Sovereignty GDPR-compliant project management software
Looking for GDPR-compliant project management software quickly leads to a list of clauses and certificates. That is a poor starting point, because the question that decides everything comes first: what law governs the company that holds your data. A contractual clause does not protect against a legal obligation to which your provider is subject elsewhere.
What a project tool really contains.
It is readily classed among the tools with no personal data issue. That is inaccurate, and deserves a close look.
Named people
Your teams and the client's: identity, role, business address, assignment to projects.
Working time
Who worked, how much, on what. It is personal data, and it is structuring.
Written content
Minutes, actions, team reports. Texts written by people, sometimes about people.
Client data
Your client's project, its milestones, its risks. You are its custodian, and you answer for it to them.
By design, not by clause.
The Cloud Act allows a US authority to demand data from a company subject to US law, wherever that data is physically stored. The location of a data center is therefore not enough to guard against it: what matters is the law governing the company that runs it, and the law governing its shareholder.
This is why a contractual clause, however well drafted, does not settle the question. It binds your provider to you; it does not release them from a legal obligation to which they are subject in another country.
For pylotik, the answer lies in the structure of the parties: the host is subject to French law, the data stays in the European Union, and the publisher is owned by no one outside France. None of them is targeted by the Cloud Act on the basis of nationality or shareholding. The detail is on the sovereignty and security page, and the four levels of what “French” covers on French project management software.
What is in place.
Four verifiable elements, and a design that makes certain faults impossible rather than forbidden.
Separation between organizations
Each organization is a closed space. An object is visible only to the two organizations it links, and this boundary is carried by the data itself, not by a permissions matrix to maintain.
Audit logs
Access and changes leave a trace. This is what makes it possible to answer a data subject rights request otherwise than from memory.
No profiling of people
Nobody is rated, nothing is scored. No individual index, no emotion inference, no prediction. See team engagement.
A site with no trackers
This site sets no cookies and does not measure audience; fonts are self-hosted, so no visitor address is sent to a third party.
The detail of the processing is in the privacy policy, and the functional tour on the product page.
Compliance is not a certification.
We are not SecNumCloud qualified and we do not imply otherwise: hosting is on standard instances, outside any qualified scope. An organization whose specification requires it should know before consulting us.
Nor do we hold any security certification or sector approval. The General Data Protection Regulation is not a certification either: it is an obligation, and nobody issues a label that would prove you comply with it.
What we can do, however, is answer a security questionnaire or a procurement questionnaire point by point, including where the answer is negative.
What we are asked about compliance.
Where is the data of my project management tool hosted?
At pylotik, in France, at a host under French law, with data that stays in the European Union and backups at a second French provider. Asking this question of any vendor, distinguishing the place of storage from the law governing the host, is the best filter there is.
Can a US tool be GDPR-compliant?
It can comply with the regulation in its processing, and remain subject to legal obligations in its own country. The two questions are distinct, and the second is not settled by a contractual clause.
Who is the data controller?
For the data of your projects and your teams, it is you. The publisher acts as processor within the meaning of the regulation, within the framework defined by the contract. See the terms and conditions.
How do I respond to a data subject rights request?
Since access and changes are logged and the data is tied to identified people, an access or erasure request is handled on facts rather than from memory. The detail is in the privacy policy.
Does the client see my teams' data?
No. Separation between organizations is carried by the data: human resources, management, workload and margins stay invisible to the client, whatever their position.
Do you answer security questionnaires?
Yes, point by point, including when the answer is negative. Write to us from the contact page.
Going further.
- Hosting, GDPR and security: the technical detail, and what we do not claim.
- French project management software: the four levels behind the word.
- The privacy policy: what is collected, and what is not.
- The product tour: rights, client access, separation.