THE REPORT AT A GLANCE
Four pillars
Key facts
- Data hosting
- European Union
- PUE · primary region
- ~1.09
- EcoVadis
- Assessment in progress
- ISO 27001
- Target Q1 2027
CSR & SUSTAINABILITY
Building trust, responsibly.
Our first CSR and sustainability report describes, honestly and without overstatement, where we stand today as a young company and the commitments we take on as we grow.
First edition · Reference year 2026
ABOUT THIS REPORT
An honest baseline, structured around four pillars.
This is Mindlapse’s first Corporate Social Responsibility (CSR) and sustainability report. It is structured around four pillars - Environment, Social & Human Rights, Ethics, and Responsible Procurement - reflecting the recognized sustainability assessment frameworks.
Mindlapse SAS is a French company, incorporated in January 2025 and headquartered in Paris (9 rue des Colonnes, 75002). We build an agentic Cyber-GRC (Governance, Risk & Compliance) platform for large European organizations. We hold Jeune Entreprise Innovante (JEI) status and the Bpifrance DeepTech label.
Responsibility for sustainability currently sits with the CEO, who oversees environmental, social and ethics matters. As we grow, we intend to formalize this governance further.
OUR APPROACH
Real impacts over symbolic commitments.
As a software company of {headcount} people, our direct environmental footprint is limited. Our most significant impacts are the energy efficiency and resource use of the cloud we operate on, the way we treat and develop our people, and the integrity and security with which we handle our clients’ data. Our approach focuses on these areas rather than on symbolic commitments we could not yet substantiate.
Our mission is itself aligned with positive societal impact: strengthening the digital trust and cyber resilience of European organizations, in a regulatory context shaped by NIS2 and DORA.
PILLAR 01 · ENVIRONMENT
A digital-first, low-footprint model.
Mindlapse owns no data centers and runs no manufacturing. Our team works remote-friendly, which limits commuting and office-related emissions. Our main environmental footprint is the cloud infrastructure that runs our platform.
-
European, efficient hosting
All data is hosted within the European Union on Google Cloud. Our primary region is europe-west1 (St. Ghislain, Belgium), one of the most efficient data centers in Google’s fleet, with a PUE (Power Usage Effectiveness) of approximately 1.09, powered by renewable energy and an on-site solar installation. Our secondary region is europe-west9 (Paris, France). Google matches 100% of its annual electricity consumption with renewable energy purchases.
-
Efficiency by design in our AI layer
AI compute is our main variable footprint, so we favor right-sized, EU-hosted models such as Mistral for in-platform processing, and apply engineering practices (caching, request optimization, selecting the model that fits each task) to keep compute proportionate to the value delivered. We also own the fact that we make intensive use of commercial LLMs for our internal needs, in particular building the platform: an environmental impact we are fully aware of and seek to keep in check.
Our commitments
- Measure our greenhouse-gas emissions (GHG Protocol, Scopes 1-3) and establish a baseline.
- Define a documented CO₂e reduction trajectory once the baseline is established.
- Formalize an environmental policy as the organization matures.
- Complete an EcoVadis assessment before the end of the year (process already initiated).
PILLAR 02 · SOCIAL & HUMAN RIGHTS
A French social framework.
Employment relationships are governed by French labor law and the SYNTEC collective agreement (IDCC 1486), which set robust standards for working conditions, working time and employee protection.
-
Our teams (September 2026)
The team numbers 16 people as of September 2026. Among them, 4 are apprentices or interns, a deliberate investment in training and youth employment relative to our size. Women represent 25% of the team. We recognize that female representation, structurally low in the cybersecurity sector, is an area we actively want to improve as we hire.
-
Working conditions & well-being
We operate as a remote-friendly organization (including full-remote positions) and have put in place a working-time agreement that favors work-life balance. Public transport coverage and meal vouchers apply to all employees.
-
Health & safety
We keep an up-to-date occupational risk assessment (Document Unique d’Évaluation des Risques Professionnels, DUERP) as required by French law, and apply the associated harassment-prevention obligations.
-
Diversity monitoring
In accordance with French law, we collect no data on employees’ ethnic origin; diversity monitoring is limited to lawful criteria such as gender.
Our commitments
- Formalize a written human rights policy referencing international standards (e.g. the UN Guiding Principles, ILO conventions).
- Introduce ESG and diversity awareness sessions for employees.
- Track social indicators (training hours, well-being) as the team grows.
PILLAR 03 · ETHICS
Governance documents in place.
Mindlapse has adopted an internal Code of Conduct and an Anti-Corruption Policy, setting clear expectations on integrity, conflicts of interest and lawful business conduct.
-
Security & privacy by design
Data protection is built into how we build. We host all customer data within the EU, act as a processor on behalf of our clients, and maintain a published privacy policy and a personal-data breach management procedure. An ISO 27001 certification program is underway (targeted for Q4 2026).
-
Data sovereignty
Our exclusively European hosting and our use of EU-hosted AI models reflect a deliberate commitment to European data sovereignty for our clients.
-
Business integrity
Mindlapse has been subject to no litigation related to social, ethics or environmental matters.
PILLAR 04 · RESPONSIBLE PROCUREMENT
An EU-first supply chain.
Our main sub-processors, first among them our cloud provider, operate within the European Union under GDPR-compliant data processing agreements (DPAs). We prioritize suppliers established in the EU to preserve data sovereignty and reduce the risk of transfers outside the EU.
Our commitments
- Formalize CSR expectations toward our suppliers as our supplier base grows.
- Extend our internal integrity and data-protection requirements to our supply chain.
OUTLOOK
The commitment roadmap.
Area
Commitment
Horizon
-
Governance
Publish this CSR report; formalize ESG steering
2026
-
Security
ISO 27001 certification
Q1 2027
-
Assessment
Complete the EcoVadis assessment (process already initiated)
2026
-
Environment
Measure GHG emissions (Scopes 1-3); define a CO₂e reduction trajectory
2026-2027
-
Environment
Formalize an environmental policy
2027
-
Social
Human rights policy; ESG awareness; social indicators
2027
-
Procurement
Formalize supplier CSR requirements
2027
Contact us.
Mindlapse SAS · 9 rue des Colonnes, 75002 Paris, France
This report reflects Mindlapse’s position for its 2026 reference year and will be updated as our practices and commitments evolve.