Resilis
Resilis is an AI-assisted SaaS platform for operational resilience. It helps regulated organizations build business continuity and disaster recovery plans, keep them current, and run a live crisis cockpit. Access is B2B, by invitation after a signed contract.
What is Resilis?
Resilis is an AI-assisted SaaS platform for operational resilience, published by RESILIS, a French company based in Lyon. It covers the whole cycle around a disruption - before, during and after - in one place, rather than leaving continuity work scattered across documents and spreadsheets.
The English site frames the product in three movements. BUILD is about writing the plans, with a claim of doing it ten times faster. MAINTAIN is about keeping them alive as the organization changes. ACT is a real-time crisis cockpit, and Resilis insists that the platform runs separately from the systems it protects, so it stays available when the customer's own IT is down.
The French site details six modules that can be switched on independently, since you only activate the ones you need. Business continuity starts from a business impact analysis - criticality, maximum tolerable downtime, named owners - where the vendor claims three to four weeks of work compressed into three to four days. Resources holds one catalog of applications, sites, key people and suppliers, with a dependency graph and cascading impact analysis. IT recovery lines up the deadline the business requires against the IT target, flags the gaps, tracks the 3-2-1 backup rule and derives the rebuild order from that same graph. Crisis management defines the crisis teams - primary members, alternates, responsibilities - along with action cards and a single directory. Crisis mode stands up an operational team in two minutes, with notifications, video calls and a timeline and logbook inside a virtual crisis room.
Throughout, the AI proposes drafts - activities, scenarios, strategies, action cards - that the user reviews and validates. It is positioned as a decision-support assistant and never as the decision maker.
The frameworks cited are ISO 22301, ISO 27001 and ISO 22361 on the French side, DORA and NIS2 for the European Union, and SEC Reg S-P, the FFIEC IT Handbook, NCUA Part 749 and NYDFS Part 500 for the United States. Dedicated US pages address small and large advisers, community banks, and healthcare and life sciences, including health systems, health plans, pharmaceutical manufacturing and medical devices. Two named customer references appear on the French site: Cilena in cybersecurity and Braintale, a publisher of CE-marked medical software.
What it does
- Map critical activities, resources, sites, applications and third parties into a single inventory
- Produce business impact analyses, continuity plans, IT recovery plans and action cards, accelerated by AI drafting
- Run a real-time crisis mode: information feed, AI summaries, action tracking, stakeholders and a timestamped logbook
- Design and run crisis exercises and tabletops inside the tool, with a lessons-learned review afterwards
- Compare the recovery deadline the business requires against the IT target, resource by resource, and flag the gaps
- Export every document as a timestamped PDF carrying its change history and validation chain
- Follow automated sector regulatory watch and receive notifications when plans need updating
When to use Resilis / When not to
A quick filter to help you decide if Resilis is the right fit.
When to use Resilis
- Banks, credit unions and registered investment advisers that must show an examiner a live continuity program under SEC Reg S-P, the FFIEC IT Handbook, NCUA Part 749 or NYDFS Part 500
- Healthcare and life sciences organizations - health systems, health plans, medical device makers and pharmaceutical manufacturers - carrying continuity and quality obligations
- Small resilience teams where one person often wears compliance, operations and more, and needs AI-drafted starting points instead of a blank page
- Multi-entity groups spanning several sites, countries or subsidiaries, which need access rights differentiated by profile and by entity
- Consulting firms running continuity and crisis programs for their clients, for whom Resilis advertises a partner offer on its French site
When not to use Resilis
- Anyone hoping to sign up alone: the terms state that access is by invitation only and after contract execution, and accounts are created by Resilis
- Consumers and non-professional users - the terms restrict the service to professional, business clients
- Buyers who need a free plan or a free trial to evaluate before committing: neither exists, and the entry point is a sales demonstration
- Teams that must size a budget before speaking to a salesperson - no rate card, plan or range is published anywhere on the site
- Engineering teams looking for a documented API or a catalog of named third-party integrations to plug into their stack: none is published
How to use Resilis
A typical end-to-end flow, from setup to results.
