Data Security and Compliance: What Booper Guarantees Regarding Your Prices and Margins
Your purchase prices, selling prices, and profit margins are among your company’s most sensitive data. This page answers the ten questions your CIO and DPO ask us before signing the contract.
OVHcloud hosting, including production, acceptance testing, and backups
The platform handles only your sales, prices, and inventory
OVHcloud for hosting; everything else is handled by Booper
The Essentials in Thirty Seconds
Booper hosts the MPS platform in France, at OVHcloud, on servers dedicated to each client. Access is provided through your company's SSO (SAML 2.0, OpenID Connect) or via individual login credentials. Data transfers are encrypted using TLS and SFTP.
Data is backed up daily to a second data center. Only one third-party service provider is involved: OVHcloud. At the end of the contract, your data is returned to you and then deleted—including backups—within 60 days.
The 10 Answers Your CIO Is Looking For
The same information that we provide in our responses to requests for proposals and our security assurance plans.
Hosting Provider and Location
OVHcloud, with data centers located in France. Each customer has its own servers, which are isolated from those of other customers.
Production, testing, and backup servers are all located in France. The services are provided from within the European Union.
Certifications
Booper does not currently hold any specific certifications. We're being upfront about it rather than sugarcoating it.
The OVHcloud data centers that host the platform are certified to ISO 27001, ISO 14001, and ISO 50001. Booper follows an information security policy aligned with ISO 27002.
Encryption
In transit: HTTPS/TLS for the application, SFTP for file transfers, SSH for administration. Passwords are hashed using bcrypt.
Sensitive files sent via email are encrypted before being sent, and the team's workstations have encrypted hard drives.
Authentication and SSO
SAML 2.0 and OpenID Connect, such as with Microsoft Entra ID. Your company's two-factor authentication applies to Booper through your directory.
Otherwise, individual credentials, password policy, session lockout, and expiration after inactivity. All actions are logged and time-stamped.
Backups
Daily backups to a second OVHcloud data center in France, retained for seven days. Full and incremental backups.
Maximum allowable data loss: 24 hours. Backups are documented and tested regularly.
Contractual Availability
A monthly availability commitment of at least 99% during the service's operating hours, with penalties for noncompliance.
Target recovery time: 8 business hours as standard, 4 hours with the Platinum plan.
Penetration Testing
The MPS platform was audited by an independent specialized firm using both black-box and gray-box testing methods. Critical and significant vulnerabilities were fixed and then verified by the auditor.
Booper is contractually obligated to have an independent penetration test conducted before the launch of each service.
Data Protection Contact
Booper's Data Protection Officer is Sofiane Belkacem, who also serves as Director of Data and Security. Contact: protectiondesdonnees@booper.fr.
You will be notified of any data breach no later than 48 hours after it is discovered.
Contractors
There is only one sub-contractor: OVHcloud, for hosting in France. Platform development and integration are handled by Booper.
You will be notified in advance of any new subcontractor. You may object to this for a legitimate reason.
Shelf Life
Your data will be processed for the duration of the contract. Upon its expiration, it will be returned to you in a standard format and then deleted from the servers and backups within 60 days, with written confirmation.
Business transaction histories are retained for two years as standard, then deleted or archived according to the policy defined with you.
The End-to-End Journey of Your Data
Four stages, all in France, all mapped out.
Secure Storage
Your sales, pricing, and catalog files are delivered via SFTP to a dedicated area. Each file is reviewed before being integrated.
Dedicated Servers
Your data is processed on OVHcloud servers that do not host any other customers. Access is limited to authorized personnel, who are reviewed annually.
Daily Backup
Every night, a copy is sent to a second data center in France. Seven days of retention, with restoration tested.
Restoration and Deletion
At the end of the contract, a complete export in an open format, followed by the deletion of servers and backups within 60 days, confirmed in writing.
Consumer data is never part of the process. Only your users’ identifying information (last name, first name, work email address) and their login logs are subject to the GDPR, for which Booper acts as a processor within the meaning of Article 28. See our privacy policy for details.
What We Don't Do
Five negative commitments—more telling than a list of logos.
No consumer data
No loyalty cards, no individual shopping carts. The models work with aggregated sales, prices, and inventory.
No reliance on a third-party AI model
The Booper assistant's language model is developed in-house and hosted in your environment. Your data never passes through any external model provider.
No automated decisions regarding individuals
Price recommendations are tools to help with product-related decisions. The final decision rests with your teams.
No data outside the European Union
Hosting, backups, and services are provided from within the EU. There are no data transfers to third countries, so there are no standard contractual clauses to manage.
No server pooling
Your environments are dedicated and isolated. An incident affecting another customer will not impact your data.
No hidden subcontractors
Only one, OVHcloud, is named in the contract. You will be notified of any new subcontractors before they begin work.
