Trust & security
Trust is not declared. It is documented.
Where the data lives, who can reach it, what happens during an incident: the decisions a long-term partnership rests on, written for the people whose job is to ask.
Last updated · September 2026
Hosting
Your platforms’ data does not leave the European Union.
Production, backups and analytics for the three platforms run on OVHcloud, in France: Gravelines and Roubaix. Pupil, student, applicant and alumni data stays there: a single data residency, a European supply chain, no transfer to a third country.
This public website is a separate perimeter: its audience measurement and advertising tags, loaded only with your consent, involve US providers. The safeguards framing those transfers are described in the privacy policy.
OVHcloud · Gravelines · Roubaix · 100% EU
Data protection
Aligned with GDPR and the CNDP, by construction.
GEERD operates under the GDPR (European Union) and law 09-08 / CNDP (Morocco).
A data processing agreement, a procedure for answering data-subject requests and retention rules are built into each platform and documented for your DPO. No certification to date; our security documentation is available on request.
GDPR · CNDP · DPA on request
Security & access
Every account is a named account.
Sign-in with a Google Workspace or Microsoft 365 account, role-based access control on BrightStep, EasyClass and AlmaHub.
On admissions and on payment operations, every change is attributed and timestamped in an audit trail. Backups are encrypted.
Google · Microsoft · Roles
Reliability
Eight years in operation, continuous monitoring.
Multi-region failover, daily encrypted backups, continuous monitoring. The description of these mechanisms is part of the security documentation provided on request.
Multi-region · Daily backups · Continuous monitoring
Documents & questionnaires
What your DPO will ask for is already written.
The data processing agreement (DPA), the answers to your security questionnaire and our security documentation are available on request.
We answer compliance requests within five working days.
Answered within 5 working days
Looking for the site’s own data notice?
This page describes the platforms. The processing tied to this website (the contact form, appointment booking, DigiPulse, audience measurement, transfers outside the EU and the CNDP filing) is described in the privacy policy.
A compliance question?
DPO, IT director, purchasing committee: write to us. A real person answers, within five working days.