Security

A formal security policy, applied to every line of code

Ducal.tech operates under an ISSP (Information System Security Policy) aligned with ANSSI, HDS (Health Data Hosting), and GDPR frameworks. It's not a document gathering dust — it's the foundation of every technical decision.

ISSPANSSI Compliant
AES-256Full Encryption
24hCritical Fix SLA
4hGuaranteed RTO

Health data is valuable. On illicit markets, a complete medical record sells for ten to twenty times more than a credit card number. Healthcare organizations know this, often the hard way: cyberattacks against hospitals have multiplied in recent years.

That's why at Ducal, security is not a late-stage audit or a checkbox. It's an integrated approach embedded into every stage of design, development, and operations.

Ducal.tech maintains a formal Information System Security Policy (ISSP), compliant with ANSSI (French National Cybersecurity Agency) guidelines and aligned with HDS (Health Data Hosting), GDPR, and ISO 27001 frameworks. This document governs all activities of the collective. It is available upon request as part of a contractual relationship.

Foundations

Five guiding principles

Derived from our ISSP, these principles guide every technical and organizational decision.

🛡️

Defense in depth

Multiple independent security layers. If one layer is compromised, the others hold.

🔑

Least privilege

Each account only accesses the resources strictly necessary for its mission. No more, no less.

🧱

Environment separation

Development, staging, and production are strictly isolated. Never any real data in dev.

🏗️

Security by design

Security is built into the architecture from day 1, not bolted on as an afterthought.

🔒

Privacy by default

Default settings are the most protective possible. Privacy is not an option to enable.

Artificial Intelligence

AI in our process

AI strengthens our security daily. But it operates within strict boundaries.

What AI does
Static and semantic analysis of source code on every change
Deep vulnerability detection (business logic, access controls)
Security configuration compliance verification
Systematic code review on every pull request
What AI never does
×No access to production databases
×No access to production environments
×No patient data in AI prompts or contexts
×No change deployed without human validation

As a system operating in the healthcare domain, our use of AI falls under the high-risk category per the European AI regulation (AI Act, EU 2024/1689). That is why human oversight is systematic at every stage.

Read our full AI usage charter for complete details →

Sovereign hosting

All our healthcare solutions are hosted with Outscale (a Dassault Systemes subsidiary), an operator qualified SecNumCloud by ANSSI (French National Cybersecurity Agency) and certified Health Data Hosting (HDS). Data is located exclusively in France, with no exposure to the US Cloud Act.

Environment separation

Three strictly isolated environments ensure no real data ever leaks outside production:

DEV
Synthetic data only. No real patient data, not even anonymized.
STAGING
Anonymized data. Access restricted to the project team. Functional validation before production deployment.
PRODUCTION
Named, restricted access. Full audit logging of all access. End-to-end encryption at rest and in transit.

Network and segmentation

The infrastructure relies on restrictive firewall rules. Administrative access requires a key-authenticated VPN. Services are segmented on the network to limit lateral movement in case of compromise. No database is directly accessible from the outside.

End-to-end encryption

In transit

All communications are protected by TLS 1.3 minimum. HSTS is enabled across all our domains. Legacy protocols (TLS 1.0, TLS 1.1, SSLv3) are disabled without exception.

At rest

Health data is encrypted with AES-256-GCM. Infrastructure volumes are also encrypted at the storage level. Backups are encrypted before transfer and at rest.

Data lifecycle

The lifecycle of each piece of data is governed by four distinct phases:

Active data
Contract duration + 5 years. Restricted access, full encryption.
Backups
Rolling 30-day retention. Encrypted and stored on a separate server.
Archives
Retained per applicable legal obligations. Exceptional and audited access.
End of contract
Certified secure deletion. Certificate of destruction provided to the client.
IA
AI systematically verifies the absence of unencrypted sensitive data in source code and configuration files.

Access, secrets, and identities

Mandatory MFA. Multi-factor authentication is required for all access to production environments, without exception.

Password policy. 16-character minimum, bcrypt or argon2 hashing, no default passwords. Temporary credentials are disabled after first use.

SSH by key only. ED25519 key access, production access exclusively via authenticated VPN. No direct external access.

Centralized secret management. Rotation every 30 days (critical secrets) or 90 days (standard secrets). Zero secrets in source code, zero secrets in logs.

Named access. All access is individually tracked. Revocation within 24 hours after end of assignment. No shared accounts.

IA
Every commit is automatically scanned to detect the accidental presence of secrets in source code — API keys, passwords, access tokens.
Monitoring

Audits, monitoring, and incident response

Continuous monitoring

Centralized logs across the entire infrastructure
Automatic alerts within 5 minutes
OWASP scans on every deployment
CVE analysis on dependencies
Periodic load testing

Remediation SLAs

Critical (CVSS 9-10)
24 hours — emergency fix
High (CVSS 7-8.9)
72 hours — priority patch
Moderate (CVSS 4-6.9)
14 days — next sprint
Low (CVSS 0.1-3.9)
30 days — security backlog

Incidents are classified from P1 (critical) to P4 (minor). In case of a P1 incident, the client is notified within 4 hours. If a data breach is confirmed, CNIL (French Data Protection Authority) is notified within 72 hours per GDPR requirements. Every incident is subject to a documented post-mortem.

IA
AI code review on every pull request. AI detects business logic flaws and deficient access controls — invisible to traditional scanners.

Business continuity

A business continuity and disaster recovery plan (BCP/DRP) governs the response to any major incident. The backup strategy relies on multiple levels of replication.

Full backup
Daily, encrypted, separate server
Incremental backup
Every 6 hours
Infrastructure snapshot
Weekly, separate region
Source code
Continuous (Git), unlimited retention

Recovery objectives. RTO (recovery time objective) of 4 hours. RPO (maximum data loss) of 6 hours. Target availability of 99.5%. The DRP is tested annually and results are documented.

Compliance and contractual commitments

ANSSI — ISSP Guide
Structure and governance of the security policy
HDS
Health Data Hosting — full certification
SecNumCloud
ANSSI sovereign cloud qualification, via Outscale
GDPR
Personal data protection — full compliance
ISO 27001
Security management — best practice reference
OWASP Top 10
Application security — full compliance
NIS2
Network security — applicable if critical perimeter
AI Act (EU 2024/1689)
European AI regulation — high-risk category (healthcare), human oversight, transparency

On the contractual side, every project includes a systematic Data Processing Agreement (DPA). Ducal maintains a processing register, applies privacy by design from inception, and delivers complete source code to the client. At contract end, a certified secure deletion is performed and documented.

Want to review our security policy?

Our Information System Security Policy (ISSP) is available in full as part of a contractual relationship.

Contact us

Explore healthcare security further

Article

HDS Certification: The Complete Guide

Everything you need to know about Health Data Hosting certification and its implications.

Article

SecNumCloud Explained

Why ANSSI-qualified sovereign cloud is essential for healthcare.

Article

Cybersecurity in Healthcare Facilities

Threats, obligations, and best practices for hospital IT departments.

Article

Hospital Cyberattacks: Analysis

Analysis of cyberattacks against French hospitals and lessons learned.

Article

GDPR and Health Data

Legal obligations for collecting and processing health data.

Article

Disaster Recovery Plan After a Cyberattack

How to prepare and execute a DRP in a hospital context.

Article

Open Source and Healthcare Security

Why open-source code is an asset for healthcare solution security.

Article

Sovereign Cloud in Healthcare

Understanding sovereign cloud challenges for French health data.

Have a healthcare digitalization project?

Let's talk. We'll get back to you within 48 hours with an initial proposal tailored to your needs.

Contact Us