Platform security
Last updated : 18/10/2026 — The security of your school data is our priority. This page details the technical and organizational measures we apply.
Our commitment
YA-Planning processes sensitive data: student and teacher identities, timetables, educational organization. We apply banking-grade security standards, host in Europe (GDPR), and commit to notifying the establishments concerned within 24 hours in the event of an incident.
1. Data encryption
All communications between your browser and our servers are protected by the TLS 1.3 protocol, the current standard for Internet encryption.
- TLS 1.3 on all HTTP connections (HSTS enabled, forced HTTPS redirection)
- SSL certificates renewed automatically (Let's Encrypt)
- Data at rest encrypted at the file system and backup level
- Session cookies flagged
HttpOnlyandSecure
2. Authentication & passwords
No password is ever stored in plain text. We apply OWASP best practices for authentication.
- BCrypt hashing with adaptive cost (12 rounds) on all passwords
- Signed JWTs for authenticated sessions (short expiry + refresh tokens)
- Minimum complexity policy enforced at sign-up
- Temporary lockout of the account after several failed attempts
- Password reset via a single-use link, valid for 1 hour
3. Hosting & compliance
Our servers are operated by a certified European host, ensuring compliance with the General Data Protection Regulation (GDPR).
- Location: data centers located in France
- Host certifications: ISO 27001, SOC 2 Type II, ISO 27017 (cloud), ISO 27018 (PII)
- GDPR compliance: records of processing activities, identified subprocessors, reachable DPO
- Network isolation: private VLANs, web application firewall (WAF), anti-DDoS protection
4. Multi-establishment isolation
Each establishment has a strictly partitioned space. Your data is invisible to the platform's other customers.
- Filter
etablissementIdapplied automatically to 100% of requests - Server-side validation of authorizations on every API call (zero-trust model)
- Automated tests for regression on lateral leaks
- No sharing of configuration, timetables, or lists between establishments
5. Traceability & audit log
All sensitive actions are logged and viewable by administrators. This lets you answer the questions "who did what, and when?".
- Logins, logouts, authentication failures
- Creation, modification, deletion of users
- Generation, editing, publishing, deletion of timetables
- Data exports, configuration changes
- Log retention: 13 months minimum
6. Backups & continuity
Your data is backed up several times a day. In the event of a technical incident, we guarantee a fast restoration.
- Incremental backups every 6 hours
- Full backups daily, kept for 30 days
- Geographic replication across 2 separate data centers
- Restoration tests documented quarterly
- RPO (maximum acceptable loss): 6 hours · RTO (recovery time): 4 hours
7. Incident notification
In the event of a security incident affecting your data, we commit to:
- Notify within 24 hours the administrators of the establishments concerned
- Detail the nature of the incident, the data impacted, the corrective measures
- Notify the competent authorities (GDPR: within 72 h)
- Publish a public post-mortem within 30 days for major incidents
8. Best practices on the establishment side
Security is a shared responsibility. Here are the recommendations we ask you to apply:
- Strong, unique passwords for each user (password manager recommended)
- Immediately deactivate the accounts of users who leave the establishment
- Restrict the Admin role to a limited number of trusted people
- Never share credentials — create one account per user
- Immediately report any suspicious activity to security@yaplanning.com
Dedicated security contact
Have you identified a vulnerability? Unusual behavior? Our security team is directly reachable.