Commitments Set Forth in the Contract
Excerpts from the MPS solution’s general terms and conditions of sale. Higher service levels are described in each proposal.
| Commitment | Standard Level | What This Means for You |
|---|---|---|
| Monthly Availability | At least 99% during the operating range, excluding scheduled maintenance | A penalty of 10% of the monthly fee if the threshold is not met. |
| Blocking error | Support within 1 business hour; resolution by the next business day | Support is available Monday through Friday, 9 a.m. to 6 p.m., via support tickets, email, and phone. |
| Recovery After an Incident | Recovery within 8 business hours (4 hours with the Platinum plan), maximum data loss of 24 hours | Daily backups to a remote site; tested restore procedures. |
| Scheduled Maintenance | Nighttime and Sunday morning time slots, announced 15 days in advance, up to 3 days per year | An urgent security operation may take place without prior notice; you will be notified immediately. |
| Data Breach | Notification within 48 hours of discovery | You can set your own deadlines for notifying the CNIL. |
| Penetration Test | Conducted by an independent auditor prior to the service's launch | Summary and remediation plan available upon request. |
| Reversibility | Export to CSV, dump, or API; deletion within 60 days; written confirmation | Standard return shipping is included in the price. |
Organized security, not just lip service
Booper has been a French software publisher since 2014. Our clients are retail chains and networks that entrust us with their purchase and sale prices. Their security departments audit us before each contract.
- A designated information systems security officer and a data protection officer.
- An information systems security policy aligned with ISO 27002, reviewed periodically, and an IT policy statement signed by each employee.
- IT security policies are enforced on all workstations: encrypted drives, automatic lockout, user-specific accounts, and sensitive files encrypted before any transfer.
- A disaster recovery plan and a business continuity plan, including a designated crisis response team, reviewed annually.
- Personalized accounts on the platform, an annual review of access permissions, and logging of all access events.
- Updates are delivered monthly during pre-production and tested with your key users before going live, outside of the release freeze period.
Documents available upon request
Subject to a confidentiality agreement, for your CIO or DPO.
- Information Systems Security Policy
- Data Backup Plan
- Disaster Recovery Plan and Risk Analysis
- Penetration Test Report
- ISO 27002 Requirements Checklist (Security Assurance Plan)
- Appendix on the Processing of Personal Data (Article 28 of the GDPR)
Frequently Asked Questions
Where is the data processed by Booper stored?
In France, at OVHcloud, on servers dedicated to each customer. The production and acceptance testing environments, as well as the backup servers, are all located in France.
No data is transferred outside the European Union.
Is Booper ISO 27001 or SOC 2 certified?
Booper does not currently hold any certifications of its own. The OVHcloud data centers that host the platform are certified to ISO 27001, ISO 14001, and ISO 50001.
Booper has a security management system, an information systems security policy, a backup plan, and a disaster recovery plan, all of which are available upon request.
What personal data does Booper process?
Only data from platform users: last name, first name, work email address, and login logs. Booper does not process any consumer data.
Forecasting and elasticity models are based on sales, prices, and inventory—never on people.
Can we log in using our corporate directory (SSO)?
Yes. The platform supports SAML 2.0 and OpenID Connect, for example with Microsoft Entra ID. The two-factor authentication required by your company is then managed by your directory.
Otherwise, each user has individual login credentials with password policies and session timeouts.
How is the data backed up?
A daily backup is performed at a second OVHcloud data center in France and retained for seven days. The maximum contractually permissible data loss is 24 hours.
Restoration procedures are documented and tested.
What happens to our data when the contract ends?
Booper exports all data in a standard format (CSV export, database dump, or API), then deletes it from its servers and backups within 60 days, unless required by law to retain it, and confirms this in writing.
Does Booper use subcontractors?
Only one third-party service provider processes your data: OVHcloud, for hosting in France. The platform’s development and integration are handled by the Booper teams.
You will be notified in advance of any new subcontractor, and you may object to it.
Does Booper's AI assistant send our data to an external model provider?
No. The chatbot's language model is developed in-house and hosted within the client's environment. No data leaves this environment, and no calls are made to a third-party model.
To understand the difference from a general-purpose AI, read " General-Purpose AI vs. Dedicated Pricing Solution."
Is the solution subject to penetration testing?
Yes. The MPS platform was audited by an independent specialized firm using both black-box and gray-box testing methods, and the critical and significant vulnerabilities identified have been fixed and verified.
Booper is contractually obligated to have an independent penetration test conducted before the launch of each service.
Who should I contact if I have a question about the GDPR or security?
Booper's Data Protection Officer is Sofiane Belkacem, who can be reached at protectiondesdonnees@booper.fr. You will be notified of any data breach no later than 48 hours after it is discovered.
Further Reading
Do you have a question for your CIO or DPO? Ask us
Security questionnaire to complete, GDPR appendix to review, and documentation to submit to your CISO: our security manager will respond within two business days.
You can also email us directly at protectiondesdonnees@booper.fr.