Privacy Policy

1. Purpose

This document describes the data Sigalion processes, why, and for how long. It covers the website, the client area, the Vault application and the mobile applications. The controller for this processing is Sigalion, a French simplified joint-stock company registered with the Pau Trade and Companies Register, whose contact details appear in the legal notice. We neither host nor transfer any data outside the European Union.

2. What we never see

Your files are encrypted and decrypted on your own device. We never hold your keys or your encryption passwords, and we cannot reconstruct them.

When you timestamp a document, only its fingerprint is sent, never the document. When you verify one, only the proof and the fingerprint are: the timestamp token, or the signature, which contains its signer's certificate. Nothing of it is kept. This is true on the website as well as in the applications.

3. Your account

We keep your username, your e-mail address, your password in a non-reversible form, the date your account was created, the date you last signed in, your credit counters and, where applicable, the organisation your account belongs to. To give you access to the service. Until your account is deleted.

Short-lived tokens are added to this if you ask to reset your password or to change your address.

When you ask for your account to be deleted, it is deactivated immediately, then permanently deleted.

4. Purchases and invoices

We keep the product, the amount, the VAT rate, the country and, for an invoice, your billing details. To carry out the sale and to meet our accounting obligations, which require ten years. This data outlives the deletion of your account, the accounting obligation taking precedence.

Card payments are handled by Mollie: we pass on neither your name nor your e-mail address, only an amount, a description and an internal reference. Your bank details never pass through our servers.

Purchases made from an iPhone or an Android phone go through the App Store or Google Play, and all we keep is the receipt identifier, so that a purchase cannot be credited twice.

5. File transfer

The file you send is already encrypted by your device when it reaches us; we cannot open it. We keep that encrypted file, the recipient's e-mail address, the file name, its size and the expiry and download dates. To carry the transfer through and to give you its history.

The file is deleted after 48 hours, or 7 days on the Giga plan; the history entry, file name included, is erased 7 days after that deadline, 30 days on the Giga plan. If your upload is split into parts, which happens with large files, a technical entry follows its progress and disappears as soon as the upload is complete.

6. Sending the password by SMS

If you choose this option, the password and the recipient's number pass through our servers to be handed to our operator, OVH. We do not keep them.

This function is optional: you may pass the password on by whatever means you prefer, and it is in fact better for it to travel by a different route from the file.

7. Timestamping

Only the fingerprint of your document is sent. For qualified eIDAS timestamping, that fingerprint is sent to the qualified provider you select. The document is never sent, and no fingerprint is kept in our logs.

Verifying a signature or a timestamp requires no account: in that case we gather nothing beyond the log entry described in point 11.

8. API keys and two-factor authentication

An API key is only kept in a non-reversible form, along with the name you give it. If you enable a security key, we keep its public identifier, its public key, the device type and a signature counter. None of these allows you to be authenticated anywhere else. Until you delete them.

9. Organisation accounts

If your account belongs to an organisation, its administrator sees how much credit and storage you use, never the contents of your files nor your passwords.

10. Contact form

Your message reaches us by e-mail and is not recorded in any database. We keep it for no more than three years after our last exchange.

11. Technical logs

Our servers record the requests they receive, to keep the service secure and to detect abuse. The IP address is truncated there and does not allow you to be identified; these logs are kept for 52 days.

Our application logs, kept for about three months, record no full address, no file name and no document fingerprint; some carry the numerical identifier of your account.

12. Cookies

We use two cookies, both strictly necessary and exempt from consent on that ground: your session cookie, which follows you from the website to the client area and remembers the language you chose, and a second, short-lived one, while a security key is in use. No advertising cookie, no tracker, no third-party audience measurement.

Your browser also remembers two display details specific to the contact form, unrelated to your identity.

13. Recipients

Your data is neither sold nor rented. It is accessible to OVH, our host and our SMS operator, and to Mollie for card payments. Apple and Google receive nothing from us: it is with them that you make your purchase. Finally, your data may be disclosed to the authorities where the law requires it.

14. What these processing activities rest on

Three grounds, and none of them is your consent, which we therefore never ask for. The performance of our contract, for everything that makes up the service. A legal obligation, for keeping invoices. And our legitimate interest, for answering your messages and for the security of the service.

15. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. Erasure has one limit, that of invoices, which the law requires us to keep for ten years.

Write to us through the contact form or at the address in the legal notice. You may also lodge a complaint with the CNIL, the French data protection authority.

16. Changes

Any change takes effect when it is published on this page, whose date of last update appears below.

This document is written in French; in the event of any discrepancy with a translation, the French version prevails.

Last updated: 25 September 2026