Building trust, responsibly.

As a software company of around a dozen people, our direct environmental footprint is limited, and our most material impacts are: the energy and resource efficiency of the cloud we run on, the way we treat and develop our people, and the integrity and security with which we handle our customers’ data. Our sustainability approach focuses on these areas rather than on symbolic commitments we could not yet substantiate.

Our mission is itself aligned with a positive societal outcome: strengthening the digital trust and cyber-resilience of European organisations, in a regulatory context shaped by NIS2 and DORA.

A digital-first, low-footprint model. Mindlapse owns no data centres and no manufacturing operations. Our team works in a remote-friendly setup, which limits commuting and office-related emissions. Our principal environmental footprint is the cloud infrastructure that runs our platform.

Efficient, EU-based hosting. All data is hosted within the European Union on Google Cloud. Our primary region is europe-west1 (St. Ghislain, Belgium), one of the most energy-efficient data centres in Google’s fleet, operating at a Power Usage Effectiveness (PUE) of approximately 1.09, powered by renewable energy and an on-site solar installation. Our secondary region is europe-west9 (Paris, France). Google matches 100% of its annual electricity consumption with renewable energy purchases.

Efficiency by design in our AI layer. Because AI compute is our main variable footprint, we favour right-sized, EU-hosted models such as Mistral for in-platform processing, and we apply engineering practices (caching, optimised requests, appropriate model selection per task) to keep compute proportionate to the value delivered. We are also transparent about using commercial LLMs intensively for our internal needs, in particular software development: this carries an environmental impact that we are conscious of and seek to manage.

A French social framework. Employment relationships are governed by French labour law and the SYNTEC collective agreement (IDCC 1486), which set robust standards for working conditions, working time and employee protection.

Our people (September 2026). The team comprises 12 confirmed members. Of these, 4 are apprentices or interns (3 work-study apprentices and 1 intern), a deliberate investment in training and youth employment relative to our size. Women represent 25% of the team. We recognise that female representation, structurally low across the cybersecurity sector, is an area we want to actively improve as we recruit.

Working conditions and well-being. We operate a remote-friendly organisation (including fully remote roles) and a working-time agreement designed to support work-life balance. Statutory public-transport reimbursement and meal benefits apply to all employees.

Health & safety. We maintain a Document Unique d’Évaluation des Risques Professionnels (DUERP) in accordance with French law, and apply the associated harassment-prevention obligations.

Diversity monitoring. In line with French law, we do not collect data on employees’ ethnicity; diversity monitoring is limited to lawful criteria such as gender.

Governance documents in place. Mindlapse has adopted an internal Code of Conduct and an Anti-corruption policy, setting clear expectations on integrity, conflicts of interest and lawful business conduct.

Security and privacy by design. Data protection is embedded in how we build. We host all customer data within the EU, act as a data processor on behalf of our customers, and maintain a published privacy policy and a personal-data-breach handling procedure. An ISO 27001 certification programme is in progress (targeted Q4 2026).

Data sovereignty. Our EU-only hosting and our use of EU-hosted AI models reflect a deliberate commitment to European data sovereignty for our customers.

Business integrity. Mindlapse has not been subject to any litigation related to social, ethical or environmental matters.

EU-first supply chain. Our key sub-processors, foremost our cloud provider, operate within the European Union and under GDPR-compliant Data Processing Agreements. We prioritise EU-based providers to preserve data sovereignty and reduce cross-border transfer risk.