Frequently asked questions

Yes. Chill fully respects the principle of Privacy by Design, as defined by the GDPR.

This means that the protection of personal data is taken into account from the moment the application is designed, and at every stage of its evolution. Our development teams systematically build security and confidentiality questions into every project from the outset.

Here are a few concrete examples of that approach:

• Chill offers fine-grained access rights management, with the option of restricting the visibility of data by centre or by department.
• Every new feature is reviewed for the access rights it requires, before it even goes into production.
• Development is based on Symfony, a well-established open source framework with robust security standards.
• The source code is open, which allows regular security audits and rapid improvements.

The password must contain at least 9 characters, including:

• an uppercase letter,
• a lowercase letter,
• a special character from: @#$%!,;:+"’-/{}\\~=µ()£].

All other characters are allowed as well. The complexity requirements can be increased if needed.

Two-factor authentication is available for organisations that have a SAMLv2 identity server.

During 2026 it will be rolled out generally and become mandatory through our own identity server.

Yes, file consultations are recorded in access logs and stored for one year. Work is underway to make this history available from the administration interface.

Detailed per-user action logging (“who did what” in the files) is not available yet, but can be the subject of specific development work.

Yes. From the administration interface, you can create profiles with custom rights, combining:

• Split by centre: a user only sees the service users of their own centre (e.g. “Centre Franche-Comté”).
• Split by department: a user only sees the service users linked to a specific field or department (e.g. a social worker specialising in socio-professional integration cannot see the interventions of their colleagues in the “parenting support” department).

The functional administrator configures access rights per action (create an interaction, edit a document, etc.) according to the profiles.

The software allows the collection of personal data relating to:

• the identity of the service user,
• the management of their budget,
• social support actions,
• the documents associated with that support.

This data is defined, collected and managed by our clients according to their own internal policies.

Champs-Libres only handles hosting, without accessing the data, with the following exceptions:

• the phone number used to send text messages
• the email addresses used to send emails, whether to users of the software or to third parties;

All other data processed by Champs-Libres is anonymised, pseudonymised, or not personal at all (e.g. number of emails sent, storage volume, number of active users, etc.).

Champs-Libres does not process the personal data of service users for any purpose other than secure storage on behalf of the client.

The data is used only for hosting management and invoicing.

As regards the personal data of service users, our clients are the sole data controllers. Champs-Libres does not access them.

As regards data related to hosting management:

• only the system administrators of Champs-Libres have access to it,
• they may produce statistics for invoicing purposes,
• this data is only shared with clients on request, in order to substantiate an invoice.

• Service user data: the retention period can be configured by each client. A dedicated module for configuring this period will be available during 2025.

• Phone numbers used for text messages: kept for one year after invoicing.

• The database is hosted on a private internal network, within the OVH infrastructure.

• Server access is limited to system administrators, and only through public/private key authentication.

• Champs-Libres applies an internal security policy that is mandatory for all staff.

• Encrypted backups are made at least three times a day and stored in a remote data centre.

This procedure has to be put in place by the client. Champs-Libres does not have access to service user data and is therefore not in a position to respond directly to their requests (right of access, rectification, etc.).

If a request is made (for example, obtaining the list of text messages sent to a number), the user should contact the client, who can then get in touch with us if needed. If the client does not respond, the user may contact us directly.

Yes.

An internal incident management procedure is in place. It requires us to:

• document every personal data breach,
• systematically notify the client concerned,
• inform the competent supervisory authority, where the situation requires it, in accordance with the applicable regulations.

Hiding: some fields can be hidden.

Adding: yes, see the next question.

Renaming: in some cases fields can be renamed. This is not available with our standard offer; additional maintenance costs have to be invoiced.

Yes, there are two options depending on your needs:

1. Adding custom fields

   Through the administration interface, you can configure additional fields in service user profiles (the term used by Chill).

   This method is quick and accessible, but these fields cannot be used for statistics or document generation.

2. Developing a dedicated module

   For more advanced needs (statistics, automatic document generation, business rules, etc.), a specific module can be developed, fully tailored to your activity.

   This option offers more possibilities but requires an investment in development and maintenance.

Draft: pathway awaiting validation.

Active caseload: validated pathway, currently being followed.

Outside the active caseload: no intervention for 6 months.

Pre-archived: no intervention for more than 2 years.

Closed: pathway completed.

Yes. In each pathway, you can add:

• support actions,
• the associated objectives and results.

These elements can be edited through the administration interface and exported for statistical purposes.

Yes. The software allows you:

• to record documents and link them to a service user or to their support pathway;
• to generate documents automatically (letters, forms, etc.) from the data held in the software.

Yes, but change management support is recommended to ensure a successful rollout. We offer:

• user training,
• or train-the-trainer sessions for internal trainers.

Yes. Users can communicate through:

• notifications available in several places in the software
• the events module, which allows shared events to be created ****(meetings, interventions, etc.).

Yes, that is possible. A technical analysis is needed to define:

• the types of data to be exchanged,
• the formats,
• the tools involved.

Yes. The software offers:

• more than 100 filters,
• more than 120 groupings.

Custom exports can be saved and shared to make collective use easier.

Yes:

• A minor version is released as soon as a new feature is ready.
• Fixes are published quickly after a bug is reported (generally within the week).
• These versions are then deployed automatically to hosted installations.

For large organisations: a ticket management tool is made available, plus a dedicated project manager.

For smaller organisations: an account manager is assigned, on a non-exclusive basis.

Support is available by email and telephone during office hours (9 a.m. to 5 p.m., Monday to Friday).