Book a Meeting

Technical security file

The security of an LMS is not demonstrated by a page of promises. We maintain a technical security file, updated after each audit, which we share in full with your IT department, your CISO or your data protection officer. This page summarises its substance.

The reference document covers the authentication architecture, the authorisation model, session management, OWASP coverage, defence in depth, secrets management, logging, third-party dependencies, the responsible disclosure procedure and GDPR compliance. It is dated, versioned, and follows the version of the product you are running.

Le dernier audit de sécurité global a été mené en avril 2026The most recent full security audit was carried out in April 2026. Its findings and the associated fixes are public: they are listed in our [changelog] under the "Security" label. changelog sous le label « Sécurité ».

OWASP Top 10 coverage (2021)

Each of the ten categories in the OWASP framework is addressed by identified, documented measures.

CATEGORY MEASURES
A01 — Broken access control Permission model enforced on every entry point, anti-CSRF token on sensitive actions, strict validation against account takeover.
A02 — Cryptographic failures Passwords hashed with bcrypt, HMAC-SHA256 signing of cookies and webhooks, constant-time secret comparison, unique keys per installation.
A03 — Injection SQL queries systematically protected (typing, escaping, column and sort whitelists), prepared statements, systematic HTML escaping of anything that reflects user input.
A04 — Insecure design Safeguard against open redirects, password reset redesigned around a token, Zip Slip protection on archive import, path-traversal checks on file reads.
A05 — Security misconfiguration Secrets kept out of the repository with a documented example file, HttpOnly / Secure / SameSite, cookies, directory listing disabled, protection of sensitive folders handled by the product.
A06 — Vulnerable and outdated components Regular audits of PHP and JavaScript dependencies, deliberately lean dependency footprint, quarterly update policy.
A07 — Identification and authentication failures Rate limiting with increasing delay, session regeneration after login, signed "remember me" cookie, single-use reset token, anti-enumeration responses for accounts.
A08 — Software and data integrity failures Constrained deserialisation (no unauthorised object instantiation), signing of inbound and outbound webhooks, state verification on OAuth2 exchanges.
A09 — Security logging and monitoring failures Structured, typed application logs (authentication, failures, web services, e-mails), timestamp, IP address and user agent, optional Sentry integration.
A10 — Server-side request forgery (SSRF) Every outbound call goes through a hardened client: HTTP/HTTPS schemes only, host whitelist, rejection of private and reserved addresses, no redirect following, TLS verification and conservative timeouts.