Security & Trust
Security & Trust at Flowtly
Flowtly runs on Google Cloud in europe-west1. Every customer gets an isolated database schema, and data is encrypted in transit and at rest. This page lists the measures in place and the documents that describe them.
Talk to our security teamISO 27001 practices
Risk management, policies and controls aligned to ISO 27001 practices; not audited.
SOC 2 criteria
Controls aligned to the SOC 2 Trust Services Criteria; not audited.
No AI training on your data
Customer data is never used to train internal or third-party AI models.
Encryption by default
TLS on every connection, and data at rest encrypted with Google Cloud’s default encryption.
Secure cloud infrastructure
Flowtly inherits the resilience of Google Cloud while adding tenant isolation.
Google Cloud-based architecture
Flowtly runs on Google Cloud: Cloud Run, Cloud SQL and Secret Manager in europe-west1. The data centres and managed services it uses are ISO 27001 and SOC 2 certified, and CloudFront delivers static assets.
CloudFront for static assets
AWS CloudFront delivers static assets only over TLS. Your workspace data is hosted on Google Cloud in europe-west1, Belgium.
Isolated database schemas per tenant
Every customer receives a logically isolated database schema to prevent data overlap or accidental access.
Encryption & data protection
Encryption, secret management, and backups are automated.
Encryption in transit & at rest
Connections to the platform and between its components use TLS. The application reaches the database only with a trusted client certificate. Data at rest in Google Cloud is encrypted with the provider’s default encryption.
Secrets & key management
Credentials and API tokens are stored in Secret Manager-backed vaults with fine-grained access controls.
Resilient backups
Automated, encrypted backups run daily alongside point-in-time recovery, and the 30 most recent are kept. Restoring from backup is tested every quarter.
Privacy & compliance
We operate with privacy by design and provide the legal safeguards modern teams require.
GDPR-aligned
Data access, correction, deletion, and portability workflows are available for every EU-based customer.
Data Processing Agreements
DPAs define responsibilities and joint incident handling. A breach is notified without undue delay, and no later than 48 hours after it is identified.
ISO 27001 practices
Security measures structured around ISO 27001 practices; not audited. The technical and organisational measures list what is actually in place.
SOC 2 criteria
Operational controls aligned to the SOC 2 Trust Services Criteria; not audited.
Data access & retention
You remain the sole owner of your workspace data, and retention is tightly controlled.
Deletion or return when you leave
When your subscription ends, you choose: we delete your data, or return it in a common electronic format and then delete it. We do this within 30 days of your instruction. Backups holding it are overwritten in the normal backup rotation and never restored to production.
You own your data
Flowtly never sells or monetises customer data. Inside your workspace, only the people you authorise can see it.
Least-privilege access for Flowtly staff
Infrastructure access is limited to authorised Flowtly personnel bound by confidentiality, on a least-privilege basis. For help inside the app, you add a Flowtly employee to your workspace and choose their permissions.
Application-level security
Built-in controls keep identities, roles, and activity trails fully governed.
SSO, MFA and fingerprint sign-in
Single sign-on through Microsoft Entra ID, which you can require for the email domains you have verified. Single sign-on through Google Workspace and just-in-time provisioning are planned. Today, a switch adds people who already hold a Flowtly account on their first Microsoft sign-in, and nobody else. Multi-factor authentication with an authenticator app, recovery codes and an email fallback, and fingerprint sign-in in the mobile app.
Role-based access controls
Assign granular permissions per module, team, or integration to follow the principle of least privilege.
Audit trails & monitoring
All key actions are logged so administrators can review logins, changes, and deletions in context.
Questions from procurement
What buyers ask most often before they sign, answered from our published documents.
Where your data lives
Workspace data is hosted on Google Cloud in europe-west1, Belgium. Some sub-processors work outside the EEA, for error monitoring, transactional email and the AI features. The sub-processor list names each one and where it processes data.
API access and its terms
A personal access token acts with its owner’s permissions. It lasts 365 days unless you choose otherwise, and you can revoke it at any time. Write requests are rate-limited per organisation, and there is no separate sandbox. Read the API guide.
How systems connect
For a system-to-system description, the API publishes an OpenAPI 3.1 document at api.flowtly.eu/docs.json. AI tools connect through the MCP server at mcp.flowtly.eu. Polish bank data arrives through Kontomatik.
Moving your data in
Clients, contracts, invoice history and bank statements load in bulk, each checked by a dry run before anything is written. What loads and what you set up by hand.
Security & compliance
Role-based access at module and data level
Each permission belongs to a module, and permission groups bundle them by role, with per-person exceptions on top. Viewer and manager roles separate reading from changing, and sensitive data has its own role: agreement pay terms, for example, need the agreements manager role.
Encrypted in transit (TLS) and at rest (Google Cloud default encryption)
Connections to Flowtly Workspace and between its components are secured with TLS, and the application reaches its database only with a trusted client certificate. Data at rest on Google Cloud is encrypted with the provider’s default encryption.
A full audit trail
A verifiable record of who changed what, from rates to invoices to agreements, ready for compliance reviews and diligence.
Tenant-isolated data architecture and daily backups
Each organisation’s working data sits in a database of its own, not one shared with other organisations, and access is scoped to that organisation. The database is backed up automatically every day, with the 30 most recent backups kept and point-in-time recovery alongside.
Single sign-on through Microsoft Entra ID
Members whose email is on one of your verified domains sign in with their work Microsoft account. Require it, and password sign-in is refused on those domains. Colleagues who already have a Flowtly account can join on their first Microsoft sign-in, if you allow it.
Multi-factor sign-in you can require for everyone
A six-digit code from an authenticator app on top of the password, with ten single-use recovery codes, trusted devices for 30 days and an optional email fallback. Require it organisation-wide and anyone not yet set up is guided through setup at sign-in.
Documents for procurement
Every document on this list exists today and is linked. For a security review of your own, ask the security team: they answer it from these documents.
Technical and organisational measures
The measures we actually implement to protect your data, dated and versioned. It also states plainly that Flowtly holds no ISO/IEC 27001 certification or SOC 2 attestation.
Data processing agreement
Our GDPR Article 28 agreement: roles, breach notification and how sub-processors are engaged.
Privacy policy
Which personal data we process, why, who receives it, and every recorded revision.
Terms and conditions
The terms that govern the Flowtly platform, with their revision history.
Legal notice
Company name, registered office, who represents the company, and the KRS, VAT ID and REGON numbers.
Sub-processors
Every company that processes personal data on our behalf. Each entry gives its role, its location and the date it was added, with a dated change log.
Vulnerability disclosure policy
How to report a security vulnerability to the security team, and what we ask of you while we fix it.
Service levels
99.5% monthly availability on every plan, what is not counted, and the first response within 8 business hours on Enterprise.
National Court Register extract
Anyone can download an extract for KRS 0001188143 from the Polish Ministry of Justice’s register portal.
Service status and incident history
Automated checks of the monitored components, 90 days of history and incident records on status.flowtly.eu.
What happens to my company’s data if I cancel my subscription?
Can I count on support during system implementation?
Can Flowtly employees see my data?
Can the hosting company access my data?
I am afraid of my data going through AI — do I have alternatives?
See how we handle your data
Our technical and organisational measures and our data processing agreement are published in full. The security team can walk you through either, or answer what they do not cover.
Talk to the security teamSecurity team: security@flowtly.eu