PASSI - Information System Security Audit Provider
PASSI is a qualification issued by ANSSI (the French National Cybersecurity Agency) to providers authorised to carry out security audits on behalf of French government bodies and critical operators. The qualification covers five audit scopes: architecture, configuration, source code, penetration testing and organisational/physical. It is governed by the PASSI Requirements Framework published by ANSSI and updated periodically.
For a public buyer or a vital-importance operator (OIV), requiring a PASSI audit of the selected solution is a common due-diligence measure. The official list of qualified providers is published on the ANSSI website at cyber.gouv.fr.
SecNumCloud - ANSSI qualification for sovereign hosting providers
SecNumCloud is the French reference qualification for sovereign cloud computing providers. The framework requires independence from non-European law (notably the CLOUD Act and FISA Section 702), physical localisation of data and operations within the territory of the European Union, and strengthened technical measures for encryption, auditing and business continuity.
The SecNumCloud 3.2 framework is published by ANSSI. Its qualification is mandatory for hosting sensitive State data within the meaning of the General Security Framework (RGS). ARDNTECH selects its hosting subcontractors from among providers aligned with this framework.
HMAC-SHA-256 - Hash-based Message Authentication Code
HMAC is a mechanism for computing a message authentication code from a cryptographic hash function and a secret key, defined by RFC 2104 (IETF, 1997). Its HMAC-SHA-256 variant uses the SHA-256 function standardised by NIST in FIPS 180-4 and produces a 256-bit MAC. In practice, HMAC-SHA-256 is used to guarantee the integrity and authenticity of a message without revealing the key.
Chaining HMAC (where the HMAC of an event includes the HMAC of the previous one) builds an immutable audit chain: any retroactive modification of an event breaks the chain and becomes detectable. ARDNTECH uses chained HMAC-SHA-256 for its audit log, verifiable through a public CLI command.
Argon2id - Modern key derivation
Argon2 is the key-derivation algorithm that won the Password Hashing Competition (2015), standardised by RFC 9106 (IETF, 2021). Argon2id, its hybrid variant, combines Argon2i's resistance to side-channel attacks with Argon2d's resistance to time-memory trade-off attacks. It takes three parameters: memory cost, time cost and parallelism.
For interactive use, RFC 9106 recommends a memory cost of at least 64 MiB, 3 iterations and 1 lane of parallelism. For higher-intensity server use, it recommends 256 MiB or more. ARDNTECH implements Argon2id with 256 MiB of memory, in line with the RFC 9106 recommendations.
Zero-knowledge - Architecture with no plaintext access
An architecture is described as zero-knowledge when, by cryptographic design, the server has no technical means of reading user data in plaintext. Encryption and decryption are performed entirely on the client side with a key derived from the user's passphrase, which is never transmitted to the server.
The operational consequence is that an attacker compromising the server (or the publisher itself, compelled by a legal request) only gains access to encrypted blobs that are unusable without the holder's key. The trade-off is that the publisher cannot recover a forgotten password: the reset mechanism necessarily destroys the previous vault.
OpenPGP - Asymmetric encryption standard
OpenPGP is the open standard for message encryption and signing, derived from the Pretty Good Privacy tool. Its current specification is RFC 9580 (IETF, July 2024), which replaces RFC 4880. OpenPGP combines symmetric encryption for content (AES-256-GCM, ChaCha20-Poly1305) with asymmetric encryption for key exchange (RSA, X25519, Ed25519).
In a B2B vault, OpenPGP makes it possible to encrypt a secret for several recipients without central re-encoding: each user has their own key pair, and sharing consists of re-encoding the symmetric session key for the new recipient's public key. ARDNTECH uses OpenPGP RFC 9580 on the client side for sharing secrets between users of the same organisation.
