B2B security documentation

Security datasheet — Live event platform

Document version 1.1 · Last updated: October 2026

01Executive summary

The Nomacast live event platform (chat, moderated Q&A, polls, quiz, suggestion box, reactions, key quotes, video replay, analytics) is designed for corporate B2B use with high requirements on data sovereignty, named authentication and traceability.

Operational hosting	European Union (Cloudflare European zone for the D1 database nomacast-ue under contractual EU jurisdiction, EU regions for R2 and Stream)
Encryption in transit	TLS 1.3 on all traffic, managed by Cloudflare (automatic certificates)
Passwords	PBKDF2-SHA-256 with 100,000 iterations and a random per-user salt
IP addresses	HMAC-SHA-256 hashed, never stored in plaintext
Event data retention	90 days by default, configurable 30 to 365 days by the client organiser
Video replay retention	30 days by default, MP4 download provided for client archiving, extension on request
Authentication audit log	90 days (table auth_logs), CSV-exportable
GDPR role	Processor within the meaning of GDPR Article 4(8), DPA provided with the quote
Infrastructure certifications	Cloudflare: ISO 27001, ISO 27018, SOC 2 Type II, PCI DSS Level 1

02Vendor identification

03Scope covered by this datasheet

This datasheet covers all processing operations performed by the live event platform, namely:

• Participant pages: /i/<magic-token> (named invitees), /chat/<slug> (public access)
• Client administration pages: /event-admin/<slug> (login/password), /presenter/<HMAC> (full-screen presenter)
• API endpoints: /api/event-admin/*, /api/chat/*, /api/admin/*
• Video broadcast and replay: Cloudflare Stream (European region)
• Live screen sharing: dedicated nomacast-signaling Worker (Durable Object)

Out of scope: the nomacast.fr marketing site (see marketing site privacy policy) and on-site video capture tools (physical equipment operated by Jérôme Bouquillon).

04Hosting and data residency

All operational platform data is hosted in the European Union.

• Event database: Cloudflare D1 nomacast-ue, European Union jurisdiction contractually guaranteed by Cloudflare, hosted within Cloudflare's European zone.
• File storage (client logos, slide PDFs, shared documents, highlight reels): Cloudflare R2, buckets nomacast-slides, nomacast-documents, nomacast-highlights, all configured in European region.
• Live video broadcast and replay: Cloudflare Stream, European delivery infrastructure.
• Key-value storage (partner codes, anti-spam): Cloudflare Workers KV, EU instance.
• Edge computing (Pages Functions): execution on the Cloudflare datacenter closest to the visitor (in Europe for a visitor located in Europe). Persisted event data is stored exclusively in the EU-jurisdiction resources described above.

Any new Cloudflare resource created on behalf of a client is, by internal constraint, created in an explicit EU region (never in None jurisdiction). This rule is documented and systematically enforced.

05High-level technical architecture

• Front-end: vanilla HTML / CSS / JavaScript, no framework, served via Cloudflare Pages (global edge).
• Back-end: Cloudflare Pages Functions, V8 isolates runtime, no persistent server-side state.
• Relational database: Cloudflare D1 (distributed SQLite) under EU jurisdiction.
• Object storage: Cloudflare R2 (S3-compatible), EU region.
• Video: Cloudflare Stream (RTMPS ingest, HLS/DASH delivery, VOD replay).
• Real-time: dedicated Worker with Durable Objects for WebRTC signalling (screen sharing).
• No non-EU service is used for processing event data.

06Participant authentication

• Named unique link per invited participant: HMAC-SHA-256 signed magic token, 24-character base64url-safe length, bound to the event.
• No account creation, no password to remember on the participant side.
• Optional public mode: free access with shared event password (configurable by the client organiser).
• Session cookies: HttpOnly, Secure, SameSite=Lax flags, HMAC-signed, no identifying information in plaintext.
• Anti-bot filtering: Cloudflare Turnstile on sensitive forms, invisible honeypot field on the contact form.

