Privacy, Security, and Architecture

At a Glance

• SOC 2 Type II Certified: Security, Availability, Processing Integrity, Confidentiality, and Privacy
• Zero Customer Data Sharing: Customer Data is not sold or used to train shared models
• Enterprise-Grade Encryption: AES-256 encryption at rest, TLS 1.2+ in transit
• Continuous Monitoring: 24/7 security monitoring and incident response
• Regular Security Assessments: Annual penetration testing and quarterly vulnerability scans
• Trust & Transparency: Security updates maintained in our Trust Center

Security FAQ

1) Are trial environments covered by confidentiality protections?

Yes. Trial and paid usage are covered by QFlow confidentiality protections in our agreements, including Service Terms and related documents. If an NDA is in place, it also applies.

2) Will customer data remain confidential and not be shared externally?

Customer Data is treated as confidential and is not sold. QFlow only discloses Customer Data as required to deliver the service (for example, approved subprocessors), as directed by the customer through enabled integrations or features, or where required by law.

Some product capabilities can route data to third-party systems based on customer configuration. Those third-party systems are outside of QFlow operational control and are governed by their own terms and privacy/security commitments.

3) Is customer data used to train shared models?

No. QFlow does not use one customer's data to train shared models across customers. Where model fine-tuning is used, it is done using that customer's data in isolation for that customer context only. AI-enabled features are optional and can be disabled.

4) How is customer data stored and secured?

QFlow uses managed cloud infrastructure and layered security controls to protect Customer Data.

• Encryption in transit and at rest.
• Logical segregation by customer organization and role-based access controls.
• Centralized authentication and session controls.
• Operational logging, monitoring, and incident response processes.
• Backup and recovery procedures.

5) Are you SOC 2 certified?

Yes. QFlow is SOC 2 certified in the areas of Security, Availability, Processing Integrity, Confidentiality, and Privacy.

6) What written documentation can be provided?

Security and compliance documentation is available through our Trust Center and legal terms pages. For procurement questionnaires or formal confirmation letters, contact support.

• Trust Center: trust.qflow.ai
• Service Terms
• Privacy Policy
• Data Processing Addendum (DPA)
• Security contact: support@qflow.ai

7) Do you conduct penetration testing and vulnerability assessments?

Yes. QFlow conducts annual third-party penetration testing and quarterly vulnerability scans. Critical and high-severity findings are remediated promptly according to our vulnerability management program. Penetration test reports can be made available to customers under NDA.

8) How do you handle security incidents?

QFlow maintains a formal incident response plan with defined procedures for detection, containment, eradication, and recovery. Customers are notified of security incidents that may impact their data in accordance with contractual obligations and applicable law. Our security team is available 24/7 for incident escalation.

9) What access controls are in place?

QFlow implements role-based access controls (RBAC) with the principle of least privilege. Administrative access is strictly limited, requires multi-factor authentication (MFA), and is logged for audit purposes. All access is reviewed regularly, and accounts are deprovisioned immediately upon employee termination.

10) How is application security managed?

Security is integrated throughout our development lifecycle:

• Secure coding standards and developer security training
• Code review requirements for all production changes
• Automated security testing in CI/CD pipelines
• Dependency scanning for known vulnerabilities
• Regular security updates and patch management

11) Where is customer data hosted?

QFlow infrastructure is hosted on AWS in the United States. We use multiple availability zones for redundancy and high availability. Data residency requirements can be discussed for enterprise customers with specific compliance needs.

12) Do you have business continuity and disaster recovery plans?

Yes. QFlow maintains documented business continuity and disaster recovery procedures, including automated backups, tested recovery procedures, and redundant infrastructure. Our target RTO (Recovery Time Objective) and RPO (Recovery Point Objective) metrics are available in our Trust Center.

13) How do you ensure employee security awareness?

All QFlow employees complete security awareness training during onboarding and annually thereafter. Training covers data protection, phishing awareness, secure handling of credentials, incident reporting, and privacy obligations. Employees with access to production systems receive additional specialized training.

14) What compliance frameworks do you follow?

QFlow is SOC 2 Type II certified and follows industry-standard security frameworks including NIST Cybersecurity Framework and OWASP guidelines. We maintain GDPR compliance for data processing activities and can support customers with their own compliance requirements.

