Security and availability
How the platform is hosted, protected and backed up, with the latest check results.
Availability, 90 days
100.00%
Latest backup
23 September 2026,
Latest security scan
22 September 2026
Hosting
The platform runs on shared web hosting managed with cPanel: AlmaLinux 9, Apache with PHP-FPM 8.3 and a MariaDB 10.11 database. Traffic goes through Cloudflare, which provides HTTPS encryption, caching of static files and protection against denial of service attacks. Scheduled tasks (queues, backups, checks) are started every minute by the server scheduler.
Portability: the same application can be deployed with Docker (application, background workers, scheduler, MariaDB, Meilisearch containers). The procedure is described in the deployment documentation.
Security measures
- Encrypted connection (HTTPS) required, with an HSTS header.
- Strict Content Security Policy (CSP): no external scripts, inline scripts allowed only with a one-time token per page.
- Two-factor authentication required for every management team account.
- Audit log of administration actions: who created, changed or deleted what, and when.
- Rate limits on sign-in, the API, search and the assistant.
- Uploaded files checked: real type, size and content.
- No third-party resources loaded by the pages: fonts, maps and charts are served by the platform.
Backups
Every night the database and uploaded files are archived and encrypted (AES-256). Archives are kept outside the public web space: one per day for 30 days and one per month for 12 months. A copy can be sent to external storage. Every week the latest backup is automatically restored into a test database to check that it can be used.
Security scan
An automated OWASP ZAP scan ("baseline" profile) looks for common web application weaknesses.
Accepted risks (documented, not fixed)
- CSP: script-src 'unsafe-eval' (site-wide) : accepted risk. Alpine.js (shipped with Livewire 4, used by Filament) evaluates x-data/x-on/x-show expressions with new Function(), which needs 'unsafe-eval'. The CSP-safe Alpine build only accepts a subset of expressions and Filament does not support it yet: removing it would break the admin panel and existing public components. 'unsafe-eval' does not allow injected <script> tags or inline event handlers to run, the per-request nonce still blocks those. Fix path: move to Alpine's CSP-safe build (Livewire 4's csp_safe option) once Filament supports it.
- CSP: script-src 'unsafe-inline' (Filament panel, /gestion only) : accepted risk. Filament's vendor views print inline <script> tags without a nonce. Limited to /gestion/* routes, behind login with mandatory two-factor authentication for every management team account. Fix path: track future Filament releases for CSP nonce support.
- CSP: style-src 'unsafe-inline' (site-wide) : accepted risk. Style attributes (Filament, ECharts, MapLibre, bar widths) cannot carry a nonce. Style injection is far less dangerous than script injection (no code execution). Fix path: move remaining dynamic styles to CSS classes driven by variables.
Load test
A load test scenario (k6) simulates visitors reading procedures, searching and using the simulator.
Availability
The platform checks itself every five minutes (database, cache, queue, disk space, backups). The history of the last 90 days is public.
Current status: Operational. Latest check: 23 September 2026, 07:55
Availability over the period: 100.00%
