Keep your data secure,
our priority.
The security of your data and your work is our priority. That's why being ISO 27001:2022 certified and hosting your data in France — exclusively within the European Union, under European jurisdiction and in full GDPR compliance — have been our goals from day one.
What does this mean in concrete terms?
ISO 27001 certified
We have placed safety issues at the heart of both our software and internal development.
- Tomorro is ISO 27001 certified.
- Annual penetration tests.
Physical security
Tomorro is committed to guaranteeing the physical integrity of your data: employees, physical security, data access, hosting and networks.
- Access to the Tomorro premises is protected by individual badges.
- Tomorro's premises are monitored 24 hours a day by an alarm and video surveillance system.
- Visitors are directly supervised by a Tomorro member for the duration of their visit.
Hosting
Tomorro strictly controls access to your data, both online and in-house, to ensure that your documents are protected from modification. And for added security, we make daily backups.
- Your production data (infrastructure and data) is hosted exclusively in France, on AWS in the eu-west-3 region (Paris). Cross-region backups are stored on AWS eu-central-1 (Frankfurt, Germany) to ensure resilience against regional incidents. All data remains within the European Union.
- Hosting is provided by Amazon Web Services, world leader in web hosting, ISO 27001 certified, which also hosts solutions such as Engie, Véolia, Siemens...
- Test and production environments are strictly distinct.
- Access to Tomorro's systems is protected by AWS's rights management policies.
- User authentication by email and password is mandatory for a short session (controlled by a strict policy).
- Internal access to data is restricted to duly authorized employees only.
Data encryption
Access to your account is secured by several protection mechanisms. We scrupulously protect your data, which we encrypt both in transit and at rest in our databases.
- All data is encrypted, including backups, using different encryption keys during transmission as well as during storage.
- Data and backup encryption keys are changed regularly.
- Data transmission is only carried out using the TLS/SSL protocol.
- All transmissions between clients and servers are end-to-end encrypted using the HTTPS protocol.
Compliance
Tomorro complies with all applicable regulations and we ensure that our service providers are compliant.
- Stripe, our payment provider, has been audited by an independent PCI Qualified Security Assessor (QSA) and is certified as a Level 1 PCI Service Provider.
- Our privacy and data processing policy complies with the General Data Protection Regulation.
Availability and resilience
Your production data is replicated in real time across 3 distinct AWS Availability Zones (AZs) — each AZ corresponding to an independent physical data center — within the eu-west-3 region (Paris), with automatic failover within seconds in the event of an incident.
- Two complementary backup mechanisms are in place: automatic daily snapshots retained for 365 days, and continuous backups enabling Point-in-Time Recovery (PITR) with a maximum data loss of 5 minutes (RPO 5 min). All backups are stored in an isolated AWS account, cross-region in eu-central-1 (Frankfurt, Germany), for maximum resilience against regional incidents.
Incident response
In the event of an incident, Tomorro's teams are mobilised to protect your data and ensure a return to normal within the shortest possible time.
- Tomorro has a clear procedure in place for security events and has trained all staff members internally on this subject.
- Automatic alerts are set up to notify our team in case of an incident.
- When security events are detected, they are transmitted to our emergency alias, teams are called, notified and assembled to react quickly.
- The analysis is done in person, distributed throughout the company and includes measures that will facilitate the detection and prevention of a similar event in the future.
- Security-related events must be systematically reviewed for closure by the engineering and security services and, where appropriate, by the services specifically concerned.
Security center
For the sake of transparency and awareness, we have documented all questions relative to security on a dedicated platform accessible to all.
- Informations are certified by an external provider (Vanta)
- Documentation regularly checked and updated by our teams
- All security topics covered
Contact us
If you need help or have any questions about security or the use of our services, our team is at your disposal.
A single, secure platform
Protecting our customers' data is at the heart of what we do.
At Tomorro, we apply the highest standards of security, confidentiality, and compliance to guarantee the integrity of every contract and document managed on our platform.
Compliance & Certifications
Tomorro is committed to meeting the most rigorous international compliance standards:
- ISO 27001:2022 certified
- GDPR compliant
- Digital Operational Resilience Act (DORA)
- EU AI Act readiness
Our compliance and security posture are continuously monitored through Vanta to ensure full transparency.
Hosted in France, with resilient backups in Europe
- Hosted on Amazon Web Services (AWS) in France: production in eu-west-3 (Paris), with cross-region backups in eu-central-1 (Frankfurt) for resilience. All data remains exclusively within the European Union.
- Certified ISO 27001 hosting infrastructure.
- Data redundancy across 3 distinct Availability Zones (AZs) in the Paris region, with cross-region backups in Frankfurt, ensuring resilience and business continuity.
- Continuous monitoring and alerting of infrastructure performance and security.
Product & Application Security
- Secure software development lifecycle (SDLC) with code reviews, automated testing, and vulnerability scanning.
- Isolated development, staging, and production environments.
- Independent penetration tests carried out annually by third-party experts.
- Continuous monitoring via Datadog and incident management through Sentry.
Monitoring & Transparency
- Public Trust Center: trust.tomorro.com
- Public Status Page: tomorro.instatus.com
- Regular third-party audits and penetration test reports available upon request.
Contact our Security Team
If you have any questions or would like to report a vulnerability, please reach out to our security team.
our customerstalk about itbetter than us
Speed up your contract management with AI