15) How do you manage third-party vendors?

All third-party vendors and subprocessors undergo security review before engagement. We maintain a current list of subprocessors in our Trust Center and notify customers of changes as required by our agreements. Vendor access is limited to what is necessary for service delivery.

Architecture and Controls (More Detail)

QFlow is designed to support advanced analytics and AI workflows without sacrificing security and privacy fundamentals.

Multi-Tenant Architecture & Data Isolation

QFlow operates a secure multi-tenant architecture with comprehensive isolation controls:

• Logical Segregation: Customer data is logically segregated at the database and application layers using tenant identifiers
• Role-Based Access: Granular permissions ensure users can only access data within their organization context
• Environment Separation: Production, staging, and development environments are strictly isolated
• Query Validation: All data access queries are validated to prevent cross-tenant data leakage
• Network Segmentation: Application tiers are segmented with firewall rules limiting lateral movement

Infrastructure Security

QFlow infrastructure is built on AWS with defense-in-depth security controls:

• Cloud Infrastructure: AWS services with inherent security controls and compliance certifications
• Network Security: VPC isolation, security groups, and network ACLs restrict traffic
• DDoS Protection: AWS Shield and CloudFront provide DDoS mitigation
• Load Balancing: Application load balancers distribute traffic and improve resilience
• Auto-Scaling: Automatically scales to handle traffic spikes and maintain availability

Encryption & Key Management

Customer Data is protected using enterprise-grade encryption at all stages:

• In Transit: TLS 1.2+ for all data transmission with strong cipher suites
• At Rest: AES-256 encryption for data stored in databases and object storage
• Key Management: AWS KMS for centralized key management with automatic rotation
• Certificate Management: Automated certificate provisioning and renewal
• Secrets Management: Encrypted storage for API keys, credentials, and sensitive configuration

Security Monitoring & Operations

QFlow maintains 24/7 security monitoring and operational controls:

• SIEM Integration: Centralized logging and security event monitoring
• Intrusion Detection: Network and host-based intrusion detection systems
• Anomaly Detection: Automated alerts for unusual access patterns or behaviors
• Audit Logging: Comprehensive audit trails for all administrative and data access
• Log Retention: Security logs retained for minimum 1 year for forensic analysis
• Incident Response: Documented procedures with 24/7 escalation capability

Authentication & Access Control

Robust identity and access management controls protect customer environments:

• Single Sign-On (SSO): SAML 2.0 support for enterprise identity providers
• Multi-Factor Authentication: MFA enforcement for administrative access
• Password Policies: Strong password requirements with complexity and expiration rules
• Session Management: Secure session handling with automatic timeout
• API Security: Token-based authentication with scoped permissions and rate limiting
• Principle of Least Privilege: Access grants limited to minimum necessary permissions

Backup & Business Continuity

QFlow maintains comprehensive backup and recovery capabilities:

• Automated Backups: Daily automated backups with point-in-time recovery capability
• Geographic Redundancy: Backups replicated across multiple AWS availability zones
• Recovery Testing: Regular disaster recovery drills to validate procedures
• RTO/RPO: Target 4-hour RTO and 1-hour RPO for critical systems
• High Availability: Multi-AZ deployment for production services
• Failover Procedures: Documented and tested failover processes

Vendor & Subprocessor Management

Third-party relationships are managed with security and compliance in mind:

• Security Reviews: All vendors undergo security assessment before engagement
• Contractual Protections: Data processing agreements and security requirements in contracts
• Subprocessor List: Current list maintained in Trust Center with update notifications
• Regular Audits: Ongoing assessment of vendor security posture
• Limited Access: Vendors granted minimum necessary access for service delivery

Data Lifecycle Management

Customer data handling follows defined processes throughout its lifecycle:

• Data Retention: Configurable retention policies aligned with customer requirements
• Data Export: Self-service data export capabilities in standard formats
• Data Deletion: Secure deletion procedures including cryptographic erasure
• Right to Be Forgotten: Processes to honor data subject deletion requests
• End of Service: Data return and deletion within 30 days of contract termination

Need a Formal Security Package?

For formal confirmation letters, trust documentation, or security review support, contact support@qflow.ai.