Trust Center

Enterprise-Grade Security & Compliance

We prioritize the protection of your data with industry-leading security practices, transparent compliance standards, and rigorous operational controls. Built for teams that demand trust at every layer.

Compliance & Certifications

We maintain strict adherence to global data protection regulations and industry security standards.

● Certified

SOC 2 Type II

Annually audited by independent third parties covering security, availability, processing integrity, confidentiality, and privacy.

● Certified

ISO 27001:2022

Internationally recognized information security management system standard governing our security controls and risk management.

● Compliant

GDPR

Full compliance with EU General Data Protection Regulation. Data processing agreements (DPA) available upon request.

● Compliant

CCPA / CPRA

Designed to protect California consumer privacy rights, including opt-out mechanisms and data deletion workflows.

● Compliant

HIPAA Ready

Enterprise customers can execute Business Associate Agreements (BAAs) and enable PHI-safe configurations.

● In Progress

FISMA / FedRAMP

Actively pursuing federal authorization for government and public sector deployments. ETA Q4 2025.

\n

Security Architecture

Defence-in-depth approach across infrastructure, application, and data layers.

🔐

Data Encryption

All sensitive data is encrypted in transit and at rest using industry-standard protocols.

  • TLS 1.3+ for all API & web traffic
  • AES-256 encryption at rest
  • Customer-managed encryption keys (CMEK)
  • Automatic key rotation every 90 days
🛡️

Access & Identity

Granular controls ensure only authorized personnel and systems can access your data.

  • Role-Based Access Control (RBAC)
  • Multi-Factor Authentication (MFA)
  • SSO via SAML 2.0 & OIDC
  • Comprehensive audit logging
☁️

Infrastructure Security

Hosted on AWS & GCP with hardened configurations and continuous vulnerability scanning.

  • WAF & DDoS mitigation (Cloudflare/AWS Shield)
  • Isolated VPCs with private subnets
  • Automated patching & CIS benchmarks
  • 24/7 SOC monitoring & alerting

Data Processing & Controls

Transparent policies governing how your content and metadata are stored, processed, and managed.

Control Area Implementation Verification
Data Residency Regional deployment options (US, EU, APAC). Data never leaves selected region. Audit Verified
Data Retention Configurable retention policies. Automatic purging of inactive content & logs. Customer Managed
Subprocessors Strict vetting process. Full list available in Trust Center. Opt-out for non-essential vendors. Quarterly Review
Data Export / Deletion One-click export (JSON/CSV). Immediate logical deletion; physical wipe within 30 days. GDPR/CCPA Ready
Backup & Recovery Automated daily backups with 30-day retention. Point-in-time recovery capabilities. Biannual DR Test

Incident Response & Monitoring

Proactive threat detection and structured response protocols to minimize impact and maintain trust.

1. Detection & Alerting

Continuous monitoring via SIEM, EDR, and network traffic analysis. Automated anomaly detection triggers immediate alerts to our SOC team.

2. Triage & Classification

Incidents are categorized by severity (P1–P4). Critical threats are escalated within 15 minutes with dedicated incident commander assignment.

3. Containment & Eradication

Immediate isolation of affected systems, credential rotation, and threat removal. Root cause analysis begins simultaneously.

4. Recovery & Communication

Verified system restoration, post-incident review, and transparent customer notification within 72 hours for material impacts.

Trust Center & Documentation

Access official reports, policies, and technical documentation for security teams.

Security Questions?

Our Trust & Security team is available to answer technical inquiries, assist with compliance documentation, or discuss custom security configurations.

📧 security@flowcms.io
🔑 PGP Public Key
📞 Enterprise Sales