DORA contextual menu: how feature flags transform our application

Optimising the customer experience: integrating feature flags with GrowthBook

Since 2024, our Product strategy has been firmly focused on closer collaboration with our customers. By listening to their needs and incorporating their feedback, we have introduced innovations that are transforming the user experience. One of the recent pillars of this approach is the implementation of feature flags, a revolutionary tool that allows us to test, enable or disable features in a targeted and secure way. Here is a look back at this ambitious project, which culminated in the integration of GrowthBook into our application.

How the project unfolded: adopting feature flags

The idea of implementing a feature flags system took shape at the start of 2024. Initially, we had considered developing our own custom-built solution, starting from scratch. However, after several iterations, and because of the technical and operational complexity, this project could not be completed.

We then explored open-source alternatives and identified GrowthBook as an ideal candidate. This powerful, modular and self-hosted tool matched our requirements for flexibility and security perfectly. Our development teams worked closely with the Product and Security teams to guarantee an integration that meets the standards for performance, data protection and an optimal user experience. This synergy made it possible to deploy a robust solution, aligned with our users’ needs, while respecting regulatory and technical constraints.

What are feature flags?

Feature flags are software mechanisms that make it possible to enable or disable features on the fly, without requiring a full deployment. In other words, they offer unrivalled flexibility for testing new features, gathering user feedback in real conditions and carrying out progressive or limited rollouts.

One of the strengths of our implementation is the ability to activate these feature flags according to several specific criteria:

• The domain name: makes it possible to make activations conditional on a particular environment, whether it is on a dedicated or a shared server.
• The user: enables features for specific users, making it easier to test internally or with restricted groups.
• An ecosystem: defines a set of organisations belonging to the same group (for example: the partners or subcontractors of a key customer).
• An organisation: enables features for specific entities, such as subsidiaries, subcontractors or operational divisions.

Thanks to this granularity, we can personalise the user experience and limit the risks during rollouts.

GrowthBook: a powerful, technical tool

To meet our requirements for robustness and flexibility, we chose GrowthBook, an open-source solution that our technical teams have integrated directly into our servers, guaranteeing that data never leaves our servers.

GrowthBook is based on a real-time evaluation engine. When a user interacts with the application, the tool determines in a few milliseconds whether a specific feature should be enabled for that user, based on defined rules such as the domain name, the user or the ecosystem. This architecture ensures precise and dynamic management of features, while maintaining optimal performance.

In addition, GrowthBook offers a complete REST API that makes it possible to interact with the application programmatically. A REST API is a standardised interface that allows different applications to communicate with each other via HTTP requests. In practical terms, a REST API makes it possible to send data (for example, enabling or disabling a feature) or to retrieve information (such as the results of experiments or the status of feature flags) using simple formats such as JSON. This makes it easier to integrate GrowthBook with other internal systems or applications.

The GrowthBook API uses personal access tokens or secret keys to connect a specific environment to the GrowthBook application. These tokens make it possible to guarantee secure communication between the environment and GrowthBook, while ensuring that only authorised entities can interact with the features and the data. The API’s responses, encoded in JSON, are easy to interpret and can be used directly in a variety of application environments.

By hosting GrowthBook on our own servers and using its robust API, we ensure a seamless and secure integration, while offering greater flexibility to meet the specific needs of our users.

Security and reliability: a pillar of our integration

Security was an absolute priority in this project. Here are the measures taken to guarantee an integration that is reliable and compliant with our standards:

• Secure hosting: GrowthBook is deployed on our internal network, which guarantees full control over the data and compliance with regulations such as GDPR.
• Audits and traceability: every feature flag decision is recorded, making it possible to trace who enabled or disabled a feature and why.
• Source code under control: by using an open-source solution, we are able to view, audit and adapt GrowthBook’s code to meet our specific needs, without depending on a third party.

Concrete application: the DORA contextual menu

The first major use case for this integration was compliance with the DORA regulation (which entered into application on 17 January 2025). Thanks to feature flags, we were able to develop a contextual menu that allows our customers to check which modules of our application help them comply with the 5 pillars of DORA:

1. ICT risk management.
2. ICT incident management.
3. Resilience testing.
4. Third-party risk management.
5. Information and intelligence sharing.

This feature, which can be activated on request, allows a gradual adoption of the application by users whose ecosystem is affected by this regulation.

Conclusion: a step towards a more agile product

The integration of feature flags with GrowthBook marks a key step in our continuous improvement approach. By getting closer to our customers’ real needs, while guaranteeing security and performance, we are taking a further step towards more agile and proactive compliance and cybersecurity management.

Stay tuned to discover the next steps in our Product transformation!