07Client organiser authentication

• Login + password per client, stored as PBKDF2-SHA-256, 100,000 iterations, unique random salt per user (never in plaintext, never MD5/SHA-1).
• Rate limit: 5 login attempts per minute per IP address, anti-brute-force.
• Full audit log (table auth_logs): timestamp, hashed IP, event (login_success, login_failed), user-agent. Retention 90 days.
• Session cookie nomacast_session: HttpOnly, Secure, SameSite=Lax, HMAC-signed, configurable duration.
• HMAC client token for API endpoints: SHA-256 of the event slug + ADMIN_PASSWORD secret, base64url-safe, 24 characters. Secret rotation invalidates all tokens simultaneously.

08Nomacast administrator authentication

• HTTP Basic Authentication on /admin/* routes, credentials stored in Cloudflare Pages environment variables (ADMIN_USERNAME, ADMIN_PASSWORD).
• Strictly limited access to Jérôme Bouquillon (single administrator).
• Secret rotation on client request or after an incident, with no service interruption.
• No third-party access, no sharing of administrator credentials with sub-processors or external providers.

09Encryption

• In transit: TLS 1.3 on all traffic, certificates automatically managed and renewed by Cloudflare. Modern cipher policies (AES-256-GCM, ChaCha20-Poly1305), HSTS enabled.
• At rest: transparent encryption at the Cloudflare infrastructure level (D1, R2, Stream, KV).
• IP addresses: hashed using HMAC-SHA-256, never stored in plaintext (impossible to reconstruct the original IP).
• User passwords: PBKDF2 with 100,000 SHA-256 iterations, 16-byte unique random salt per account.
• HMAC tokens: SHA-256 with shared secret, base64url-safe for URL transport.

10Application security

• Content Security Policy (CSP) with per-request nonce, strict script source allowlist, anti-XSS.
• CSRF protection: Origin/Referer header validation, SameSite=Lax cookie, anti-CSRF tokens for sensitive actions.
• Anti-XSS: systematic escaping of user content via escapeHtml on the server side, strict input validation (length, type, regex).
• SQL injection protection: exclusive use of parameterised prepared statements (Cloudflare D1 API).
• Header injection protection: systematic sanitisation before sending Resend emails.
• Rate limit: 5 login attempts/min/IP, 30 chat messages/min/participant, 100 votes/min per poll.
• Anti-bot: Cloudflare Turnstile on the quote form and public registration pages.
• Non-indexable platform pages: meta robots: noindex, nofollow, noarchive on all participant pages to prevent public exposure.
• Event isolation: it is impossible to access another event's data with a given token (systematic slug/HMAC verification on every request).

11Moderation and content

• Manual moderation: dedicated interface for the moderator appointed by the client organiser, explicit validation before publication in moderated Q&A mode.
• Multi-layer automatic moderation: configurable forbidden word filtering, anti-flood (per-participant token bucket), anti-spam URL (regex + lookup table).
• Deletion / hiding: ability to hide or delete a message at any time from the moderation interface.
• Participant exclusion: ability to exclude a participant for the remainder of the event.
• Read-only mode: moderator announcements only, disabling participant contributions.

12GDPR: roles, purposes and legal bases

Roles:

• Data controller: the event's client organiser (GDPR Article 4(7)).
• Processor: Nomacast (GDPR Article 4(8)), governed by a Data Processing Agreement (DPA) attached to the quote.
• Sub-processors: Cloudflare Ireland Ltd. (Dublin), Gladia (Paris), Resend Inc. (USA), Google Ireland Ltd. (Dublin): details in section 14.

Purposes:

• Live animation of the event (display of messages, votes, reactions, presence) on behalf of the client organiser.
• Production of aggregated engagement and presence analytics (post-event reporting).
• Event replay during the retention period, when enabled.

Legal basis (defined by the client organiser as data controller):

• Performance of a contract or pre-contractual measures (GDPR Article 6.1.b) for events intended for clients/prospects.
• Legitimate interest (GDPR Article 6.1.f) for internal events, professional conferences, B2B events.
• Explicit consent (GDPR Article 6.1.a) for public events with open registration.

