Privacy policy

Summary

This website sets no cookies, runs no analytics, embeds no tracking pixel and makes no request to any third-party server. Fonts, styles, scripts and images are served from this domain only. The contact form's anti-spam check is a proof-of-work computed inside your own browser: no hosted captcha, no fingerprinting, nothing to consent to, and no data leaving this domain.

Data controller

Vault & Vector, a French sole trader established in Paris. Contact: contact@vaultandvector.io. Full legal identification is provided on request.

Cookies and tracking

None. No cookie is written and no consent banner is therefore required. The only thing this site keeps in your browser is your light-or-dark theme preference, if you set one: a single local value, never sent to the server, used for nothing else, and removable by clearing site data. This is a deliberate choice: a consultancy that advises on access control and data governance should not instrument its own visitors.

Server logs

The hosting provider records technical connection logs (IP address, timestamp, requested resource, user agent) for the sole purposes of delivering the page, maintaining service availability and preventing abuse. These logs are processed on the basis of legitimate interest (Article 6(1)(f) GDPR) and are not used to build profiles, are not cross-referenced with any other source, and are not shared with third parties for marketing purposes.

Messages you send us

Whether you write by email or use the contact form, the data you choose to send (typically your name, email address, organisation and the content of your message) is processed to answer your request and, where relevant, to prepare a possible engagement. The legal basis is the taking of steps at your request prior to entering into a contract (Article 6(1)(b) GDPR), and our legitimate interest in responding to business enquiries (Article 6(1)(f) GDPR).

The form transmits nothing beyond the fields you fill in. No cookie is written, no identifier is stored in your browser, and the anti-spam proof is discarded once verified. Submissions reach the same mailbox as a direct email. Providing an organisation is optional.

Correspondence that does not lead to an engagement is deleted within three years of the last contact. Correspondence relating to an engagement is retained for the duration of the contractual relationship and for the applicable legal limitation and accounting periods.

Recipients

Your data is not sold, rented or transferred for commercial purposes. It is accessible only to the data controller and to the technical providers strictly necessary to operate the site and the mailbox (the hosting provider and the email provider) acting as processors under contract.

Your rights

Under the GDPR you have the right to access, rectify, erase and port your data, to restrict or object to its processing, and to give instructions on its fate after your death. These rights can be exercised by writing to contact@vaultandvector.io. We answer within one month.

If you consider that your rights have not been respected, you may lodge a complaint with the French supervisory authority, the CNIL: cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

Security

The site is served over HTTPS only, with HSTS and a restrictive Content Security Policy. A security.txt file is published for the coordinated disclosure of any vulnerability found on this domain.

Changes

Any change to this policy is published on this page.