X25519 / Ed25519 - Modern elliptic curves
X25519 is a Diffie-Hellman key-exchange algorithm on the Curve25519 curve, defined by RFC 7748 (IETF, 2016). Ed25519 is the associated signature algorithm, defined by RFC 8032. Designed by Daniel J. Bernstein and his team, these algorithms offer a security level equivalent to a 3072-bit RSA key with a far smaller memory and CPU footprint.
Their adoption is now widespread: TLS 1.3, SSH, Signal, WireGuard, and OpenPGP since RFC 9580. The Edwards curves avoid the common implementation pitfalls of the legacy NIST curves (P-256, P-384) by making side-channel attacks harder to mount.
AES-256-GCM - Authenticated symmetric encryption
AES-256-GCM is the Advanced Encryption Standard in Galois/Counter Mode, with a 256-bit key. The GCM mode is standardised by NIST in NIST SP 800-38D and provides both confidentiality (through counter-mode encryption) and authentication (through a MAC derived from a multiplication in GF(2¹²⁸)).
Its widespread use is explained by its hardware performance (the AES-NI and CLMUL instructions of x86_64 and ARMv8 processors) and its proven resilience. It remains sensitive to IV reuse, which must be random or strictly sequential. AES-256-GCM is the default symmetric primitive of OpenPGP RFC 9580 and TLS 1.3.
CLOUD Act - US extraterritoriality 2018
The Clarifying Lawful Overseas Use of Data Act is a US federal law enacted on 23 March 2018. It authorises US authorities to require an operator subject to US law to hand over user data, regardless of its physical storage location. The full text is published on congress.gov.
A US company, or the European subsidiary of a US company, remains subject to the CLOUD Act even if its servers are physically located within the Union. It is this structural criterion that distinguishes a genuinely sovereign publisher from one whose parent company falls under US law.
FISA Section 702 - Surveillance of foreign nationals
The Foreign Intelligence Surveillance Act, in its Section 702 added in 2008, authorises the collection of electronic intelligence by US agencies (NSA, FBI) on non-US persons located outside the territory of the United States, with the mandatory cooperation of US electronic communications operators.
The CJEU ruled in 2020 (Schrems II ruling) that this regime, lacking any effective remedy mechanism for the persons targeted within the EU, is incompatible with the fundamental guarantees of European law. It is one of the recurring reasons why European CISOs rule out operators subject to US law.
Schrems II - CJEU ruling C-311/18 (2020)
The Data Protection Commissioner v Facebook Ireland and Maximilian Schrems ruling, handed down on 16 July 2020 by the Court of Justice of the European Union, invalidated the Privacy Shield adequacy decision governing transfers of personal data between the EU and the United States.
Since Schrems II, any transfer to a third country relying on Standard Contractual Clauses must be preceded by a Transfer Impact Assessment documenting the absence of any risk of foreign surveillance. For DPOs, choosing a strictly European publisher avoids this procedure and the associated regulatory risk.
GDPR Art. 28 - Data processing
Article 28 of Regulation (EU) 2016/679 governs the relationship between the data controller and the processor. It requires the conclusion of a written contract setting out the subject matter and duration of the processing, its nature and purpose, the type of data and the categories of data subjects, as well as the controller's obligations and rights.
In practice, any SaaS publisher is a processor within the meaning of Art. 28 as soon as it processes personal data on behalf of its clients. ARDNTECH provides a standardised DPA (Data Processing Agreement) included in the Business plan and negotiable in Enterprise.
GDPR Art. 32 - Security of processing
Article 32 of Regulation (EU) 2016/679 requires the data controller and the processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The measures explicitly cited include the encryption of data and the ability to ensure the confidentiality, integrity, availability and resilience of systems.
The assessment of the appropriateness of the measures must take into account the state of the art, the costs of implementation and the nature, scope and purposes of the processing. For a B2B secrets vault, end-to-end encryption with recent algorithms (AES-256-GCM, Argon2id RFC 9106) typically satisfies this requirement.
DPA - Data Processing Agreement
A DPA (Data Processing Agreement) is the contract required by Article 28 of the GDPR between a data controller and its processor. It specifies the purposes of the processing, the categories of data concerned, the retention period, the security measures applied and the conditions for sub-processing.
