TranscribIA and the NIS2 Directive.
Directive (EU) 2022/2555, known as “NIS2”, strengthens cybersecurity obligations for essential and important entities — including public administrations and local authorities. TranscribIA, a French audio transcription solution, is designed for organisations that need to incorporate their tools into formal risk management. This page describes, without overstating claims, how its verifiable technical measures can support your compliance work.
European framework
The NIS2 Directive at a glance
NIS2 refers to Directive (EU) 2022/2555 of 14 December 2022, which repeals the original NIS Directive (EU) 2016/1148 and expands its scope. It aims for a high common level of cybersecurity across the Union and imposes stronger obligations on certain entities: risk management, technical and organisational security measures, incident reporting, accountability of management bodies and supply chain security.
Like all European directives, NIS2 is transposed into national law by each Member State. In France, affected entities are designated and governed by national transposition legislation; thresholds and designation procedures fall within that national framework. TranscribIA therefore does not state exact thresholds and invites each organisation to verify its status with the competent national authority.
Security requirements for covered entities address the following themes: risk management policy, incident handling and business continuity, network and system security, cryptography, access control and authentication, cyber hygiene, skills and awareness, and supply chain security.
Public entities
Public administration, local authorities and public bodies
NIS2 significantly broadens public-sector coverage compared with NIS1. Entities inpublic administration are explicitly covered: the European framework includes central administrations and, subject to risk assessment, regional administrations. Member States may also include local administrations. Each entity's scope and classification must be checked under applicable national law with the competent authority. These entities must implement appropriate and risk-proportionate measures, establish management accountability and report significant incidents according to a precise timetable.
For a local authority or public body, choosing an audio transcription tool therefore means being able to demonstrate security measures, traceability and control over processed data — including statements by elected members, staff or service users. TranscribIA specifically addresses this use case: sovereign, isolated and auditable processing of sensitive recordings.
Technical measures
Verifiable controls aligned with NIS2 requirements
Purchasing software alone does not establish an organisation's NIS2 compliance. Some suppliers may themselves fall within the Directive's scope; this page does not constitute NIS2 product certification. The controls below are presented as technical measures that may support your organisation's compliance, under your responsibility and within your own risk assessment.
Sovereign hosting & on-premise
Governance, sovereignty and supply chain
- SaaS hosted in France (French and EU jurisdiction)
- On-premise option in your infrastructure, no outbound data
- No transfers outside the EU by default
- Configurable AI engines (European cloud or local models)
Data encryption
Cryptography, in transit and at rest
- TLS 1.2+ required, HTTPS throughout (in transit)
- Encryption at rest: NVMe disk and PostgreSQL database
- Backups encrypted with age (X25519 + ChaCha20-Poly1305)
- Protected application secrets (AES-256-CBC)
Strong authentication & access control
Multi-factor authentication and least privilege
- RFC 6238-compliant TOTP 2FA, configurable role-based enrolment
- 5-level RBAC (principle of least privilege)
- Password re-authentication for destructive actions
- Rate limiting, strict CORS and CSP policy
Logging, audit & monitoring
Traceability and event detection
- Per-organisation activity_logs + platform audit_logs
- Traceability of all sensitive actions, CSV/JSON exports
- Active 24/7 monitoring (queue, disk, certificates, dependencies)
- Slack/email alerts and daily digest
Incident management & notification
Incident handling and reporting obligations
- Detection: ClamAV on uploads, monitoring and audit trail
- Documented notification process (early warning, notification, final report)
- Pre-restore snapshots (overwrite-protection safety net)
- Incident assessment, containment and documentation
Resilience, disaster recovery & hygiene
Business continuity, isolation and updates
- Daily encrypted EU off-site backups (90d / 30d retention)
- RPO 24h / RTO 4h targets, validated DR drill, granular restoration
- Multi-tenant isolation: 1 PostgreSQL schema per organisation
- Regular updates to components, dependencies and signatures
Two deployment modes
Choose the mode suited to your NIS2 policy
Sovereign SaaS (France)
For local authorities and public bodies seeking a managed, sovereign service that is ready to use quickly.
- Hosting in France, operated by AMBASSADIA SARL
- Security measures implemented and monitored by the publisher
- Immediate commissioning, DPA and compliance documentation ready
- Suitable for organisations without a full-time dedicated security team
On-premise (your infrastructure)
For entities whose internal policy prohibits SaaS or requires entirely in-house operations.
- Standalone Docker deployment, no outbound data
- Full control of inventory and controls by the entity
- The entity's security officer manages hardening, logs and backups
- Suitable for classified environments or stringent security requirements
Whatever the mode, NIS2 obligations remain with the entity. In on-premise, operational responsibility for security measures (hardening, monitoring, backups, updates) rests with your organisation; in sovereign SaaS, the publisher operates these controls and documents them for your audits.
Documentation & contact
For your IT directors, security officers and public procurement teams
The full compliance pack — processing register, DPA template, security measures, retention policy, subprocessors, architecture diagrams — is publicly accessible without an account. Our team supports your organisation's NIS2 assessment.
Publisher: AMBASSADIA SARL (Monaco). Compliance contact: contact@transcribia.eu.