Health data security and compliance at padoa: our commitment to keeping your health data safe
At padoa, data security comes first. We built a solid technical foundation during the development phase and put strict technical and organisational measures (TOMs) in place to protect personal data as fully as possible. Our proactive approach goes beyond simply meeting statutory compliance standards — it reflects a lasting commitment to strengthening data security continuously. Frédéric de Mesmay, CTO & Co-Founder of padoa
👉 Summary
What padoa does with the data it processes
Choosing a highly secure hosting provider
A comprehensive security framework
Health data security and compliance at every level for occupational health services
padoa's stability rests on an in-house Site Reliability Engineering (SRE) team of 18 specialists who build and run a reliable, scalable system architecture. This set-up allows us to handle a steadily growing volume of requests and to maintain an availability rate of more than 99.99%. By combining technical expertise with modern technology, padoa processes data efficiently and keeps the information it handles as secure as possible.
34 million employee health records held at padoa since it was founded in 2016 (active and inactive)
100,000 requests
per minute in January 2025
+99.99%
availability rate in 2024
*padoa internal figures for France, based on usage data across all clients
What padoa does with the data it processes
padoa processes data on behalf of occupational health services for one purpose only: to allow them to carry out their statutory prevention and health remit — protecting employees' health and safety throughout their working lives.
We do not pass this data on to third parties.
We do not sell it.
padoa's business model is a subscription to the platform, paid by the occupational health services. padoa generates no revenue whatsoever from the use of data and does not sell it.
What kind of data are we talking about?
Employee data
This covers personal data (surname, first name, age, gender, contact details), social information (marital status, level of education) and work-related health data recorded by the occupational physician or their team during occupational health inspections.
Only authorised people within the occupational health service can see this data, and only those who need it to look after the employees concerned. It is processed under medical confidentiality.
Neither the employer nor line managers nor HR departments have access to it.
Once the data has been anonymised and aggregated into statistics, it also feeds into health reporting and prevention monitoring as part of the occupational health service's remit.
Employer data
This covers organisational company data, contact details and lists of the employees assigned to each organisation.
This information makes it possible to plan and manage activities efficiently.
Collective prevention data
Collective prevention data helps occupational health services produce objective health analyses for groups of employees who share similar sociodemographic characteristics.
That makes it possible to develop targeted prevention and risk management measures in the workplace and to act before problems arise.
Worth knowing
All data processing complies strictly with the applicable legal provisions, which makes the processing fully transparent and lawful.
Choosing a secure health data host
Health data security and compliance at padoa starts with the host: we chose Microsoft Azure as a certified hosting provider for health data. As padoa's processor, and because padoa is subject to the GDPR, Microsoft Azure is equally bound to comply with the GDPR. The provider's nationality therefore has no bearing on whether the GDPR applies.
Several factors were decisive:
Technical leadership
Microsoft Azure, the world's leading provider of cloud infrastructure services, meets the strictest requirements for health data security, which demonstrates a lasting commitment to a robust security architecture and proven best practice. Its global footprint means Azure can offer occupational health services across Europe a stable, transparent and high-performing service
Proven reliability and security
Microsoft Azure's hosting infrastructure offers demonstrable guarantees on availability, reliability and information security, backed by hundreds of certifications, including CIS, CSA STAR, SOC 1-3, ISO 20000-1, ISO 27001, ISO 22301, ISO 27017 and ISO 27018.
Data residency in France
The data is hosted in Azure's French data centres, which are recognised as certified health data hosts. That guarantees full compliance with European data protection rules and rules out any transfer outside the European Union. On availability, reliability and above all data security, no European provider currently matches the maturity of global leaders such as Microsoft Azure.
Microsoft Azure is therefore a secure, compliant solution for hosting health data that also meets the highest standards on the market.
Worth knowing
Concerns are raised regularly, particularly about the US Cloud Act, a law that allows US authorities to access data under certain conditions where the hosting provider's parent company is based in the United States. However:
These requests are tightly limited in law and may only be made as part of specific investigations into clearly identified US citizens or people resident in the US — they are not a general right of access.
On that basis, the European Commission again classified the United States as an "adequate country" under the GDPR in 2023.
Providers can refuse requests that conflict with national or European law.
Comparable court orders can also be issued by European authorities as part of national or international investigations.
So while national, European or indeed US judicial authorities can in principle request access to data, Azure does everything it can to handle such requests as restrictively and transparently as possible. Azure systematically rejects unlawful requests and notifies its users as soon as it is legally permitted to do so. The same applies to padoa should the company itself be the subject of such a request. On top of Azure's safeguards, padoa encrypts all stored data, which makes it extraordinarily difficult for third parties — foreign authorities included — to make any use of it, even if direct access were granted via the hosting provider.
A comprehensive security framework: health data security and compliance at padoa
The security we offer our clients, and the trust that goes with it, rests on two pillars that cannot be separated:
Data security inside the software
Security in our organisation and business processes
Inside the software
Data security inside the software is our top priority. We invest continuously in technology, processes and security architecture to keep the platform as well protected as possible. Our layered, proactive approach secures all data across four components: availability, integrity, confidentiality and traceability.
Platform availability
Software can only count as secure if it is available to its users at all times.
padoa is built for maximum availability. In 2024 we once again exceeded our contractual service levels, with an availability rate of 99.9997%.
This exceptional stability rests on several key factors:
High processing speed and automatic scaling : padoa handles more than 35 million requests a day. The systems are sized so that 95% of all operations complete in under 868 ms. If performance drops, additional servers are brought online automatically to spread the load and avoid bottlenecks.
