Public roadmap

Continuous strengthening of technical and organisational controls, in line with what the institutional sector expects.

• Delivered: Public record of processing activities (Art. 30) and DPIA for high-risk processing
• Delivered: Hardened security headers (HSTS, strict CSP, COOP, CORP, Permissions-Policy)
• In progress: Formal procedures: backup, restore, secret rotation, breach handling
• In progress: Extended application auditability and pseudonymised logs
• Planned: Annual programme of independent audits and penetration tests

A public commitment to 99.5% availability, a stronger SLA under partner agreements, liveness and readiness probes exposed.

• Delivered: Public status page with real-time probes on every component
• Delivered: /api/health and /api/ready probes for routing and watchdogs
• Planned: Post-mortems published for any incident lasting over an hour on critical features
• Planned: A 99.9% target, negotiable under a structuring partnership agreement

Contractual stabilisation of the API: explicit versioning, a unified error format, up-to-date documentation.

• Delivered: Unified RFC 7807 error format (Problem Details) and public catalogue
• In progress: API documentation and backward-compatibility policy published
• Planned: Standardised federated auth and progressive session hardening
• In progress: Full export capability for portability and contractual reversibility

Moving towards RGAA 4.1 level AA, guided by a public multi-year plan.

• Delivered: Accessibility statement published and kept up to date
• Planned: Automated accessibility checks built into the software pipeline
• Planned: Certified external audit and published remediation plan

Getting ready for international competitions and non-French-speaking audiences, without lowering the quality of the French experience.

• Planned: i18n architecture in place and critical strings extracted
• Planned: Progressive coverage of the player, organiser and tournament referee journeys