How your data is protected

This page describes the protections around the data your organisation keeps in Flowtly: where it is stored, how one organisation is kept apart from another, how it is encrypted, how it is backed up, and where to find the documents that cover personal data under the GDPR. It describes only measures that are in place.

Where your data is stored

Flowtly runs on Google Cloud. The application servers, the database, the files you upload and the short-term cache are all in one Google Cloud region in Belgium, inside the European Union.

When Flowtly reads the text of a document you upload, such as an invoice or a receipt, that reading is done by Google's AI service in the same region.

Each organisation is kept apart

Each organisation in Flowtly has a database of its own for its working data: its people, projects, clients, finances and documents. What has to work across organisations, such as user accounts, organisation memberships and sign-in records, is kept in a separate shared database.

Every request to Flowtly names the organisation it acts in. Before anything is read on your behalf, Flowtly checks that you are a member of that organisation. If you are not, the request is refused. A request that names no organisation reaches no organisation's working data at all: Flowtly refuses to open an organisation's database it has not been told to use, rather than falling back to a default one.

In-app notifications follow the same line. A notification meant for one person can be read only by that person, and one meant for an organisation only by people signed in to that organisation. Notices about Flowtly itself are shown to everyone.

Encryption

In transit. Flowtly is served only over HTTPS. A request that arrives over plain HTTP is redirected to HTTPS before anything is exchanged. Behind Flowtly, the connection between the application and its database is encrypted too, and the database accepts it only from a client presenting a trusted certificate.

At rest. The database, its backups and your uploaded files are stored on Google Cloud, which encrypts stored data by default.

The keys and passwords Flowtly's own services use are kept in a managed secret store, not in the application's code.

Files you upload

Uploaded files are kept in private storage. Public access is blocked at the storage level, so a file cannot be made publicly reachable by a link or a sharing setting, by mistake or otherwise.

The storage keeps earlier versions of a file. Replacing or deleting a file does not immediately destroy the version that was there before.

Backups

The database is backed up automatically every day, and the 30 most recent backups are kept. Alongside the daily backups, every change is recorded continuously, which allows the database to be restored to a chosen recent point in time, not only to the moment a backup was taken.

The database is also protected against deletion: it cannot be removed by a single command, by mistake, without that protection first being switched off deliberately.

Protection in front of Flowtly

Every request passes a web application firewall before it reaches Flowtly.

Automated probes are turned away. The scans that sweep the internet for vulnerable software never reach Flowtly.
Unusual traffic is watched by an adaptive denial-of-service defence.
Requests that change data are rate limited per address. An address that sends too many in a minute is refused, and one that keeps going is blocked for a while.

Repeated failed sign-ins are slowed down as well: after too many, Flowtly pauses further attempts for a while, as Signing in describes.

Flowtly never stores your password itself, only a one-way hash of it. On top of the password, an organisation can require multi-factor authentication for everyone, or have its members sign in through single sign-on with Google Workspace or Microsoft. Signing in and Multi-factor authentication cover both.

Who can see what inside your organisation

The protections above keep other organisations out. Inside your own organisation, access is decided by roles: what each person can see and change follows the roles an administrator gives them. Permissions explains how roles work.

Key actions are recorded. The audit trail shows who changed what and when, and each sign-in is recorded with the network it came from. By default Flowtly keeps only the network prefix of the address, not the full address; an administrator can change that under Settings → Security, as Security settings describes.

Your organisation may keep personal data in Flowtly, such as details of employees, candidates or clients. The terms under which Flowtly processes that data on your organisation's behalf are set out in documents published in full on flowtly.eu:

the Data processing agreement
the Technical and organisational measures that accompany it
the Privacy policy

The Security page on flowtly.eu gathers the same documents for a procurement or security review.

To have an account, or a whole organisation, deleted, see Delete your account and data.

Example use cases

Answering a client's security questionnaire: Use this page for where data is stored, how organisations are separated and how backups work, and attach the published data processing agreement and technical and organisational measures for the contractual terms.
Checking data residency for a GDPR assessment: Flowtly's database and the files you upload are stored in a Google Cloud region in Belgium, inside the European Union.
Reassuring a team about uploaded documents: Contracts, payslips and invoices uploaded to Flowtly sit in private storage that cannot be made public.
Explaining what a backup covers: The database is backed up daily with the last 30 backups kept, and can also be restored to a chosen recent point in time.
Tightening sign-in for the whole organisation: Require multi-factor authentication or single sign-on, so that a leaked password alone is not enough to get in.