- Ask for a session through the site: the English pages route a 20-minute review request to us@resilis.com, while the French pages open a Microsoft Bookings slot for a demonstration
- Expect the first US conversation to be held by an independent advisor who works alongside Resilis on its American expansion, not by the publisher itself
- Sign the contract: access is granted by invitation only and after contract execution, and accounts are created by Resilis
- Agree the usage scope in the special conditions - entities, users and modules - and set the contractual access levels: administrators, advanced users, read-only
- Sign in from a browser on any device; nothing is installed, and the application dashboard sits behind the login
- Start from what already exists rather than a blank page: import spreadsheets and documents with AI assistance, and review the import before it is integrated
- Describe the activity: map activities and sub-activities, assign owners, rate criticality and maximum tolerable downtime
- Build the scenarios, then define the continuity, IT recovery and action-card responses that answer them
- Set up crisis management: crisis teams, alternates, responsibilities and the single directory, then switch on crisis mode when it is needed
- Run AI-generated exercises, record the lessons learned, and export timestamped PDFs for the situations where cloud access is itself compromised
Pros & Cons
Pros
- Covers building, maintaining and activating in one modular tool, where many programs stop at the document; only the modules a customer's methodology needs are switched on
- Claimed time savings are substantial: a first continuity plan in days rather than weeks, and a business impact analysis cut from three or four weeks to three or four days
- The platform is designed to run separately from the IT it protects, and its timestamped PDF exports with a validation chain remain usable offline
- Hosting sits in France and the European Union with Scaleway, in Paris and Lille, and sovereignty is put forward explicitly rather than buried
- Service commitments are published and numbered: 99.5% monthly availability, under 2 seconds for 95% of requests, a Sunday maintenance window from 02:00 to 06:00 UTC and customer notification within 2 hours
- Unusual transparency on the supply chain: subcontractors listed by name with country, purpose and safeguards, a named and reachable DPO, and a DPA available on request
- Founders come from the field, with backgrounds at KPMG Special Situations, Médecins Sans Frontières and Société Générale
Cons
- No public pricing at all: no pricing page, no plans, no range, so the budget cannot be sized without a sales conversation
- No free plan and no free trial; access is by invitation and only after a contract has been signed
- The ISO 27001, HDS and PCI-DSS badges displayed on the site belong to the hosting infrastructure, not to Resilis, and SOC 2 is only planned for 2026; Resilis claims no certification of its own
- The site contradicts itself on whether client data may be used, after irreversible anonymization, to train AI agents: the legal notice allows it, the French FAQ answers that consent is always required
- The two locales do not cover the same ground: the Modules page exists only in French, the US sector pages only in English, so reading one locale is not seeing the whole product
- No named third-party integration and no documented API; the only mention is a conditional reference to technical interfaces when available, inside the reversibility clause
- A thin public footprint: no company LinkedIn page, only the founders' personal profiles, a blog that sits in the navigation without a single article, a very young company and no published fundraising
Pricing & Plans
Resilis publishes no price. There is no pricing page, no rate card and no indicative range anywhere on the site, in either locale, and there is neither a free plan nor a free trial. The terms state that the solution is provided on a subscription basis, that the commitment period is defined contractually and that renewal follows the contract, while the financial conditions are set in the special conditions. The usage scope - entities, users and modules - is likewise fixed in the special conditions or the purchase order. Since access is granted by invitation and after contract execution, the entry point is a commercial conversation rather than a checkout. Prospective buyers should therefore expect a negotiated business-to-business subscription quoted against their own scope, and should plan on contacting the vendor to obtain any figure at all.
Data, GDPR & hosting
A consolidated view of how Resilis handles your data.
GDPR overview
Implementation is concrete and documented rather than declarative. RESILIS, a French SAS at 12 Rue de la Part Dieu, 69003 Lyon, is named as controller for its own processing and acts as processor for client data. A data protection officer is formally appointed and reachable: Hugues Lajoie, h.lajoie@resilis.com. The privacy policy lists access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and names the CNIL as supervisory authority. Transfers outside the EU are framed by Standard Contractual Clauses with an impact assessment; the US subcontractors are OpenAI, Sentry and Google Analytics. A record of processing activities is maintained and assessments are run for high-risk processing. A Data Processing Agreement is provided on request or incorporated into the contract. No Article 27 representative is named, and none is required for a publisher established in France.
Who owns the data?
The terms are explicit: the client remains the sole owner of all data they input into the solution, and the material produced through the platform - analyses, plans, scenarios, generated content - remains the property of the client. RESILIS keeps the intellectual property in the Solution itself and grants a non-exclusive, non-transferable license limited to the term of the contract. Under the GDPR, Resilis acts as processor and the client as controller. One reservation sits in the legal notice: RESILIS may use client-generated data, after irreversible anonymization, for statistics, product improvement, AI agent training and content production. At contract end, exports, technical interfaces when available and assistance are promised.
Reuse rights
Because the client owns both the data entered and the content produced in the platform, that material can be reused inside the organization without asking Resilis for permission: continuity plans, impact analyses, scenarios and action cards can be exported as timestamped PDFs and used offline. On the publisher's side, the stated purposes are service delivery, account management and authentication, support, improvement, legal obligations, fraud prevention and service communication, on the legal bases of contract performance, consent for analytics cookies, legitimate interest and legal obligation. Resilis states that it never sells personal data to third parties, and that no special-category data under Article 9 of the GDPR is collected. Its AI subcontractor OpenAI is used in Business API Mode - no training on your data, retention limited to 30 days. One question is genuinely unsettled: the legal notice, in both locales, allows RESILIS to use client data after irreversible anonymization to train AI agents; the French FAQ answers that this never happens without your consent; the terms mention only anonymized and aggregated data for continuous improvement. The three documents do not say the same thing, and the point is worth settling in writing.
