Comment BlackShield traite et protège les données des utilisateurs sur l'infrastructure AWS avec partitionnement strict par tenant.
Posture opérationnelle de confidentialité
BlackShield applique des contrôles techniques de niveau code pour le partitionnement par locataire, le chiffrement et le transport sécurisé.
Date d'effet
18 mars 2026
Dernière mise à jour
18 mars 2026
Modèle d'hébergement
Services managés AWS en us-east-1
Le plan de contrôle BlackShield s'exécute sur AWS us-east-1 avec des partitions souveraines européennes en eu-west-1 et ap-south-1 et us-west-1 et ap-southeast-2 et ca-central-1 et sa-east-1 et eu-central-1 et us-east-2 et us-west-2 et eu-west-2 et eu-west-3 et eu-north-1 et ap-southeast-1 et ap-northeast-1 et ap-northeast-2 et ap-northeast-3.
Positionnement réseau
Sous-réseaux isolés et capteurs in-VPC
Les partitions SQLite sont confinées dans un stockage S3 privé, sans sortie de données brutes.
Modèle d'accès
Cloisonnement locataire natif
Le code applicatif dérive le contexte locataire de l'identité vérifiée pour prévenir toute fuite croisée.
Gestion des secrets
Secrets générés, hachés ou coffrés
Secrets sous Secrets Manager, clés d'API hachées en SHA-256 et mots de passe avec bcrypt.
La plateforme traite les informations de compte, les métadonnées de locataire et les résultats de scans strictement nécessaires au service B2B.
Les données sont traitées uniquement pour fournir, sécuriser et améliorer les services souscrits, sans aucune utilisation publicitaire.
BlackShield applique des contrôles techniques stricts sur toute sa chaîne de traitement.
Les fournisseurs tiers d'infrastructure et de plateforme suivants sont mandatés par BlackShield pour l'hébergement cloud, le stockage de télémétrie, la facturation, les e-mails transactionnels et les alertes sous accords DPA stricts.
| Sous-traitant | Catégorie | Rôle | Localisation | Données Traitées | Garanties |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. | Plateforme Centrale | Cloud Infrastructure & Managed Platform Services | United States (with regional storage partitions in EU, US, CA, AP) | Tenant databases, findings, raw scan bundles, audit trails, and encrypted application secrets | EU-US Data Privacy Framework, AWS GDPR Data Processing Addendum, and Standard Contractual Clauses (SCCs) |
| Stripe, Inc. | Plateforme Centrale | Billing & Payment Processing | United States | Customer company name, admin email, subscription plan, billing address, and payment transaction metadata | Standard Contractual Clauses (SCCs) and PCI-DSS Level 1 certification |
| Resend, Inc. | Plateforme Centrale | Transactional Authentication & System Emails | United States | User email addresses, verification links, password reset tokens, and team invitation notifications | Standard Contractual Clauses (SCCs) and Data Processing Addendum |
| Google LLC | Plateforme Centrale | Web Analytics & Consent Measurement | United States | Aggregated website traffic and interaction metrics (strictly governed by Google Consent Mode v2 and user cookie consent) | EU-US Data Privacy Framework and Google Data Processing Terms |
| Slack Technologies, LLC (Salesforce) | Plateforme Centrale | Customer Support & Async Operator Coordination | United States | Support inquiries, incident troubleshooting context, and optional customer-configured finding alert sync | Standard Contractual Clauses (SCCs) and Salesforce Data Processing Addendum |
| OpenAI, LLC | AI Gateway (BYOK) | AI Gateway Inference Provider (Customer BYOK) | United States | Prompt payloads, completion tokens, and MCP tool schemas proxied via AI Gateway under customer API credentials (zero training on customer data) | Standard Contractual Clauses (SCCs) and OpenAI Business Data Processing Agreement |
| Anthropic, PBC | AI Gateway (BYOK) | AI Gateway Inference Provider (Customer BYOK) | United States | Prompt messages, tool invocation responses, and completion tokens proxied via AI Gateway under customer API credentials (zero training on customer data) | Standard Contractual Clauses (SCCs) and Anthropic Commercial Terms of Service |
| Microsoft Corporation (Azure OpenAI) | AI Gateway (BYOK) | AI Gateway Enterprise LLM Provider (Customer BYOK) | United States & European Union (customer-designated Azure regions) | Enterprise chat completions, embeddings, and tool schemas proxied to tenant-owned Azure OpenAI endpoints | Microsoft Products and Services Data Protection Addendum (DPA) and EU Model Clauses |
| Google LLC (Google AI Studio / Gemini API) | AI Gateway (BYOK) | AI Gateway Inference Provider (Customer BYOK) | United States | Prompt messages, tool calling parameters, and Gemini model responses proxied under customer API credentials | Google Cloud Data Processing Addendum and Standard Contractual Clauses (SCCs) |
| Groq, Inc. | AI Gateway (BYOK) | AI Gateway Low-Latency Inference (Customer BYOK) | United States | Inference prompts and token streams for low-latency LPU model execution proxied under customer API credentials | Standard Contractual Clauses (SCCs) and Groq Enterprise Data Protection Terms |
| Mistral AI | AI Gateway (BYOK) | AI Gateway European LLM Provider (Customer BYOK) | France / European Union | Prompt tokens and chat completions proxied to Mistral AI endpoints under customer API credentials with European data residency | EU GDPR direct application (headquartered in France) and Mistral Data Processing Agreement |
| Atlassian Pty Ltd (Jira) | Intégration Client | Issue Tracking & Finding Remediation Sync (Customer-Configured) | United States / Australia | Security finding titles, severity ratings, remediation tickets, and status synchronization when configured by tenant administrator | Standard Contractual Clauses (SCCs) and Atlassian Customer Data Processing Addendum |
| GitHub, Inc. (Microsoft) | Intégration Client | Issue Tracking & CI Finding Sync (Customer-Configured) | United States | Security finding descriptions, repository references, and issue tracker comments when configured by tenant administrator | Standard Contractual Clauses (SCCs) and GitHub Data Protection Agreement |
| Microsoft Corporation (Microsoft Teams) | Intégration Client | Incident Alerting & Channel Notifications (Customer-Configured) | United States & European Union | Finding summary alerts and remediation links dispatched to customer-configured incoming webhook endpoints | Microsoft Products and Services Data Protection Addendum (DPA) and EU Model Clauses |