmation request

Traceability

Logging and traceability

HelloSpot centrally logs logins and failed login attempts, for continuous monitoring and rapid detection of anomalies.

These logs are not subject to periodic rotation: records remain available for audit and investigation purposes.

Certifications of the DC2 datacenter (Scaleway, Vitry-sur-Seine) that hosts the application:

ISO 27001:2022 (information security)
ISO 50001:2018 (energy management)
HDS (France’s certified health data hosting)
APSAD (fire protection)
SecNumCloud (in progress), the highest cloud security qualification from ANSSI

A network of glowing interconnected padlocks, some of them signaling an alert

Incidents

Handling data breaches and security incidents

Under the NIS2 directive, HelloSpot collects in advance the contact details of the data protection officers (DPOs) and chief information security officers (CISOs) of its local authority customers, so it can inform them as quickly as possible in the event of a security incident or intrusion.

1. Detection and reporting
Continuous monitoring (infrastructure monitoring, security probes, log analysis) and a dedicated reporting channel.
2. Investigation and assessment
The incident is analyzed without delay by the internal security teams, together with an ANSSI-accredited incident response firm, to determine its origin, impact and the data involved.
3. Information and notifications
Affected customers are informed as soon as possible when the incident may affect their data or the availability of services. Regulatory notification obligations are met.
4. Remediation, follow-up and traceability
Corrective and preventive actions to contain the incident and prevent it from happening again, with an ANSSI-accredited provider if needed (remediation, forensics, lessons learned). Every incident is recorded in an internal register.

Network

Perimeter and network security

Active protection against cyberattacks and intrusions.

Firewall
Strict filtering, blocking of malicious IPs and allowlisting.
Anti-DDoS
Protection through CrowdSec and Laravel’s built-in safeguards (rate limiting).
SSL/TLS encryption
All traffic is secured over HTTPS, with PKCS #1 SHA-256 encryption.

Hands on a laptop keyboard, beneath a cloud of encrypted data

Vulnerabilities

Hardening and vulnerability management

Proactive maintenance of system security.

CERT-FR monitoring
Immediate application of critical security patches (system, kernel), following alerts from CERT-FR, the French government’s computer emergency response team.
Server antivirus
Continuous protection with ClamAV.
Security audits
Penetration tests carried out by ANTS (French Ministry of the Interior) and recurring vulnerability scans.

Access control

Authentication and access control: least privilege

Two-factor authentication
Mandatory for administration, via TOTP or security keys.
Strong passwords
Irreversibly encrypted in the database.
Secure access
SSH connections with private keys and mandatory VPN for administration.

A staff member logs in to her secure account from her phone

Continuity

Disaster recovery plan and backups

Service resilience and availability, with a 99.9% SLA.

Off-site backups
Replication to a remote site, 20 km away.
Backup strategy
Weekly full backups and daily differential backups.
RTO under 12 h
Fast recovery thanks to synchronized secondary servers.

See privacy, GDPR and data sovereignty

And also

Security at a glance

Security audited by the French government

A solution proven by an ANTS penetration test (French Ministry of the Interior). Recurring vulnerability audits.
Continuity and disaster recovery

Disaster recovery plan with geographic redundancy (20 km) and a recovery time objective (RTO) under 12 h.
Active defense and anti-DDoS

Filtering through CrowdSec and an application WAF. Proactive blocking of malicious IPs and brute-force attacks.
“Zero Trust” access

Multi-factor authentication (2FA) and VPN mandatory for administration. Strong encryption of all traffic.

99.9%

availability

Service availability commitment (SLA).
12 h

maximum RTO

Guaranteed recovery time, thanks to synchronized secondary servers.
20 km

geo-redundancy

Distance between the main site and the backup replication site.
10

years of experience

Since 2016, HelloSpot has become a key partner of public service organizations.

Customer reviews

A real impact on your organization, every day

Take back control of requests between residents and your departments, for free

Allaire Town Hall

We chose HelloSpot to reduce the number of phone calls. The software makes life easier for residents and has sharply cut the number of calls. We are very satisfied with both the software and the team’s responsiveness.
Bouillargues Town Hall

With the sharp rise in ID document applications, our Excel spreadsheet was no longer enough for booking appointments. HelloSpot gives us better visibility over our organization and saves us a considerable amount of time.
Craponne Town Hall

It saves time with online appointment booking and sending the list of required documents. The e-mail reminder the day before means very few missed appointments.
Thann Town Hall

We are really satisfied with HelloSpot and we will not go back.