Română
Português
EspañolLegal & Compliance
Our terms and policies, where your data is, what protects it today — and what we do not have yet.
No certifications held
Updated 8 October 2026
Laws and frameworks we work with
How each one relates to our services today. None of this is a certification or legal advice.
NIS2 Directive
Our Cyber Security Compliance module — continuous monitoring and audit-ready reports — helps you evidence the Article 21 measures and prepare Article 23 notifications.
GDPR and the UAE PDPL
Customer data is stored in France. Our company is in the UAE, so staff access from the UAE is a transfer, covered by the safeguards in our DPA.
Security measures in place
TLS everywhere, strong password hashing, optional two-factor sign-in, revocable device passwords, mail with DMARC reject and MTA-STS enforce, and an audit log of administrative actions.
Foreign legal requests
We are a UAE company hosting in France with OVHcloud. We do not claim immunity from any country's legal process. We disclose data only where we are legally required to, and tell you where we are allowed to.
Where the Services run
All customer data is on one dedicated server in OVHcloud's Strasbourg datacentre. There is no second site yet.
Not in service
PlannedA second location for backups and recovery is planned. Until it exists, keep your own copies.
Strasbourg, France
In serviceDedicated infrastructure running the website, Cloud Office, mail, VPS and security monitoring in separate virtual machines.
Company establishment
No hostingThe company is established in the UAE. No customer data is hosted there; staff may access the Services from there.
| Cluster Node | Host Operator | Physical Jurisdiction | Statutory Privacy Regime | Certifications | Egress Risk Score |
|---|---|---|---|---|---|
| FR-SBG3 | OVHcloud SAS | France (EU) | GDPR | None claimed EU data protection | Staff access from the UAE |
| — | No other site | France (EU) | — | In service — | Staff access from the UAE |
| — | No other site | France (EU) | — | — — | Staff access from the UAE |
| — | No other site | — | — | EU data protection — | Staff access from the UAE |
Data Processing Agreement & Technical Measures
The terms under which we process personal data for you, and the measures behind them.
Technical & Organisational Measures (TOMs)
As listed in the DPA, Annex II
TLS for the website, Cloud Office, IMAP, SMTP submission and sync; HSTS on our websites; MTA-STS (enforce) for incoming mail. Data at rest is not separately encrypted.
Our administrators can technically access customer data on the server. They do so only to provide, secure or support the Services, and administrative actions in Cloud Office are logged.
Services run in separate virtual machines on a private network. Each VPS customer has their own virtual machine; Cloud Office separates organisations by account and checks mailbox grants on every request.
Subprocessor Register
PUBLISHEDEvery subprocessor we use, under GDPR Article 28. We give 30 days' notice before adding one.
OVHcloud SAS
Dedicated server and datacentre (FR)
FranceCloudflare, Inc.
DNS only (not proxied)
No customer contentLet's Encrypt (ISRG)
TLS certificates
No customer contentData protection contact
privacy@totuldigital.com
For data subject requests, questions about this page, and requests from authorities.
Our documents
Everything we publish for customers, assessors and insurers. Ask us if you need more.
Data Processing Agreement
GDPR Article 28 terms, processing details, security measures and subprocessors.
Terms of Service
The agreement for Cloud Office, VPS and the compliance module, including liability and exit.
Privacy Policy
What personal data we handle, why, for how long, and your rights under GDPR and the UAE PDPL.
Security & Vulnerability Disclosure
How to report a vulnerability, our safe-harbour commitment and the scope.
Legal and data protection enquiries
For questions about our terms, a signed DPA, supplier assessments, or requests from authorities.
Check which version you are reading
Each document shows its last-updated date and a SHA-256 fingerprint of its text, so you can tell whether it has changed since you last read it.