Redundancy at every level : The platform runs on multiple servers spread across three independent data centres in France, each with its own power supply, network connection and cooling. Even if a server or a data centre fails, padoa can switch seamlessly to another site without interrupting users.
Continuous monitoring : Round-the-clock monitoring and automatic alerting keep the platform under permanent observation. A dedicated SRE team of 18 specialists ensures a fast response to faults and security-relevant events.
Rapid incident response : Our fault and incident response policy guarantees a quick, efficient reaction without compromising system security. Documented emergency and recovery procedures cover every scenario and make it possible to disable parts of the application immediately or to deploy security updates the same day.
Data integrity
Data must be neither lost nor currupted.
A robust backup strategy : Geo-redundant backups are taken over the course of each day. They are held in a data centre physically separate from the production site, to protect them from natural disasters and physical incidents. Recovery tests are run daily.
Business continuity : Various emergency and recovery scenarios (disaster recovery plans) are prepared and tested regularly, with clearly defined recovery times (RTO) and recovery points (RPO).
Confidentiality
Data must not be disclosed to anyone who is not authorised to see it.
Encryption : Data is encrypted both in transit and at rest. Cryptographic keys and secrets are managed under strictly defined policies.
Strict network security policies: Client data is protected by a controlled internet access policy at server level and by multi-tier firewalls.
Isolation: Client databases, applications and environments (production, test, development) are kept strictly separate to prevent incorrect access or accidental mixing of data.
Secure authentication: Access to the application requires two-factor authentication (2FA) and single sign-on (SSO).
Protection against vulnerabilities and malware: Automated vulnerability scans, regular penetration tests and integrated real-time virus protection defend the systems against potential attacks and malicious software.
Traceability
Data security requires a complete record of every change.
Fine-grained permissions management: padoa users have role-based access rights. By default, padoa employees have no access to occupational health services' data. Only where this is exceptionally necessary can certain specialist profiles be granted temporary read access, and every instance is logged in full. For example, padoa's client support team can access specific data in order to resolve support requests accurately.
Central logging: A central log system records all activity in the application. padoa also has standardised procedures for client requests relating to log data, and a bastion system makes administrative actions audit-proof.
Automatic deletion of confidential information: To protect privacy, log data is deleted automatically after 12 months.
Across our organisation and business processes
Inside padoa we apply strict internal information security policies.
Governance and responsibilities: An information security policy defines clear roles and responsibilities under the authority of the executive team and in coordination with the relevant authorities. It also ensures compliance with legal, regulatory, normative and contractual requirements.
Managing information assets and resources: We maintain an inventory of all information assets and an information classification policy, and we respect intellectual property rights. All resources sit in a protected environment with several classification levels, assigned according to content. Each level has its own rules for handling and transfer, limited to the relevant field of activity and operational need.
Worth knowing
Supporting the information lifecycle: this covers preventing data leaks, masking data where appropriate, permanent deletion and regular backups. As soon as a piece of information is created, it is graded under the information classification plan to establish how confidential it is. It is then circulated strictly on a need-to-know basis — only to people who genuinely require access. Information that is no longer needed is deleted.
Supplier management: Information security in our supplier relationships is closely monitored. An internal review process checks in several stages that every supplier meets defined security and compliance criteria before a contract is signed. Prior approval by the CISO and the DPO is mandatory before any contract is signed.
Audits: Independent bodies review our security practices at least once a year, including certification audits, internal audits and penetration tests.
People Management:
Candidates are selected and vetted carefully. All employees receive regular awareness training on information security and data protection, and confidentiality obligations continue beyond the end of employment.
Every employee is bound to strict confidentiality as part of their employment contract.
Physical and technical security: Our offices are physically secured, with access control, environmental safeguards and measures to protect confidential information: access control, protection against physical and environmental risks, a clean-desk rule, locked screens and secure storage of hardware. The same safeguards apply to the Azure data centres that host our systems. Decommissioned devices are destroyed under secure disposal and erasure procedures.
💡F.A.Q
Data processing
Does padoa misuse the data?
padoa processes personal data solely to enable occupational health services to carry out their prevention work. We do not use the data for our own purposes. We do not pass it on to third parties. We do not sell it.
External host
Why doesn't padoa host the data itself, given that it holds the relevant certification?
padoa took a deliberate strategic decision not to run the hosting itself. That lets us concentrate fully on what we do best as a software company, while storage and system operations are entrusted to a dedicated, highly specialised and carefully vetted hosting provider.
Confidentiality
How does padoa ensure data stays confidential?
padoa relies on strong encryption, secure hosting in France on certified Microsoft Azure servers, and strict access controls. Our ISO 27001 and ISO 27701 certifications evidence our commitment to the highest standards of information security and data protection.
Incident Management
How does padoa respond to security incidents or data breaches?
padoa has a comprehensive incident response plan for handling potential data breaches and IT security incidents quickly and in a controlled way, notifying affected parties immediately where necessary. The plan covers:
Reporting the incident through various channels (alerting systems, monitoring, padoa users, employees)
Classifying the event: distinguishing a confirmed security incident from a non-security event and assigning it to the responsible team
Analysing the status: where the incident is already known and under control, the corresponding standard process applies; where it is new and not under control, it is escalated to the executive team immediately
Technical investigation and root cause analysis by the Site Reliability Engineering (SRE) team
Communication, where necessary, to the whole SRE team, padoa employees and/or affected users
Resolution and closure by the responsible teams
Verification that systems are running correctly once the fix is in place
A post-mortem report, a defined and implemented action plan, and an update to the risk assessment
