Trust Centre

Security and privacy
at Floww.

Floww maintains an information security management system certified to ISO/IEC 27001:2022 and is an approved supplier on the UK Government's G-Cloud 15 framework. Client data is encrypted in transit and at rest and protected by layered technical and organisational controls.

Contact us Privacy policy
Security

A layered approach to information security.

Floww's platform is hosted on Microsoft Azure and protected by controls at the network edge, within the application, across our devices and in our backup and recovery arrangements.

Hosting

The platform is hosted on Microsoft Azure in the North Europe region (Ireland), with West Europe (Netherlands) designated as the recovery region.

Encryption

All connections to Floww use TLS 1.2 or higher. Internal service-to-service traffic is protected by mutual TLS, and data at rest is encrypted using AES-256.

Network protection

All web traffic passes through a web application firewall at the network edge, which blocks malicious traffic before it reaches Floww's infrastructure. Staff access is routed through a zero-trust private access network.

Access control and segregation

Each client's data is logically segregated from that of other clients. Permissions within each account restrict users to the information they are entitled to see.

Secure development

All code changes are scanned for vulnerabilities in both proprietary code and third-party dependencies before release. The platform has also been independently penetration tested.

Backup and recovery

Continuous backups with point-in-time restore are replicated to the recovery region, and application failover to that region is tested annually.

At a glance

Key facts.

ISO 27001
Certified since 2021 and audited annually
AES-256
Encryption of data at rest
TLS 1.3
Supported for data in transit (TLS 1.2 minimum)
G-Cloud 15
Approved UK Government supplier
Privacy

Data protection and privacy.

Floww handles personal data in accordance with applicable data protection law, including UK GDPR and the Data Protection Act 2018. Where Floww processes personal data on a client's behalf, it does so only on the client's instructions and under contract.

Data protection registration

Floww maintains a record of the lawful basis for each processing activity. Fomtech Limited, trading as Floww, is registered with the Information Commissioner's Office (registration number ZA788696).

Individual rights

Under UK GDPR, individuals may request access to, correction, erasure, restriction or transfer of their personal data, or object to its processing, by contacting [email protected].

International transfers

Where personal data is transferred outside the UK or EEA, Floww puts suitable safeguards in place, such as approved contractual agreements.

Sub-processors

Floww's service providers may process personal data only for specified purposes and on Floww's instructions. A current list of sub-processors is available to clients on request.

Data retention

Personal data is retained only for as long as necessary, including legal, accounting and reporting requirements. Data that is no longer required is securely deleted or anonymised.

Incident response

Floww operates documented procedures for managing suspected personal data breaches, including notification of affected individuals and the relevant supervisory authorities where required by law.

Certifications

Certifications and accreditations.

Floww's information security management system is independently certified and subject to annual external audit.

Certified · UKAS

ISO/IEC 27001

Information security management, 2022 edition. Certified since December 2021, with annual surveillance audits by an accredited certification body.

Approved supplier

G-Cloud 15

Approved supplier on the Crown Commercial Service G-Cloud 15 framework.

In scope of 27001

ISO/IEC 27017

Information security controls for cloud services, in scope of Floww's ISO/IEC 27001 certification.

In scope of 27001

ISO/IEC 27018

Protection of personal data in public cloud services, in scope of Floww's ISO/IEC 27001 certification.

Our commitments

Principles that guide our approach.

01 Security by design

New features are released only once they meet Floww's security requirements.

02 Client data ownership

Floww does not sell client data, use it to train models or use it for any purpose outside the engagement.

03 Auditability

Transactions, state changes and user actions are recorded as replayable, exportable events, providing a detailed history of activity on the platform.

Resources

Policies and documentation.

Privacy policy

How Floww collects, uses, stores and shares personal data, and how individuals can exercise their rights.

Cookie policy

The cookies used on floww.io and how to manage your cookie preferences.

Data processing terms

The terms on which Floww processes personal data on behalf of clients, set out in our terms of business and available on request.
Contact

Security and privacy enquiries.

For questions about Floww's information security controls or data protection practices, complete this form and a member of our team will respond.

By submitting this form you agree to Floww's privacy notice.