Security overview
Lornez Group maintains technical and organizational safeguards for its public websites, business communications, application integrations, and supporting records. Controls are selected according to the sensitivity of the information and the relevant operational risk.
We use defense in depth: a public website control is not treated as a substitute for access restrictions, service isolation, secure configuration, monitoring, backup protection, or credential management.
This page describes the control model at a useful public level. It intentionally does not disclose credentials, internal addresses, detailed firewall rules, recovery secrets, or information that would materially weaken security.
Control framework
HTTPS for public websites and encrypted database transport.
Dedicated website boundaries and separation between public assets, runtime configuration, and protected records.
Restricted administrative access and database accounts limited to the required application scope.
Reviewed builds, protected runtime secrets, sensitive-path blocking, rollback snapshots, and post-deployment checks.
Operational logs, security review, credential rotation, incident containment, and external verification where appropriate.
Retention limits, protected backups, deletion workflows, and restricted handling of privacy requests.
Data and access security
Our ordinary security principles include:
- Collecting only data that is relevant to an identified business, legal, security, or integration purpose.
- Limiting access to authorized personnel and providers with an operational need.
- Keeping credentials and environment configuration outside public website content.
- Restricting databases and application listeners from unnecessary public access.
- Using strong credential practices and rotating a credential when exposure is suspected or confirmed.
- Applying updates, reviewing dependency and operating-system support status, and planning migrations for unsupported systems.
- Preserving relevant evidence and reviewing related systems after a confirmed incident.
Security measures evolve. No internet-connected system can be represented as completely risk free.
Assurance and certifications
| Assurance item | Public status | Meaning |
|---|---|---|
| HTTPS across group websites | Deployed | Public web traffic is served over encrypted connections. |
| Separated service access | Deployed | Business websites operate with distinct application and record boundaries. |
| Privacy and deletion process | Published | Public notices and a dedicated request route are available. |
| ISO 27001, SOC 2, or equivalent group certification | Not currently claimed | No independent certification is represented unless an issued, in-scope certificate is listed here. |
Product, material, factory, or supplier certificates are project-specific and are not automatically group-wide information security certifications. They should be verified in the relevant business process.
Responsible disclosure
We welcome good-faith reports that help us protect users, clients, and systems. A useful report should allow us to understand and reproduce the issue without exposing more information than necessary.
When researching or reporting an issue:
- Stop after obtaining the minimum evidence needed to demonstrate the issue.
- Do not download, retain, alter, delete, or disclose personal, commercial, credential, or confidential data.
- Do not disrupt services, use denial-of-service techniques, send spam, or test physical or social-engineering attacks.
- Do not access another person's account or expand access beyond the minimum necessary proof.
- Give us a reasonable opportunity to investigate and remediate before public disclosure.
Lornez Group does not currently operate a public bug-bounty program. A report does not create an entitlement to payment. Any bounty, recognition, testing authorization, or confidentiality arrangement must be agreed in writing in advance.
How to report
Email lornez@lornez.com with the subject Security Report. Include:
- The affected domain, URL, system, or feature.
- A concise description of the vulnerability and impact.
- Clear, non-destructive reproduction steps.
- Sanitized screenshots, request samples, or logs where useful.
- Your preferred contact details and disclosure expectations.
Never send live passwords, secret keys, full database exports, or unnecessary personal data. Redact secrets and provide only the minimum evidence required.
Prepare security reportTesting boundaries
This disclosure guidance is not prior authorization to access a system, account, network, API, or dataset. Researchers remain responsible for complying with applicable law and avoiding harm.
The following are ordinarily outside scope unless expressly approved in writing:
- Denial of service, load testing, or resource exhaustion.
- Social engineering, phishing, or impersonation.
- Physical security or provider-employee testing.
- Automated high-volume scanning that materially affects availability.
- Findings based only on missing best-practice headers without a demonstrable impact.
- Third-party systems not controlled by Lornez Group.
Contact
Security reports and assurance questions may be sent to:
LORNEZ GROUP
36 rue Scheffer, 75016 Paris, France
lornez@lornez.com
A machine-readable contact record is also published at /.well-known/security.txt.
Personal-data concerns should use the Privacy Notice and Data Deletion Instructions.