What we know about your listeners: nothing.

• NONo cookie placed on your listeners' browsers.
• NONo IP address retained, neither in clear nor in reduced form.
• NONo listener identifier generated, no browser fingerprint.
• NONo listening profile, no tracking of a person from one article to the next.
• NONo resale or sharing of data with an advertising third party.

Practical consequence: the player does not need to appear in your consent banner, since it places nothing.

• Their listening position

  So a returning listener picks up where they stopped. One second, tied to the article identifier, written in their browser and never sent.

• Their accessibility settings

  Text size, dyslexia-friendly typeface, reinforced contrast, playback speed. These are their preferences, they belong to them, and sending them to us would serve no purpose other than creating the data we refuse to hold.

• Nothing, but one minute of memory at our end

  The IP address is written nowhere. It serves for one minute, in volatile memory, as the key to the rate limit that stops someone inflating a play counter. After that nothing remains of it, and it never touched the database.

Through the WordPress plugin, the API or feed discovery. This is the only moment when content belonging to you leaves your premises.

Your site never needs to be reachable from outside: everything starts from your end. A staging site or an intranet therefore works with no firewall exception.

Two distinct steps, and it is that separation that makes charter mode possible: a layer of French rules decides how the text is SAID, then a synthesis engine says it.

The choice of engine is yours and is made in the client area, with the trade-off stated plainly: the premium engine gives the most natural result, the sovereign engine keeps more of the processing in Europe.

The player is a one-line script on your page. It is the most sensitive step, since it happens at your listeners' end and under your responsibility.

The registration-wall counter lives in the listener's browser and is never transmitted to us. It is less precise than an ordinary advertising wall, and that is a deliberate choice.

Aggregated counts, with no individual dimension. The consequence is that they cannot be cross-referenced to find a person, including by us.

It is also why we cannot supply a named report or an audience cross-reference, even if a customer asks. That refusal is not a policy: it is an impossibility.

The WordPress plugin exchanges a code valid for two minutes for its own key, server to server. You never see the key, so nobody can mislay it in an email or a chat thread.

Each site has its own, tied to it. Revoking one site does not affect the others, which lets you clean up a staging environment without interrupting production.

From the client area, at any time, without going through support. Keys are stored hashed: we cannot read them back to you, only replace them.

Owner, administrator, member. A sub-editor does not need access to billing, and the refusal is enforced server-side, not merely hidden on screen.

Encrypted transport everywhere, data encrypted at rest, secrets held separately from the application code.

A deleted account takes its texts, its audio and its counts with it. There is no courtesy copy kept somewhere in case you come back.

No formal information-security management certification. If your procurement department requires it as an entry condition, we will not pass the grid, and saying so now saves you three weeks.

In the meantime: We answer a security questionnaire in writing, in as much detail as needed, and we accept the corresponding contractual clauses.

Storage is European, and so is text preparation. Speech synthesis is the missing link, and while it is missing the chain is not European end to end.

In the meantime: The product itself refuses to announce the tier as available: the option stays greyed out in the client area until the link is European, and it is the code that decides, not a page.

We log our own administrative actions on accounts, but you cannot review your sign-ins or your teams' actions from the client area. On an account shared by a newsroom, that is a real gap.

In the meantime: Roles already limit what each person can do, and a revoked key is revoked within the second. If you need to trace a specific action, write to us: we can find it, it is simply not self-service.

Neither a bounty for vulnerability research nor a page dedicated to coordinated disclosure.

In the meantime: Write to us directly: security reports jump the queue, and we publicly credit the people who raise them.

The online subscription carries no availability commitment backed by penalties. Nor do we publish an uptime figure, lacking an external probe with history to measure it.

In the meantime: A service commitment is negotiated in a quoted contract. In the meantime, the Status page says what is actually probed, how often, and gives the dated register of past incidents.

This option was announced on this site and it does not exist: the product can only serve files from our European storage. The mention was removed on 5 August 2026 from the three places it lived.

In the meantime: If your architecture requires it, let us talk before you sign rather than after: we will tell you what is feasible and on what horizon, without rounding.