Impact & Public sector
Ageing systems that are expensive to maintain, constrained budgets, and some of the most sensitive data there is. We industrialise migration to sovereign cloud, accessibility and impact measurement, with mutual insurers, charities, social economy groups and public sector bodies.
Doing more with the means you have.
Three subjects come up in every conversation with a public body or a non-profit organisation. They drive everything else: what is expensive to maintain, what must not leak, and what has to be accounted for.
Getting out of a system you can no longer change
Recovering the business rules buried in the existing estate, restating them as testable specifications, then migrating domain by domain. A single-shot replacement passes neither the budget nor service continuity.
Protecting data that does not forgive
Health data, social data, data about minors: the risk analysis and the accreditation file are not paperwork, they are the only documents that hold on the day of an inspection or an incident.
Accounting for real impact
Indicators anchored in your mission rather than in the data that is easy to extract. A funder is no longer satisfied by a beneficiary count: they ask what changed for those people.
Client cases
A few projects run with mutual insurers, charities and social economy groups.
Solutions
Legacy system modernisation
(01)Ageing applications that are expensive to maintain, and changes that take months for minor adjustments.
Recovering the business rules buried in the code, restating them as testable specifications, then migrating domain by domain with no service interruption.
Security and data protection
(02)Health, social and minors' data, and a compliance file rarely up to date when it is actually needed.
Risk analysis using the EBIOS Risk Manager method, an accreditation file kept current, and qualified hosting where sensitivity requires it.
Sharing across entities
(03)The same building blocks developed several times across entities, and software purchases that repeat.
A documented, governed common foundation, with reusable components and a shared service centre across entities.
Digital accessibility
(04)An accessibility obligation for public services, and vulnerable users who cannot reach online services.
Accessibility checks built into the delivery chain, complemented by manual audits, because a share of the criteria cannot be tested automatically.
Impact measurement
(05)Impact that is hard to measure, and funders now asking for something other than a beneficiary count.
Indicators anchored in your mission, fed automatically, and dashboards open to your funders and supervisory bodies.
Sovereignty and cost
(06)Sovereignty requirements on sensitive data, and hosting costs that are hard to justify to a board.
Migration to European sovereign cloud, open source preferred where licensing funds nothing useful, and open models operated inside your perimeter.
Compliance & standards
GDPR
Sensitive social economy / public data
RGAA
Digital accessibility
NIS2
Public essential sector
CSRD
Sustainability reporting, large organisations
AI Act
Public sector AI use cases
Digital inclusion law
Digital public service
CNIL compliance
MR-004, MR-006, public sector
SecNumCloud
ANSSI-qualified hosting
Stack & partners
Mistral AI
European sovereign LLM
Sovereign cloud
OVHcloud · Scaleway
Open source prioritised
Drupal · Django · NestJS
Frontend
React · Next.js · Liferay
Data & analytics
PostgreSQL · MongoDB · Snowflake
Compliance
EBIOS RM · ISO 27005 · RGAA
Let's talk about your Impact & public sector roadmap
An hour to test your modernisation, data protection and impact measurement challenges against what we have already put into production.
Frequently asked questions
By starting with what costs the most today rather than what demonstrates best. Three levers recur: sharing a component across entities instead of building it several times, preferring open source where licensing funds nothing useful, and delivering domain by domain so every stage can be stopped. We respond to public tenders and work under framework agreements. One candid point: a modernisation does not fund itself from savings in the first year, and claiming otherwise simply defers the difficulty.
Through automated checks built into the delivery chain, complemented by manual audits. That combination is not a precaution: a significant share of the criteria in the French accessibility framework cannot be verified automatically, because they concern meaning, journey coherence and the relevance of alternatives. A site that passes every automated check can still be unusable with a screen reader. The accessibility statement and the multi-year plan remain obligations of your organisation; we prepare them with you.
On European sovereign cloud, or on an offering qualified by the French cybersecurity agency where sensitivity requires it. AI use cases rely on open models operated in that same perimeter, which avoids sending social or health data to an external service. No data leaves the European Union without an explicit processing agreement, and the architecture is designed taking extraterritorial laws into account rather than ignoring them.
It depends on the state of the existing estate, and we would rather say so than publish a savings percentage that supposedly holds for everyone. What can be measured honestly is the maintenance cost of one domain before and after migration, the time to deliver a change of comparable size, and the number of components reused across entities. All three can be read from the first migrated domain onwards, which lets you stop or continue on figures rather than on a projection made at the outset.
By starting from your theory of change rather than from the data that is easy to extract. A beneficiary count is an activity indicator, not an impact one: what funders ask for today is what changed for those people, and over what period. We then automate collection of the chosen indicators and make them legible in dashboards open to your supervisory bodies. Existing frameworks, social return on investment or indicator catalogues, provide a common language with your funders rather than a substitute for that definition work.
Mutual insurers, charities, social economy groups, territorial civil service training bodies and foundations. Three projects are presented on this page: securing the information system of the French Mutuality Federation with an EBIOS Risk Manager analysis, building the information system of the ZUPDECO charity, and the cloud-native migration of Groupe UP. Other references exist but remain covered by confidentiality agreements.



