Built for the most demanding organizations
Encryption by design, full isolation and complete traceability — for your most sensitive crisis data.
Per-tenant encryption
Each organization has its own AES-256 encryption key. Only the tenant administrator can decrypt its data: the key stays in your hands.
Mandatory MFA
Multi-factor authentication (TOTP) is mandatory per organization. The second factor is required for everyone, administrators included.
Granular RBAC
Seven application roles, plus roles specific to each exercise.
Complete audit trail
All sensitive actions are logged with identity, timestamp and origin. SIEM-compatible export.
Sovereign hosting
Infrastructure hosted in France, with a French operator, end to end. Data encrypted at rest.
Your regulatory regime, taken into account
Your regime — NIS2, DORA, LPM, HDS, PCI-DSS, ISO 27001 — is declared in the organization profile, then taken into account when generating scenarios, units and deliverables. CrisisLab applies the corresponding technical measures; official certification remains to be obtained.
OIDC SSO
Authentication delegated to your identity provider over OpenID Connect, configured per organisation. Your password, session and revocation rules keep applying.
Scoped service accounts
Integrations use dedicated API keys, limited to explicit scopes and revocable independently of user accounts.
AI under governance
Lena acts only within the rights of the user who calls on her; every one of her actions is logged, usage is capped by quotas, and the model provider is chosen per organisation — models operated in France are among them. When she answers from her own knowledge, she says so.
One memory per organisation
Every memory stays inside its organisation. What Lena learns at your place — documents, exercises, decisions — belongs to you.
Where CrisisLab runs
The guarantees above apply to the platform we operate. Three delivery modes exist, and they do not put the machines in the same place.
- Available
Shared SaaS
Hosted in France, partitioned per organisation
- Coming
Dedicated SaaS
An instance that is yours alone
- Coming
On-premise
An appliance inside your infrastructure
Compliance frameworks
Declare your regime: it steers the scenarios proposed, the crisis units assembled and the deliverables produced.
Documented, traceable regulatory exercises
Operational resilience testing for financial entities
LPM
Suited to operators of vital importance under French military programming law
For healthcare organisations and health data hosting providers
ISO 27001
Exercises filed as evidence for your management system
Data hosted in France, bounded retention, data subject rights respected
Questions about security?
Our team can provide detailed compliance documentation.