You cannot ask for a prohibited document
This is not a warning, it is an absence: the field does not exist. A form that offered the category while displaying “careful, this is prohibited” would end up being used.
Tenancy agreements and documents
The files first. The names only if you ask.
Sorting on the name is the best-documented bias in French housing. Software cannot make it impossible — but it can stop inviting it. Pilot presents the documents, hides identities by default, and logs every time you reveal one.
Asking for a prohibited document exposes the landlord to a €3,000 fine.
The list of documents you may demand from an applicant is exhaustive: anything not on it is prohibited, and the prohibition carries an administrative fine. Yet many landlords ask, in good faith, for a free-form employer’s letter, a bank statement, a criminal record extract or a holding cheque — because nobody told them the list was closed. Pilot makes the unlawful request structurally impossible: the category does not exist in the form, and a document filed outside the list is refused, with the legal reason shown to the applicant. That is more effective than a reminder in an online help page, because there is nothing to read.
- One public link per property: the applicant submits without creating an account and without a cookie
- Documents limited to those the decree allows, the others refused with the reason
- Watermark applied on receipt; the original is never kept
- Anonymous comparison by default, identity reveal logged
- Documents viewable online, watermarked, each opening recorded with its reason
In practice.
You open a lettings campaign on a property
It produces a public link that you share wherever you like — a listing, a message, a notice. No account for the applicant to create, no cookie placed on their browser: the link alone carries access to their file.
The applicant files their documents, in the authorised categories
Identity, proof of address, proof of occupation, proof of income. Each category is the decree’s. A document filed under a category that does not exist — because it is prohibited — is refused, with the text that prohibits it.
The watermark is applied on receipt
Every document received is watermarked, and the unwatermarked original is not kept. An identity document circulating without a watermark is a document that can be used for something other than what it was supplied for.
You compare “Applicant A”, “Applicant B”
The comparison tool shows the documents and how complete they are, not the names. So you read files before you read identities — which is all that software can usefully do on this subject.
You read the documents without downloading them
Each document opens in a viewer, in its watermarked version, through a link that expires in five minutes. You state why you are opening it, and the opening is recorded in the log. A grid shows what is provided and verifiable in each application — a completeness grid, with no mark and no order between applicants.
Revealing an identity is an action, and it is logged
When you choose to find out who applicant B is, the action is recorded in a dated access log. That does not make discrimination impossible; it makes it conscious and traceable.
Unsuccessful applications are purged
Ninety days after the decision for an unsuccessful applicant, one year for the successful one. Deletion is automatic: keeping “just in case” the identity documents of people who never became your tenants is exactly what the regulations prohibit.
What it changes
Prohibited criteria have no column
Nationality, family situation, state of health, origin: none of this exists in the data model. A box you promise not to look at always ends up being looked at.
Anonymity by default also protects the landlord
A selection file showing that the documents were examined before the identities, with a dated log, is very different from a file claiming that there was no discrimination.
The applicant has no account to create
It is a detail that decides the rate of complete applications. An application process that requires signing up loses the most sought-after applicants — which often means the best files.
The law, and the pitfalls
The list of documents that may be demanded from a prospective tenant, or from their guarantor, is set exhaustively by decree. Demanding a document outside the list is prohibited.
art. 22-2 of Law No. 89-462 of 6 July 1989; Decree No. 2015-1437 of 5 November 2015
Exhaustively means that anything not listed is prohibited — including requests that seem reasonable, such as a bank statement or a certificate of no outstanding credit. The breach is punishable by an administrative fine of up to €3,000 for a natural person and €15,000 for a legal entity.
No one may be refused the letting of a home on discriminatory grounds; the burden of proof is adjusted in favour of the person who considers themselves discriminated against.
art. 1 of Law No. 2008-496 of 27 May 2008; art. 225-1 et seq. of the French Criminal Code
Faced with a substantiated allegation, it is for the landlord to show that their decision rests on objective elements. A selection that leaves no trace of method puts the landlord in the most uncomfortable position: they must prove reasoning they never documented.
