This is a trust page, not a second privacy policy. For how we collect and use personal data, read the Privacy Policy. The Terms of Service also apply and, where we process personal data on a customer's behalf, so does our Data Processing Agreement.
01 How we handle data
We host the platform on Google Cloud Platform, in logically isolated environments.
The processing locations we publish for Google Cloud Platform are Singapore and the United States. You can choose a single data region.
Our Privacy Policy also explains that personal data may be processed in Singapore and in other countries where we or our service providers operate.
Model routing respects data residency, and private deployment is available.
The current list of sub-processors, and where they process data, is at floowed.com/policies/subprocessors.
02 AI and models
A case can include model-based processing. Google, through Google Cloud Platform, is our main model provider.
Floowed does not use customer data to train, fine-tune or develop machine-learning or AI models, except transiently to run the customer's own workflows. On our sub-processors page we state that Google Cloud Platform's model-based document processing is contractually bound by the no-training restriction in our Data Processing Agreement.
The access controls, logging and encryption on this page apply to that processing too.
03 The case record and audit log
Every case is meant to leave a record of what happened. We log decisions, configuration changes and overrides, attributable to the acting user, and we keep version history. You can see what was decided, what changed, and who overrode it.
We minimise personal data in processing and in logs, and we redact personal data in application logs.
04 Access, encryption and backups
Access to customer personal data is protected by role-based access control, least privilege by default, scoped access tokens, and authentication controls. Our people are under confidentiality obligations and get access on a need-to-know basis. We maintain internal security policies. In the product, you are responsible for managing access for your authorised users, as described in the Terms of Service.
Data is encrypted in transit with TLS, and encrypted at rest.
We keep secured back-ups, and we maintain measures designed to restore availability of, and access to, customer personal data in a timely manner after an incident. We do not publish a guaranteed uptime or recovery time on this page. Unless a separate written service level agreement is in place, the Terms of Service provide the service on an "as is" and "as available" basis.
05 Agreements and requests
Where Floowed processes personal data on a customer's behalf, our Data Processing Agreement applies. It is incorporated into the Terms of Service and is available to customers on request. Customers can also request security questionnaires and our audit reports. For a copy, or for those requests, contact dpo@floowed.com.
We're working toward SOC 2. We don't hold a SOC 2 report or ISO 27001 certification yet, and we'll update this page when that changes.
06 Reporting a security issue
If you believe you have found a security issue in Floowed, email security@floowed.com. That is the address we publish for security reports.
For privacy or data-protection questions, use dpo@floowed.com.