13Retention and automatic purge

Event data (chat, votes, presence, analytics)	90 days by default, configurable 30 to 365 days by the client organiser
Video replay	30 days by default from the end of the live, MP4 download provided, extension per additional 30-day period on request (€50 excl. VAT)
Authentication audit log (auth_logs)	90 days, CSV-exportable on request
Hashed IP addresses	Duration aligned with the associated action (message, vote), then jointly deleted
Contract and billing data	10 years (French accounting legal obligations)

Purge mechanism: a Cloudflare Workers cron job (purge-retention + purge-expired-replays) runs daily and automatically deletes data that has reached its expiry. Cascade deletion: deleting an event triggers deletion of all associated invitees, messages, responses and analytics.

14Technical sub-processors (GDPR sub-processors)

The complete sub-processor list is kept up to date and communicated to the client organiser in case of changes. Any addition of a new sub-processor is subject to prior notification with right of objection.

15Audit log and traceability

• auth_logs table: full authentication journal (login_success, login_failed, logout) with timestamp, hashed IP, event slug, user-agent.
• Retention: 90 days, then automatic purge.
• Export: available in CSV format on client request.
• Anomaly detection: anti-brute-force rate limit, internal alerting on repeated attempts.
• Admin action traceability: creation/modification/deletion timestamps maintained on all D1 entities.

16Backup, high availability and business continuity

• Cloudflare D1: automatic multi-zone replication, daily snapshots retained by Cloudflare, point-in-time recovery available.
• Cloudflare R2: 11 nines durability (99.999999999%), multi-AZ replication in European region.
• Cloudflare Stream: automatic multi-region EU replication, distributed CDN delivery.
• RPO (Recovery Point Objective): 24 hours (daily snapshot).
• RTO (Recovery Time Objective): 4 hours in case of major incident.
• Business continuity plan: automatic Cloudflare-level failover, client communication via alternative channel (phone, email) in case of prolonged interruption.

17Security incident notification

In case of a personal data breach within the meaning of GDPR Article 4(12):

• Notification to the client organiser (data controller): within 72 hours after becoming aware of the incident, in accordance with GDPR Article 33.
• Notification content: nature of the breach, categories and approximate number of data subjects concerned, likely consequences, measures taken or planned to remedy.
• Assistance to the data controller: Nomacast actively assists the client in any notification to the CNIL and information to the data subjects (GDPR Article 28.3.f).
• Detection: Cloudflare monitoring (logs, alerting), daily supervision by Jérôme Bouquillon.
• Escalation chain: email + SMS to Jérôme Bouquillon for critical incidents, client communication within 24h.

18Right to be forgotten and GDPR rights exercise

• Primary channel: with the client organiser (data controller), via the early erasure function available in the admin interface /event-admin/<slug>.
• Alternative channel: with Nomacast (processor) by email [email protected], forwarding to the data controller and assistance.
• Response time: maximum 30 days in accordance with GDPR Article 12.
• Effective deletion: immediate cascade of all associated data (messages, votes, presence, analytics, hashed IPs) across the entire infrastructure (D1, R2, Stream).
• Identity verification: may be requested in case of reasonable doubt, without exceeding the minimum necessary information.

19Sectoral compliance

Specific configurations are available on request for regulated sectors:

• Pharma and healthcare: personal data contact identified in documentation, dynamic watermark on replays, custom retention per event, extended audit log.
• Finance and banking: optional client-side encryption, extended moderator action traceability, SOC exports.
• Public sector and defence: contractual confirmation of EU jurisdiction hosting (Cloudflare), option of sovereign France storage via Scaleway on quote (exclusive fr-par region, strictly French jurisdiction).
• Other special cases (insurance, energy, telecoms, critical HR): contact us for a dedicated CISO/IT framing.

20Complementary documents available on request

• Data Processing Agreement (DPA): standard GDPR processor contract, attached to the quote.
• Copies of vendor certifications: Cloudflare ISO 27001, ISO 27018, SOC 2 Type II, etc.
• Detailed sub-processor list with addresses and DPO contacts.
• Incident management policy and detailed escalation procedure.
• Complete data processing map by processing operation and purpose.
• Security assurance plan for enterprise procurement processes.
• Audit log of a past event (anonymised example) on request.

For any complementary document request, contact [email protected] specifying your need and context (vendor evaluation, RFP, due diligence).

This datasheet is synchronised with the legal notice, the marketing site privacy policy and the live event platform privacy policy. In case of apparent inconsistency, these official documents prevail.