ISO 27001 program
Risk management, policies, and controls aligned to ISO 27001.
Secure cloud infrastructure
Flowtly inherits the resilience of AWS while adding tenant isolation and global performance safeguards.
AWS-based architecture
The entire platform runs on Amazon Web Services using ISO 27001 and SOC 2 certified data centers and managed services.
CloudFront CDN & DDoS protection
AWS CloudFront delivers content securely worldwide, enforces TLS, and mitigates DDoS attacks at the edge.
Isolated databases per tenant
Every customer receives a logically isolated Amazon RDS database to prevent data overlap or accidental access.
Encryption & data protection
Encryption, secret management, and backups are automated so your data stays protected end to end.
Encryption in transit & at rest
HTTPS with TLS 1.2+ secures all traffic, while AES-256 encrypts databases, file storage, and snapshots.
Secrets & key management
Credentials and API tokens are stored in AWS KMS-backed vaults with automatic rotation and fine-grained access controls.
Resilient backups
Automated, encrypted backups run daily and are tested for rapid restoration and disaster recovery readiness.
Privacy & compliance
We operate with privacy by design and provide the legal safeguards modern teams require.
GDPR aligned
Data access, correction, deletion, and portability workflows are available for every EU-based customer.
Data Processing Agreements
DPAs define responsibilities, breach notification timelines, and transparency for joint incident handling.
ISO 27001 safeguards
Security program structured around ISO 27001 controls and recurring risk assessments.
SOC 2 Type II readiness
Operational controls monitored against SOC 2 Trust Services Criteria with evidence collection.
Data access & retention
You remain the sole owner of your workspace data, and retention is tightly controlled.
Zero data retention after exit
Once a subscription ends, data is scheduled for deletion after a short grace period—no lingering backups.
You own your data
Flowtly never sells or monetizes customer data. Only authorized admins can access it.
Minimal access by Flowtly staff
Support access is restricted to vetted engineers under least-privilege with full activity logs.
Application-level security
Built-in controls keep identities, roles, and activity trails fully governed.
SSO & two-factor authentication
Integrate with standard SSO providers and enforce 2FA to reduce credential-based risks.
Role-based access controls
Assign granular permissions per module, team, or integration to follow the principle of least privilege.
Audit trails & monitoring
All key actions are logged so administrators can review logins, changes, and deletions in context.
