Open standard export
Your data follows you
Entries, journals, workflows and audit trail are exportable in open formats. You leave with your data assets intact.
Execution that'sreadable,traceable,enforceable.
Every important action leaves a cryptographic proof: who delegated, which agent acted, which tool was authorized, which result needs review. Verifiable from your browser.
Proof, not trust
Proof standards expected in statutory audit, tax control, M&A due diligence. Mathematically verifiable, no vendor dependency.
Cryptographic audit chain
Every action produces a SHA-256 fingerprint chained to the previous one. Post-hoc modification impossible without breaking the chain. Mathematically verifiable.
End-to-end 4-IDs correlation
Every operation carries 4 identifiers (run, workflow, executor, scope). Traceability from action back to its human origin, legally enforceable.
Browser-verifiable Activity Replay
Activity timeline with hash chain verification from your browser. Without trusting us, by mathematical computation.
Seven detailed guarantees
Highest standards in security and compliance. Every operation auditable, every AI decision supervised.
No training on your data
Your data is never used to train or improve AI models. Inference on dedicated European servers. No retention on the provider side (zero data retention).
Human in the Loop
Every critical decision validated by a finance expert. AI augments human judgment, it never replaces it.
Strict data isolation
Fully separated environment per firm. Database-level isolation enforced. Architecture validated by security audit.
Bank-grade encryption
Persistent encryption at rest and in transit. Keys in European sovereign vault, quarterly rotation.
EU hosting
Hetzner VPS Germany, Scaleway storage France. Sovereign actors only. No US service in the critical data path.
Complete audit trail
Every action, every entry, every AI decision traced. Reliable audit trail compliance guaranteed. Proofs exportable in one click.
Per-license business RBAC
Firm without statutory audit license doesn't see Due Diligence tools. Automatic capability filtering based on declared professional licenses.
Complete European data path
Exclusively sovereign EU technical stack. No US service in the critical path.
Hetzner Germany
Portal VPS + accounting database. Falkenstein region, Saxony.
Scaleway France
Object storage, documents, exports. Paris region.
EU subprocessors only
European DPA for all subprocessors. Mistral La Plateforme available as sovereign option for LLM inference.
Sovereign finance, not outsourced.
Most AI-powered finance platforms rely on infrastructure and models whose architecture was not designed for the French regulatory framework. 3AP is built in France, hosted in the EU and indexed on French doctrine. Your data and decisions never leave the regulatory perimeter that governs you.
3AP — sovereign FR/EU
The layer designed for the French framework
- Hosted by Hetzner (Germany) and Scaleway (France) — no US service in the critical path.
- French doctrine indexed: PCG, CGI, BOFiP, NEP CSOEC, BOSS, Légifrance.
- DGFiP compliant, reliable audit trail, GDPR by design.
- Answers are sourced in doctrine, never invented.
- Data is never transmitted in clear; Human in the Loop is systematic.
Non-EU AI finance tools
Today's market standard
- Infrastructure and models are often hosted outside the EU, with possible extraterritorial exposure.
- Doctrine is generally English-language and rarely adapted to the French accounting framework.
- DGFiP compliance is not native and generally has to be rebuilt by the firm.
- Risk of answers that cannot be sourced and are difficult to rely on during an audit.
- Traceability varies; human control is not systematically guaranteed.
Category comparison without naming vendors · sources: public DGFiP references and GDPR charter.
Regulatory compliance
| SOC 2 Type II | In preparation |
| ISO 27001 | In preparation |
| GDPR | Compliant |
| EU AI Act §5.b | In preparation |
| Reliable audit trail | DGFiP compliant |
Your data never transits in clear to LLMs
Systematic anonymization before transmission. GDPR Article 6.1.a explicit opt-in consent.
Anonymized payload
Only structural elements needed (sector, revenue range, headcount, answers, scores) are transmitted. No names, email, company name in clear.
GDPR explicit opt-in
Mandatory opt-in consent, unchecked by default. Legal basis GDPR Article 6.1.a. Deletion on request.
You stay because it works, not because you are captive.
Reversibility is not a hidden FAQ clause: it is a visible commitment. Your data, workflows and audit trail can be exported at any time in open standard formats. No proprietary lock-in, no vendor lock-in.
No proprietary lock-in
No closed format
No dependence on an exclusive format. Your systems remain yours: 3AP operates on top of them without locking them in.
Contractual reversibility
Your departure is planned from the start
Portability is built in from the outset: a documented exit procedure, full return of data and assured continuity.
- CSV
- FEC
- JSON
- Open API
- Factur-X
- Exportable audit trail
The questions we're asked about security.
How can I verify an action hasn't been modified after the fact?
Every action produces a SHA-256 fingerprint chained to the previous one. You verify the chain integrity from your browser, by mathematical computation. Post-hoc modification = chain broken, immediately detected.
How do you guarantee GDPR compliance?
Strict EU hosting, systematic LLM request anonymization, explicit opt-in consent, right to erasure on request. European DPA for all subprocessors.
What is your exact sovereign EU stack?
Hetzner VPS Germany + Scaleway storage France + Anthropic Sonnet 4.6 (Mistral La Plateforme alternative available). No US service in the critical path.
Where are you on SOC 2 and ISO 27001 certifications?
SOC 2 Type II and ISO 27001 in preparation, independent security audit ongoing. GDPR compliant, reliable audit trail DGFiP compliant.