Security
Enterprise-grade security for everyday operations work
Flotr is built for teams that cannot afford lost tasks or unclear ownership. Paid plans include the same security foundation: authenticated access, workspace boundaries, encryption, and GDPR-aligned data handling you can review before you commit.
- Encryption in transit
- Workspace-scoped access
- GDPR-aligned practices
- Traceable operational changes
In the product
Security is enforced in the application layer — not only in marketing copy. These controls apply to every workspace; Team adds shared permissions and audit history for collaborative review.
Workspace-scoped data access
Business data is accessed through repositories that apply the active workspace boundary. API requests require an authenticated user and active organization.
Roles and permissions
Workspace roles control sensitive actions such as inviting members, managing integrations and automations, viewing audit history, and managing billing.
Modern authentication
Sign in with Google, email magic links, or passkeys. Sessions and organization membership are managed with industry-standard auth practices.
Operational audit history
Meaningful changes emit domain events that feed operation activity and workspace audit records on Team plans. This supports traceability inside your organization.
Protected integration credentials
OAuth tokens and secrets for connected integrations are encrypted before they are stored. They are only decrypted when needed to run an authorized action for your workspace.
Secure file handling
Operation attachments are stored in dedicated object storage. Downloads use short-lived signed URLs so files are not exposed through permanent public links.
Infrastructure and data protection
We do not operate our own data centers. We choose infrastructure partners with strong track records and contractual commitments, and we design Flotr so your workspace data stays scoped and recoverable.
Encryption in transit and at rest
Web and API traffic is served over modern TLS. Database and file storage rely on provider-managed encryption at rest as part of our hosting stack.
EEA-first hosting where feasible
We aim to host and process customer data within the European Economic Area. When data must leave the EEA, we use appropriate safeguards such as Standard Contractual Clauses.
Managed infrastructure
Flotr runs on specialist cloud infrastructure for compute, database, and object storage. Those providers maintain their own security programs, certifications, and independent audits that contribute to our overall posture.
Logical separation between workspaces
Customer workspaces are isolated in application logic and data access layers. Production access for Flotr staff follows least-privilege principles and is limited to what is needed to operate and support the service.
Privacy, GDPR, and contracts
Flotr follows a GDPR-aligned approach: lawful bases documented in our privacy policy, data subject rights, retention aligned to service use, and a Data Processing Agreement for customers who need Article 28 terms. Compliance also depends on how your organization configures Flotr, your retention choices, and your own processes.
Certifications and shared responsibility
Flotr does not currently hold its own SOC 2 Type II or ISO 27001 certification. We inherit portions of a strong baseline from our infrastructure and subprocessors, but product features alone do not make you compliant — your legal, security, and IT teams still own your program.
If you need a security questionnaire, subprocessor list, or custom contractual terms for a regulated environment, contact us. We will walk through your requirements honestly rather than overclaim.
Questions about your deployment
Tell us about retention, access, integrations, AI usage, and contractual needs before you put regulated or sensitive data in Flotr. We will help you assess fit — product capabilities do not replace your own security review or legal advice.
Contact Flotr about security