For a B2B buyer subject to the GDPR, requiring a signed DPA before deploying any SaaS tool that processes personal data is a legal obligation, not an option. ARDNTECH provides a standardised DPA included in the Business plan, and a negotiated DPA in Enterprise.
DPO - Data Protection Officer
The Data Protection Officer (DPO) is the role created by Article 37 of the GDPR. Their designation is mandatory for public authorities and bodies, for organisations whose core activity requires regular and systematic monitoring of individuals on a large scale, and for organisations processing special categories of data (health, biometric data, etc.) on a large scale.
The DPO advises on GDPR compliance, oversees impact assessments (DPIAs), cooperates with the CNIL and acts as a contact point for data subjects. When evaluating a secrets vault, the DPO validates in particular the DPA and the assessment of transfers outside the EU where applicable.
NIS2 - European cybersecurity directive
Directive (EU) 2022/2555, known as NIS2 (Network and Information Security), replaces the 2016 NIS directive and significantly extends the scope of operators subject to cybersecurity obligations. It now covers essential and important entities across broadened sectors (energy, transport, health, digital infrastructure, managed services, etc.).
NIS2 imposes risk-management measures, incident notification within 24 hours (initial alert) and 72 hours (full report), and supply-chain security obligations. Its transposition into French law is under way. For vital-importance and essential-service operators, NIS2 strengthens the requirements that existed under the LPM and NIS1.
OIV - Operator of Vital Importance
An Operator of Vital Importance (OIV) is a public or private organisation whose activity is deemed indispensable to the proper functioning of the French nation, designated confidentially by decree of the Prime Minister. OIVs are subject to the provisions of the Military Programming Law (LPM) on cybersecurity.
OIV obligations include declaring critical information systems (SIC) to ANSSI, complying with security rules defined by sector-specific decree, and notifying security incidents. For a SaaS publisher, being eligible for selection by an OIV implies meeting qualification requirements (SecNumCloud) and responding to PASSI audits.
TOTP - Time-based One-Time Password
TOTP (Time-based One-Time Password) is an algorithm for generating one-time passwords based on the current time, defined by RFC 6238 (IETF, 2011). It combines a shared secret (TOTP seed) and a time counter (30-second windows by default) via the HMAC-SHA-1 function to produce a 6-digit numeric code.
TOTP is the most widespread second-factor mechanism in enterprise applications. It is supported by all standard authentication applications (Google Authenticator, Aegis, etc.) and by ARDNTECH. RFC 6238 can be read publicly on tools.ietf.org.
WebAuthn / Passkey - Passwordless authentication
WebAuthn (Web Authentication API) is a W3C standard that allows web applications to authenticate a user using a FIDO2 authenticator (hardware key, fingerprint, facial recognition). The specification is published at w3.org/TR/webauthn-3/ . Passkeys are a consumer implementation of WebAuthn where the key pair is synchronised across devices via a key manager (iCloud Keychain, Google Password Manager).
From a security standpoint, WebAuthn is natively resistant to phishing (the key is bound to the domain origin) and to replay attacks. For a B2B secrets vault, enabling WebAuthn for unlocking removes the most common compromise vector in enterprises: theft of the master password through phishing. ARDNTECH supports WebAuthn / Passkeys on all plans.
AGPL-3.0 - Network copyleft open source licence
The GNU Affero General Public License version 3 (AGPL-3.0) is a free software licence published by the Free Software Foundation. It requires that any network deployment of software covered by this licence make the corresponding source code available to the users who access it, including via a web service.
For ARDNTECH, publishing under AGPL-3.0 means that any organisation deploying a modified ARDNTECH instance must publish its modifications. It is a structural guarantee for clients: if ARDNTECH ceased to exist, the code would remain accessible and maintainable by the community. The cryptographic code can be audited by any CISO or PASSI auditor without special access.
