Legal notices

IMMG 2259-SD — Plateforme Pilier 2 GloBE

Publisher Art. 6 LCEN

Twisted Wires
Individual business — French registration pending
Registered office: France
Website: https://twistedwires.io
Contact: contact@twistedwires.io

Publication director: Mathieu Renard

Hosting Data in France

OVH SAS
2 rue Kellermann — 59100 Roubaix, France
Phone: +33 9 72 10 10 07
https://www.ovhcloud.com

Servers located in OVH datacenters in Roubaix (RBX) and/or Gravelines (GRA), metropolitan France. Data subject to French and European law (GDPR).

Backup infrastructure: dedicated OVH server with AES-256 disk encryption (LUKS2), SSH-key access only.

Personal data GDPR Art. 13

Data controller: Twisted Wires (see contact details above).

Data collected and purposes:

User account (email, bcrypt-hashed password) — authentication, platform access.
Audit logs (SHA-256 hashed identifier, event type, timestamp) — regulatory traceability, security.
Uploaded file data (processed in memory, not permanently stored) — conversion service delivery.
Mapping events (anonymised, column headers SHA-256 hashed) — mapping suggestion improvement.

Legal basis: contract performance (Art. 6(1)(b) GDPR) and legitimate interests (Art. 6(1)(f)) for security.

Retention: audit logs retained for 90 days (configurable). Account data retained for the duration of the business relationship.

Your rights: access, rectification, erasure (Art. 17), portability (Art. 20), objection (Art. 21). Requests: rgpd@twistedwires.io

Complaints: CNIL (French Data Protection Authority) — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

Security ANSSI / OWASP

Transport encryption: TLS 1.2+ (Let's Encrypt)
HTTP security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options
Web Application Firewall: ModSecurity with OWASP Core Rule Set (CRS)
Database: AES-128 encryption (Fernet) per tenant, HKDF-SHA256 derived key
Passwords: bcrypt hashing (cost 12)
Authentication: JWT httpOnly cookie, configurable TTL (default 8h)
Account lockout: 5 failures → 15-minute block

Intellectual property

All source code, mapping algorithms, interfaces and content on this platform are the exclusive property of Twisted Wires, protected by French copyright law (CPI) and international conventions.

GloBE rules, DGFiP forms and OECD publications are official documents subject to their own terms of use.

Cookies

This site uses only functional cookies:

access_token — JWT authentication token (httpOnly, session)
lang — language preference (1 year)
session — Authlib SSO session (session)

No third-party advertising or analytics tracking cookies are used.

Limitation of liability

IMMG 2259-SD is a tool to assist in preparing GloBE returns. Outputs must be reviewed by a qualified professional before submission to tax authorities. Twisted Wires cannot be held liable for filing errors resulting from incorrect use of the platform or erroneous source data.

As GloBE regulations (Pillar Two) continue to evolve (OECD guidance, national transpositions), users are responsible for verifying that outputs comply with the rules in force at the time of filing.