How we protect your data across every FlowForma product. ISO/IEC 27001:2022 certified and Cyber Essentials accredited as a company.
Last updated: November 5, 2026
Our certifications cover FlowForma as a company, and so every FlowForma product.
Certified information security management system, independently audited.
UK government-backed accreditation for core cyber security controls.
Customer personal data is processed under our data processing agreement, with lawful transfer safeguards.
Runs inside your Microsoft 365 tenant, governed by your existing Microsoft controls.
Process Automation only
Our products are built differently, so where your data lives depends on the product you use. Here's how each one works.
The workflow, forms and rules engine runs alongside Microsoft 365, so your process data and documents stay inside your own SharePoint Online environment.
A software-as-a-service platform hosted on Microsoft Azure, with each customer in its own isolated workspace.
A software-as-a-service platform hosted on Microsoft Azure, with data stored in the European Economic Area: Ireland (primary), the Netherlands (backups and replicas) and Sweden (AI service data).
Sign-in with Microsoft Entra ID or Google Workspace.
A software-as-a-service platform hosted on Microsoft Azure, with data stored in the European Economic Area: Ireland (primary), the Netherlands (backups and replicas) and Sweden (AI service data).
Sign-in with Microsoft Entra ID or Google Workspace.
| Product | Stored data | Identity | AI processing |
|---|---|---|---|
| FlowForma Process Automation | Process and form data: your own Microsoft 365 tenant and region. Platform data: FlowForma's Microsoft Azure environment in the region you choose (Europe, Asia-Pacific, India or the Americas). | Microsoft Entra ID | Built-in AI uses Microsoft Azure OpenAI Service. If you bring your own AI provider, that provider's terms and data location apply |
| FlowForma Contract | European Economic Area: Ireland (primary), the Netherlands (backups and replicas), Sweden (AI service data) | Microsoft Entra ID or Google Workspace | Global deployment: individual AI requests may be processed in any Azure region where the model is available |
| FlowForma Agent Trust | European Economic Area: Ireland (primary), the Netherlands (backups and replicas), Sweden (AI service data) | Microsoft Entra ID or Google Workspace | Global deployment: individual AI requests may be processed in any Azure region where the model is available |
| FlowForma Assure | European Economic Area: Ireland (primary), the Netherlands (backups and replicas), Sweden (AI service data) | Microsoft Entra ID or Google Workspace | Global deployment: individual AI requests may be processed in any Azure region where the model is available |
Ongoing training and strict access controls keep security embedded in how our team works.
Comprehensive, ongoing training keeps our team informed about the latest threats and best practices.
Simulated phishing tests are run regularly to reinforce vigilance and readiness against social engineering.
Access to customer data is limited to authorized personnel who need it for their role, and is logged.
Our security team continually evaluates and improves our policies, processes and tools.
We partner with reputable security firms to run regular internal and external penetration tests.
Every third-party app and provider is reviewed against our security and data protection standards before use.
A formal incident response plan and team are ready to act immediately to reduce risk.
Detailed recovery plans are tested through regular simulations, for resilience and rapid restoration.
Automated scans across our infrastructure catch exploitable weaknesses, with prompt remediation.
Documented security policies and incident response plans, backed by background checks and staff training.
Every FlowForma product uses Microsoft Azure OpenAI Service. Your data is never used to train Microsoft's or third-party foundation models.
Full detail in the AI Disclosure.
This page describes our current architecture and security practices. It is provided for transparency and does not add to or replace the commitments in your order form, our Terms and Conditions or our Data Processing Agreement.
| Area | How it works across FlowForma products |
|---|---|
| Encryption and credentials | TLS 1.2 or higher for data in transit. Microsoft Azure encryption at rest for databases, file storage, search and secrets. Azure managed identities for service-to-service access, with required secrets held in Azure Key Vault. |
| Network and file security | Traffic passes through a managed web application firewall in blocking mode. Core data services are reached through private network endpoints. Uploaded files are validated and malware-scanned before processing, and are never executed. |
| Audit logging | An append-only audit trail for each customer workspace covers sign-in, user and role changes, configuration, key activity, AI analysis and review decisions. FlowForma administrative activity is recorded separately. |
| FlowForma staff access | Restricted to authorized personnel on a need-to-know basis, and logged. Standard admin tools can't view or download your content. A small number of authorized engineers hold privileged infrastructure access for administration, security and support. |
| Backup and resilience | Geo-redundant database backups with 30-day point-in-time restore. File storage is geo-redundant between Ireland and the Netherlands, with versioning and 90-day soft delete. Applications currently run in a single Azure region and are not zone-redundant. Process Automation only Process and form data in your own Microsoft 365 tenant is covered by your Microsoft 365 backup and retention policies. |
| Retention after your contract ends | Your workspace is disabled for 30 days, then soft-deleted, then permanently deleted 30 days later unless the law requires otherwise. Residual copies expire on their own cycles: backups up to 30 days, deleted files up to 90 days, operational logs up to 365 days. Process Automation only Process and form data stays in your own Microsoft 365 tenant, under your control. |
| AI provider retention | Microsoft's standard Azure OpenAI abuse monitoring may keep prompts and outputs for up to 30 days. |
The same security and AI principles apply to free trials unless we say otherwise. Trial commitments, support and deletion are covered by the Free Trial Terms, not the customer terms.
We may update our hosting, services and security controls as our products develop. Changes won't knowingly reduce the overall level of security during an existing subscription.
See how FlowForma keeps your data secure and under your control, across every product.
