The security of your exchanges, explained precisely.
Where the data is hosted, how it is encrypted, who signs in, who has access, and what is logged. The answers your CISO and your DPO will look for, chapter by chapter.
- Open sessionsSpot and close open sessions.
Where you are signed in
- 203.0.113.24Last used 10/18/2026This device
- 198.51.100.7Last used 10/16/2026Sign out
- 203.0.113.90Last used 10/2/2026Sign out
Sign out of all 2 other sessions - New deviceAn alert flags every new device.New sign-in to your account
New sign-in
Your account was just used on a device we have not seen before.
- Device
- Firefox, macOS
- Date
- 10/16/2026 8:42 AM
- IP address
- 198.51.100.7
If this was not you, change your password now and review your sign-in methods.
Secure my account - Rights per spaceWhat each person can do, set person by person.
Permissions
Decide who can use each feature in this secure space.
ManagersRecipients- Messages
- Attachments
- Form responses
- Request responses
- Vault downloads
- Vault uploads
- Vault folders
Save - Activity logEvery upload, view, and validation, exportable as CSV.
Traceability
T3 rental Les Tilleuls, Julie Moreau
All sendersSelect events- 1 file added to the vaultAlain Moreau - Tax notice.pdfAlain Moreau · October 10 at 8:02 PMAlain MoreauOctober 10 at 8:02 PM
- Answer given to the requestDocument request - Guarantor's latest tax noticeAlain Moreau · October 10 at 8:02 PMAlain MoreauOctober 10 at 8:02 PM
- Automatic reminder to participantsNestor · October 9 at 9:00 AMNestorOctober 9 at 9:00 AM
- 1 file added to the vaultDeed of guarantee.pdfClaire Dumont · October 8 at 11:20 AMClaire DumontOctober 8 at 11:20 AM
- 1 participant added to the secure exchange spaceAlain MoreauClaire Dumont · October 6 at 9:31 AMClaire DumontOctober 6 at 9:31 AM
01Hosting
Your documents are hosted in France, on sovereign infrastructure.
The Nestor application and the documents in your spaces are hosted in France, by a fully sovereign European hosting provider.
- Application and documents
- In France, on fully sovereign European infrastructure.
- CLOUD Act
- No dependency: no provider subject to US law hosts the application or your documents.
- This website
- The wearenestor.com website is hosted separately, in the European Union. It holds none of the data in your spaces.
02Encryption
Encrypted in transit, and once stored.
- Your browserYou or the people you work with
- Encrypted in transit (TLS)
- NestorThe application
- Encrypted at rest by the hosting provider
- StorageIn France, sovereign hosting
Encryption at rest is handled by the hosting provider. It is not end-to-end encryption.
03Identities
A way to sign in that suits each person.
Your teams
- SSO
- SAML 2.0 or OpenID Connect, set up by your administrator.
- Mandatory SSO
- You can send your managers straight to your identity provider: its authentication policy then applies. The people you work with keep their own sign-in.
- Two-factor authentication
- With a passkey, which each user can turn on.
- Methods offered
- You choose the sign-in methods offered to your members and guests on the sign-in screen.
- Passwords
- A password policy aligned with the recommendations of ANSSI (the National Cybersecurity Agency of France), enforced on the server side.
- Sessions
- See and close open sessions. An email alert flags every new device.
The people you work with
- Sign-in
- With a link or a code received by email, or with a Google or Microsoft account.
- Portals
- The email address is verified with a code before anything is uploaded.
Sign-in methods
- Password
- Magic link
- Email code
- Passkey
- Single sign-on (SSO)
04Access
Only invited people can access a space.
- By spaceSpace by space, you set what each person can do: write, upload, download.
- Between partiesEveryone in a space sees the same documents. To keep two parties apart, open a space for each.
- WatermarkAdd a watermark to shared documents.
05Logging
Who did what, and when.
- Activity log
- For each space, campaign, and portal, exportable as CSV.
- For your contacts
- Each participant can view the log of the space they are invited to, with the names of the other participants. Exporting it is reserved for your team.
- Views
- For each file uploaded or attached to a message, you know who opened or downloaded it.
- Versions
- Previous versions of a document remain available and can be restored.
06Governance
An ISO/IEC 27001:2022 certification process, documented.
Nestor is pursuing ISO/IEC 27001:2022 certification. Our information security management system is documented, and we send its documents to your teams on request.
Certification has not been obtained yet: we will say so here on the day it is.
- Standard
- ISO/IEC 27001:2022
- Status
- Certification process under way
- Documentation
- Sent on request
07GDPR
What our terms say, and what stays with you.
“Paprwork acts as the Customer's processor within the meaning of the GDPR. Paprwork may also act as a service provider where the contract so provides.”
Nestor helps you meet certain requirements: traceability, access control, hosting in France. Compliance remains your organization's responsibility.
08Documentation
The documents of our certification process, on request.
Send us your request with the name of your organization: we send these documents to your security team or your DPO.
- 01Information security management system manual
- 02Information security policy
- 03Encryption policy
- 04Identification and authentication policy
- 05Security incident management policy and procedure
- 06Business continuity and disaster recovery plan
What they say
“Nestor brings that compliance side very simply, where you won't get it with free open-source products.”
Frequently asked questions
Frequently asked questions
Is Nestor ISO 27001 certified?
Not yet. Nestor is pursuing ISO/IEC 27001:2022 certification, and the documents of its information security management system are sent on request.
Where is the data hosted?
In France, on fully sovereign European infrastructure, with no dependency on the US CLOUD Act.
Are documents end-to-end encrypted?
No. Exchanges are encrypted in transit (TLS), and files are encrypted at rest by our hosting provider.
Can we make two-factor authentication mandatory for our teams?
Not from Nestor: each user turns it on for their own account, with a passkey. To enforce your own policy, make SSO mandatory: your managers then always go through your identity provider (SAML 2.0 or OpenID Connect) and its authentication rules.
How do we get the security documents?
Request them from the contact page, with the name of your organization and the scope of your review: we will send you the documents of our ISO/IEC 27001 process.
Need answers for your security team?
Ask your questions through our form: we answer your CISO or your DPO and send you the documents of our ISO/IEC 27001 process.
- Fully sovereign European hosting
- No account to create for the people you work with