Draft — document under review by a lawyer. Fields marked [to be completed] are still to be filled in.

This translation is provided for information only: the French version of this document is the only legally binding version. Version française

Data sovereignty and hosting

Version of October 14, 2026

Where are your documents, who can access them, how can you get them back? This page answers these questions factually, and gives you what you need to pass them on to your purchasing department or your data protection officer.

1. Hosting in the European Union

Omnifloo Office runs on virtual private servers (VPS) hosted by OVH SAS (Roubaix, France), in France. Accounts, documents and their backups stay within the European Union. The technical addresses of the servers are deliberately not published.

2. Data protection (GDPR)

DYONYSOS SASU is the controller of account, billing and support data. For the personal data you place in your documents, it acts as a processor within the meaning of Article 28 GDPR and processes it only to provide the service. A record of processing activities is kept up to date. Purposes, retention periods and rights are detailed in the privacy policy, the publisher in the legal notice and the contractual framework in the general terms of sale. A data processing agreement is provided on request.

Your data is neither sold nor used for advertising, and the content of your documents is never analysed.

3. Non-European legislation

The servers are located in France and the hosting provider is a company governed by French law. We give no legal opinion on the possible application of foreign laws, in particular the US Cloud Act: that analysis depends on each organisation's situation and on the structure of the providers, and is a matter for your legal counsel. We provide the facts needed for that analysis: location, no transfer outside the European Union for accounts, documents and backups, list of processors and security measures (table below).

Two optional features may involve processing outside the European Union, only at your initiative: audience measurement of the public website if you accept it, and the writing assistant if you set it up with the artificial intelligence provider of your choice.

4. Encryption and security

Encrypted connections (HTTPS) between your browser and the service.
Passwords stored in irreversibly hashed form, never readable.
Exchanges between the space and the editing server are signed.
Administration access restricted and protected by key; technical secrets stored outside the source code.
Regular security updates.

5. Backups

Encrypted backups of the workspace database and files are being set up. No backup commitment is made until they are in service: this section will be completed at that point.

6. Reversibility: export all my data

Your documents belong to you and you can leave at any time, in open formats, without going through us. At the end of the contract, the account stays read-only for 30 days so you have time to recover everything.

Export all my data Download my files

The first button opens, in your space, the export function for your account (files, settings and, depending on the apps enabled, calendar and contacts, in one archive). The second opens your files: tick the box at the top of the list to select everything, then choose Download to get a .zip archive. Sign in to your space if needed.

7. Fact sheet for public procurement files

A one-page sheet gathers the information public buyers ask for: hosting provider, location, processors, security measures and data processing agreement. Preview:

Item	Information
Service	Omnifloo Office: online office suite (documents, spreadsheets, presentations, PDF, document storage and sharing).
Publisher and data controller	DYONYSOS SASU, registered office in Mouguerre (France). Contact: contact@omnifloo.com.
Hosting provider	OVH SAS (Roubaix, France)
Data location	France — accounts, documents and backups are kept in the European Union; the technical addresses of the servers are not published.
Processors	OVH SAS (Roubaix, France) — hosting of the servers (France); [to be completed] — sending of service e-mails; [to be completed] — payment for paid plans, once they open; Google Ireland Limited — audience measurement of the public website, only after the visitor's consent (no account or document data).
Transfers outside the European Union	None for accounts, documents and backups. Two possible, optional cases: audience measurement accepted by the visitor, and the writing assistant if the user sets it up with the artificial intelligence provider of their choice.
Security measures	encrypted connections (HTTPS); passwords stored in irreversibly hashed form; exchanges between the space and the editing server are signed; administration access restricted and protected by key, technical secrets kept out of the source code; regular security updates, account cap and quotas.
Backups	Being set up: no backup commitment is made until they are in service.
Reversibility	Export of all data at any time, in open formats (.docx, .xlsx, .pptx, .odt, .pdf, .csv); account read-only for 30 days after the end of the contract.
Data protection (DPA)	For personal data placed in documents, DYONYSOS SASU acts as a processor (Article 28 GDPR): a data processing agreement is provided on request.
Record of processing activities	Kept up to date (Article 30 GDPR). Public privacy policy: https://office.omnifloo.com/confidentialite

Download the sheet (PDF)

For any additional document, write to contact@omnifloo.com.