Data retention & training
Hosting summary
The legal notice names the host: Scaleway SAS, a French company headquartered in Paris. The data centers used are in France - Paris and Lille - and the Security page describes secure cloud infrastructure hosted in the European Union. Backups are stored on secure infrastructure in the EU and replicated across several European data centers. The privacy policy states that personal data is primarily hosted in the European Union and that some subcontractors may be located outside the EU, particularly in the United States: OpenAI, Sentry and Google Analytics. Transfers outside the EU are framed by Standard Contractual Clauses together with an impact assessment. Data is encrypted in transit, with HTTPS, TLS and HSTS, and at rest with AES-256, under strict multi-tenant isolation. The site's own address resolves on a Scaleway network in Paris. One caution: the certifications quoted for this infrastructure belong to Scaleway, not to Resilis.
Things to keep in mind
Risks and trade-offs to weigh before adopting Resilis.
- The ISO 27001, HDS and PCI-DSS badges describe the hosting infrastructure, not Resilis: the Security page says that our hosting infrastructure holds the following certifications. On the English homepage the same badges appear under an independent-audit heading, which reads as a certification of the publisher. SOC 2 is announced as planned for 2026, so it is not held.
- The site's own pages disagree about those hosting certifications: the Security page lists ISO 27001, HDS and PCI-DSS, while the Subcontractors page lists ISO 27001, HDS and ANSSI for the same Scaleway.
- The legal notice allows RESILIS to use client data, after irreversible anonymization, to train AI agents, while the French FAQ answers that this never happens without your consent and the terms mention only anonymized and aggregated data. Settle this in writing before uploading anything sensitive.
- No price is published anywhere, so the budget cannot be estimated without a sales contact - and on the US side the first commercial contact is an independent advisor who works alongside Resilis on its US expansion, not Resilis itself.
- The legal notice writes the identification number as a SIRET while showing nine digits, which is a SIREN rather than a SIRET; the spelling is reproduced here exactly as the site publishes it.
- The availability commitment is 99.5% per month, which tolerates roughly three and a half hours of downtime a month for a tool meant to be used precisely when everything else is failing; the offline PDF exports are the fallback to plan for.
- The AI drafts activities, scenarios and action cards, and the deepest human risk is treating those drafts as finished plans. The terms position the AI as decision support, not as a decision maker: a continuity plan nobody has challenged is a document, not a capability.
Setup & Integrations
Technical difficulty
Low on the technical side, real on the business side. Nothing is installed: the platform runs in a browser, accounts are created by Resilis, and no API or technical integration has to be wired up. The effort sits in the data - mapping activities, resources, sites, applications and third parties. Existing spreadsheets and documents can be imported with AI assistance and reviewed before integration, so nobody starts from a blank page. The tool is presented as usable by a non-specialist, with approved consultants available to help.
Deployment
Supported languages
Behind Resilis
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
Is there a free trial or a free plan?
How long does it take to put a first continuity plan in place?
Is Resilis itself certified ISO 27001, HDS or PCI-DSS?
Where is the data hosted?
Will my data be used to train AI models?
Is there a mobile app?
Do I need to be a continuity specialist to use it?
Can several entities, sites or countries be handled in one account?
Is a Data Processing Agreement available?
Can crisis work be documented and traced?
Should you pick Resilis?
Resilis addresses a narrow, well-defined problem: end-to-end operational resilience for regulated organizations that must show an examiner, an auditor or a board that their continuity work is current rather than filed. On that point the product is coherent. Building the plans, keeping them alive and running the crisis itself sit in one platform, the AI drafts rather than decides, and the tool is designed to run separately from the systems it protects. The two markets are served differently: France through ISO 22301 and the vocabulary of the French practice, the United States through Reg S-P, the FFIEC IT Handbook, NCUA Part 749 and NYDFS Part 500, with a dedicated page per segment.
Maturity is the caveat. The company is young, the blog sits in the navigation without a single article, no customer numbers are published, and the only named references - Cilena and Braintale - appear on the French site alone. The two locales do not cover the same ground, so a reader of one is not seeing the whole product.
Two points deserve care before signing. First, pricing opacity is total: no rate card, no range, no free tier, so a budget cannot be estimated without a sales conversation - and on the US side that first conversation is held by an independent advisor working alongside Resilis, not by the publisher. Second, the certifications displayed prominently belong to the hosting infrastructure, not to Resilis, and SOC 2 is announced as planned rather than held. Add the disagreement between the legal notice, the terms and the FAQ over whether client data may train AI agents after anonymization, and you have a short list of questions worth putting in writing before committing.
- Choosing a selection results in a full page refresh.
- Opens in a new window.