Hosting
Where your data lives
“Hosted in France” is a phrase you read everywhere. Here is what it covers in this case: the country, the law that applies, and the documents you can produce yourself to show anyone who asks for them.
The country
The machines that run App and the database holding your records are in France. They are not all in the same place: the service and its database live in one data centre, their standby copy and the backups in a second one, in France as well. That is what stops a fire, an outage or a flood in one place from carrying everything away.
The messages sent on your behalf — emails, text messages — and the documents it files away go through providers based in the same country.
The law that applies
European regulation, directly
The data is hosted and processed in the European Union: the GDPR applies with no legal scaffolding, no fallback clause, no country in between.
A regulator you can go to
The CNIL has jurisdiction. If something looks wrong to you, there is someone to write to, in French, and they are not on the other side of the world.
Nothing leaves the Union
The processing contract puts it in black and white: the data does not travel to a country outside the Union. If a future provider were to require it, it would appear on the annexed list before being connected.
Every provider named
The list of parties involved — hosting, mail, storage, the theory-test operator the school has chosen — is written out with, for each one, its country and its role. It holds technical providers and nothing else.
What you can show an inspector
A page on a website proves nothing: we are the ones who write it. A document you produce from your own account does.
Your record of processing activities, as a PDF
The manager downloads it from their settings. It carries your name, your SIREN, your approval number, and for each activity: the purpose, the legal basis, the recipients, the retention period, the processors and the hosting country. It is the document Article 30 of the Regulation asks for.
The retention periods screen
The whole policy, and a count of what has passed its term on your side. The Regulation does not only ask you to keep to the periods: it asks you to be able to demonstrate that you do.
The other answer: on your own premises
If even France is not enough — a local authority, a public tender, an internal requirement — say so when the study is done: the assignment is then carried out under the conditions your own framework imposes, and that is written into the contract before anything starts.
And this site
The site you are reading is hosted in France too, with a host that has made commitments on the energy its data centres consume. The detail is on the eco-design page.
What follows on
You know where it is. What is left to know is what becomes of it the day you decide to leave.