The data subject has the right not to be subject to a decision based solely on automated processing which produces legal effects concerning them.
art. 22 of Regulation (EU) 2016/679 (GDPR)
So we produce no applicant score, and it is not a technical limitation: a figure that decided, even partly, the refusal of a home would fall squarely within this scope. The decision must remain yours, and it must be explainable other than by a number.
Personal data must be adequate, relevant and limited to what is necessary, and kept for a period proportionate to the purpose.
art. 5.1.c and 5.1.e of the GDPR
Keeping the files of unsuccessful applicants “for next time” is retention without a purpose. It is also a concrete risk: a stock of identity documents from people who are not tenants has no reason to exist at a private landlord’s.
What Pilot refuses to do
No score, no ranking, no shortlisting
We do not score applicants and we do not rank them. A displayed order is a recommendation, and a recommendation on a housing application must be explainable by something other than a calculation. The decision remains entire, and it remains yours.
art. 22 of the GDPR
No field for a prohibited criterion
No nationality, no family situation, no state of health. We did not create a box while promising not to read it: we did not create it at all.
art. 1 of Law No. 2008-496
No structured assessment of the applicant
The only assessment field is a free-text note. A structured field would invite sorting, and sorting would invite a criterion — which is precisely what we refuse to provide.
Availability
Included from the Essentiel tier.
- 7-day trial at launch, card required
- No commitment
Frequently asked questions
Does Pilot rank applicants for me?
No, and it is not a technical limitation. We produce no score, no ranking and no shortlist: the GDPR gives individuals the right not to be subject to a decision based on automated processing, and refusing someone a home is exactly that kind of decision. We show you the applications; you decide.
Which documents can I ask for?
Those in the decree of 5 November 2015, and nothing else: identity, address, occupation, income. The list is exhaustive, and asking for anything outside it exposes a private landlord to an administrative fine of €3,000. The form only offers the authorised categories.
Why hide the names?
Because showing the list of names on the first screen invites sorting on it before reading a single application. The comparison view shows “Applicant A”, “Applicant B” and their documents; revealing an identity is an explicit action, recorded in a dated log.
Can I see the documents in an application?
Yes, in a viewer, in the watermarked version and without download: the link expires in five minutes, and each opening is recorded in the log with its reason. The GDPR requires you to be able to say why you read a third party’s tax notice; the log lets you do so. The grid that accompanies the application says what is provided and verifiable — it does not mark the applicant.
Does the applicant have to create an account?
No. The link you share carries access to their application: no account, no password, no cookie. That is also what makes a good application reach the end of the submission.
What happens to an unsuccessful application?
It is purged automatically ninety days after the decision — one year for the successful applicant, now your tenant. Keeping identity documents belonging to people who will never be your tenants is retention without a purpose.
And the reliability score Pilot mentions elsewhere?
It concerns a tenant ALREADY IN PLACE and is calculated from their payment history, their length of tenancy and the completeness of their file. It is not an applicant selection tool, and it means nothing for a file that has no history with you yet.
Right next to it.
Tenancy agreements and documents
The tenancy agreement fills itself in from the file, not from a blank page.
Unfurnished, furnished, student, mobility, seasonal, flat-share, mixed-use, garage, commercial 3/6/9 and professional, pre-filled from the property’s data — one lease per unit in a building. You never start from a blank page.
Tenancy agreements and documents
Your documents, and the dates that make them expire.
Everything filed, searchable, exportable. Each document can carry an expiry date that feeds the alerts, and the tenant finds their tenancy agreement and diagnostics in their own space.
Tenancy agreements and documents
Check-out is compared with check-in, automatically.
Room by room, time-stamped photos. The check-out is compared automatically with the check-in, and the PDF is archived.
Content reviewed on 2026-10-07.
Get started
Add your first property.
At launch: a 7-day trial on your real properties, card required.