Coming
Post-quantum cold encryption
Documents you keep for the long term will be protected at rest with encryption designed to resist the computers of tomorrow, not only today's.
See the roadmapSovereignty
Your documents, your analytics, your AI: in France, under French operation
Four facts about where your data lives and who touches it. No certification we do not hold, no superlative, no small print.
The four facts
Everything on this page derives from these four statements.
- Hosting
- Dedicated servers in France, operated by a French company, outside the scope of the US CLOUD Act.
- The company that operates Dicte Send is French, and the servers are dedicated to it and located in France.
- AI
- AI models run on Dicte Send's own dedicated servers. Document text and page images are processed there and nowhere else.
- Search, analyses and the assistant use no external AI service. What the AI reads never leaves the servers your documents already live on.
- Subcontracting
- None: no third-party AI service, no external analytics processor.
- No provider outside the EU can be compelled to hand over your documents through the CLOUD Act, because none is involved.
- GDPR
- Applies in full: data-subject rights, erasure, hashed IP addresses, consent records, audit log.
- You remain the controller of your documents and your recipients' data; Dicte Send processes them on your instructions, and a data-processing agreement is available on request.
Location is not jurisdiction
Hosting in Europe is not enough
A server in Europe operated by a US company still answers to US law: the CLOUD Act reaches the provider wherever the data sits. What protects you is who operates the service. Dicte Send is operated by a French company, on dedicated servers in France, outside the scope of the US CLOUD Act. This is a statement of fact, not legal advice; your counsel can verify it against our contract.
AI that stays home
No page of yours is sent to a third-party model
Search, analyses and the assistant run on Dicte Send's own dedicated servers. There is no call to an external AI service, no subscription to a foreign provider, no copy of your pages elsewhere. If you switch the AI off, nothing else changes.
Learn moreWhat we keep, and why
Hashed IP addresses
Visitor addresses are stored as a hash: enough to spot abuse and prove consent, not enough to identify a person from the record.
One strictly necessary cookie
The application sets a single cookie needed to keep you signed in. No third-party script, no tracker, here or in the product.
Consent records
When a recipient accepts a rule at the gate, an NDA or a disclosure, the acceptance, the time and a hashed address are kept as proof.
An audit log
Administrative and security actions are recorded with identifiers, never content. Exportable by your administrator.
Retention you control
Visit records are purged after the period your administrator sets. Documents you delete are kept briefly for recovery, then removed.
What we do not claim
Sovereignty claims are cheap to make and expensive to prove. We make only the four above.
No certification we do not hold
Security and hosting certifications will be published on the trust page when obtained, never before.
No absolute immunity
No service is immune to every foreign law. We state the jurisdiction we operate under and the law that does not apply to us.
No detail that helps an attacker
We do not publish the names of our suppliers or the layout of our infrastructure. Your security team can ask us under NDA.
No number we cannot source
No customer counts, no uptime percentages, no ratings until they exist and can be checked.
Who reads this page first
Legal professions
Lawyers, notaries and in-house counsel who owe professional secrecy to their clients and cannot have a US provider in the chain.
Legal use caseDeal teams
Advisers who handle counterparties' data and must show where it went.
M&A use caseRegulated and public-adjacent organisations
Consultancies and HR advisers processing personal data for clients who ask where it is stored and by whom.
HR and consulting use case
Coming
Bring this page to your DPO
Then talk to us. We answer the questions a security questionnaire asks, in writing.
Questions about sovereignty
Is the data stored in France?
Yes. Documents, analytics, AI processing and your recipients' data are stored and processed on dedicated servers in France.
Does the US CLOUD Act apply to Dicte Send?
No. Dicte Send is operated by a French company on dedicated servers in France, outside the scope of the US CLOUD Act. No US provider is involved in operating the service.
Who operates the servers?
The French company that publishes Dicte Send. The servers are dedicated to the service and located in France; we do not publish the name of the data-centre supplier on this site.
Is the AI processed by a third party?
No. AI models run on our own dedicated servers. No model or service is subcontracted.
Are you certified?
We publish only what we can prove. Certifications will appear on the trust page when obtained.
Can I get this in writing?
Yes. On request we provide a written statement of these facts for your compliance file, and a data-processing agreement.