The Pichet PSR platform was a public-facing API receiving leads from partners across a dozen external real-estate portals - every lead carried personal data (name, email, phone, real-estate intent) governed by GDPR, and every mishandled credential potentially opened a path to lead diversion to a competitor. Protection could not be an add-on, it had to live in the initial design.

I enforced per-partner credential isolation through Microsoft APIM (unique API keys per portal, scope-bounded permissions, systematic rotation through the APIM lifecycle). For GDPR flows: HTTPS-only, no intermediate persistent storage of leads (the commercial CRM remains the only source of truth), gateway-level validation on payload format and size, immediate rejection of malformed requests. I ran a formal 2023 security audit that resulted in hardened access controls and updated firewall rules. In parallel, I tooled role-based isolation on internal credentials so each operator only saw the partners they owned.

2023 audit cleared without major non-conformity, partner trust maintained for 3 years, and zero security incident across the operation - which made it possible to gradually expand the partner perimeter without going through another internal evangelisation phase.

That project locked in a security review as a recurring cycle rather than a one-shot event. Today on every ACCENSEO engagement touching regulated data, I replay the same pattern: threat-model from the wireframe phase, role-based isolation in the design, external audit at least yearly. That is what makes it possible to defend SLA contracts in front of a critical customer without justifying everything wave after wave.

The ACCENSEO accounting SaaS handles the most sensitive data: Open Banking PSD2 banking data (3 providers wired in parallel), customer KYC, accounting entries subject to audit, 2026-2027 e-invoicing regulated by the French DGFiP. Before writing any feature, I ran a competitor security audit: it surfaced critical flaws at established players (IDOR allowing one to read another customer's data, KYC flaws on identity verification). I could not reproduce those mistakes.

I built security before the application code. IDOR + KYC threat model laid down on every feature touching customer data, 6-role access control (Admin, Collaborator, Consultant, Accountant, Accounting, Banking) wired through Better Auth with full MFA (email, TOTP, SMS) and dedicated accounting login tokens. On regulated flows, I plugged the EDI Teledec (DGFiP-licensed partner) for VAT / IS / CFE / DAS2 / PAS submissions, and integrated Open Banking PSD2 across 3 providers (GoCardless/Nordigen, Bridge, Qonto) with strict consent tracking. For e-invoicing, I built the DGFiP v3.1 pipeline as early as 2025, ahead of the 2026-2027 mandate. Every security decision was documented in versioned ADRs to survive future team growth.

Compliance baseline reached ahead of the 2026-2027 regulatory deadline, rollout-ready without an emergency security rewrite, and the platform commercialisable to French accountants and SMBs without depending on an external audit at every cycle.

On this project I understood that well-executed regulatory compliance becomes a product moat: competitors carrying IDOR or KYC flaws cannot attack my segment without rewriting entire sections. That is exactly the posture I want to push on the next CTO scale-up role in regulated industries - turn regulation into an entry barrier rather than into a chain.

On the Fleurance Nature refit in 2017, Magento Enterprise Edition 1.10 carried the company's PCI-DSS responsibility for online payment across 3 storefronts, 4 customer groups, 12 pricing matrices. With 60 custom modules and 1,040 modified PHP files, the risk of introducing a security regression at every release was permanent - and any card data leak would have cost the group its PCI compliance.

I enforced strict PCI-aware patterns on every custom module: no card data storage on the Magento side (full delegation to a certified payment gateway), systematic use of Observer / Strategy patterns to never touch the Magento core - which prevents the unintended introduction of a capture point - and a complete security regression suite before every release. On the OWASP Top 10 side, I framed XSS prevention on UGC contributions, multi-store session isolation, and strict input validation across every custom form.

Zero production security incident during the migration and across the 5 years of operation that followed, PCI compliance preserved throughout the process, and the Varnish cache stayed operational without introducing any authentication bypass.

On this project, I locked in security as a daily review rather than a yearly audit. That reflex is what lets me today negotiate IT contractual clauses (DPA, SCCs, SLA, reversibility) directly at ACCENSEO without going through external counsel on routine deals - because I know what I am signing.