Where is my data held?

The cloud service runs from UK and EU data centres. If that is not close enough, self-host: the runner executes inside your own network and your content never reaches us at all.

Can I self-host everything?

Yes. Every component runs on your own infrastructure, including the runner that executes flows and the editor people build them in.

Who can see my flow data?

Your organisation, according to the roles you set. We access customer content only to run your automations, or to resolve a service, security or support issue you have raised.

Do you train AI models on my content?

No. Where a flow calls an AI provider, it calls the provider you chose with the key you supplied, and only with what that step sends.

Will you sign a data processing agreement?

Yes. We generate a DPA for your organisation, with the security measures annexed, and EU financial entities can add the DORA addendum.

Yes. Flomation holds Cyber Essentials and Cyber Essentials Plus, the UK government-backed scheme, with Plus independently assessed rather than self-reported.

Is multi-factor authentication available?

Yes, time-based one-time codes from any authenticator app, enrolled per user and required at sign-in once it is on.

SECURITY

What happens to your data, and what you can check

Flomation sits between the systems you already trust, so the questions are fair ones. Here are the answers, including the parts that are your decision rather than ours.

The short version

Where is my data held?: The cloud service runs from UK and EU data centres. If that is not close enough, self-host: the runner executes inside your own network and your content never reaches us at all.
Can I self-host everything?: Yes. Every component runs on your own infrastructure, including the runner that executes flows and the editor people build them in.
Who can see my flow data?: Your organisation, according to the roles you set. We access customer content only to run your automations, or to resolve a service, security or support issue you have raised.
Do you train AI models on my content?: No. Where a flow calls an AI provider, it calls the provider you chose with the key you supplied, and only with what that step sends.
Will you sign a data processing agreement?: Yes. We generate a DPA for your organisation, with the security measures annexed, and EU financial entities can add the DORA addendum.
Are you certified?: Yes. Flomation holds Cyber Essentials and Cyber Essentials Plus, the UK government-backed scheme, with Plus independently assessed rather than self-reported.
Is multi-factor authentication available?: Yes, time-based one-time codes from any authenticator app, enrolled per user and required at sign-in once it is on.

Self-hosting is the strongest control we can offer

Most of what a security review asks about stops mattering when the software runs on your side of the boundary.

The runner executes flows on your infrastructure and reaches your internal systems directly, so data does not leave your network to be processed.
The editor, API, trigger service and database all run on your own hosts, in your own environments.
Deploy it where your other services live, with your own network controls, logging and backups around it.
The same flows run in either place, so a proof of concept in the cloud can move in-house without rebuilding it.

Secrets stay out of the flows that use them

A flow refers to a secret by name. The value is only resolved at the moment the step runs.

Secrets and credentials belong to an environment, so development cannot read what production holds.
They are encrypted at rest and are never rendered back into the editor once saved.
Connected accounts use OAuth where the provider offers it, and tokens are refreshed on the server rather than handed to a browser.
Trigger configuration keeps unresolved references, and values are resolved through a single controlled endpoint when a trigger fires.

Every run leaves a record

Automation is only trustworthy if you can answer what ran, on what, and who asked for it.

Each execution keeps its inputs, its outputs and its timings, node by node.
The record shows what started it: a person, a schedule, a webhook, a form or another flow.
Approval steps record who decided, what they were shown and when they answered.
Failures route down an error path you design, so a problem is handled rather than silently swallowed.

Access is scoped, not shared

The people who build flows are rarely the people who should reach production data.

Role-based access control governs who can see and run what, per organisation and per environment.
Multi-factor authentication is available for every account, and single sign-on is on the roadmap rather than shipped.
Sessions are token-based, and service-to-service calls between components are authenticated in their own right.
Inbound webhooks are verified before they can start a flow, using each provider signature, and a shared secret where a provider does not sign at all.

How your data is handled

You own your content

Your flows and the data passing through them are yours. We take a limited licence to process them so the service can run, and nothing more.

Retention is tied to your account

Content is kept while your account is active. An account with no sign-in and no active flows for twenty-four months may be deleted along with its data. Billing records are kept for as long as tax law requires.

Deletion is final

Once an account is deleted, neither it nor its content can be restored, so export anything you need first.

Sub-processors are infrastructure and payments

We use infrastructure and payment providers as processors, plus whichever services you connect to your own account. We do not sell personal data.

What not to put through it

These come from the Terms of Service and the Acceptable Use Policy. They are there because the platform is not built for them.

Special category data under the UK GDPR, including health records.
Payment card numbers, government identity numbers and similar financial account details.
High-risk activities, meaning anything where a failure could injure someone or cause serious harm.
Security or vulnerability testing against the service without asking us first.

Independently assessed

Certification is not the whole answer, but it is the part somebody else checked.

Cyber Essentials

The UK government-backed baseline: firewalls, secure configuration, access control, malware protection and patching, assessed annually.

Cyber Essentials Plus

The same controls, verified by an independent assessor testing our systems rather than reading our answers.

Paperwork for procurement

Cyber Essentials and Cyber Essentials Plus certificates.
A Data Processing Agreement, generated for your organisation, with the technical and organisational measures annexed.
A DORA addendum for EU financial entities.
Terms of Service, an Acceptable Use Policy, and a Privacy and Cookie Policy, each with a plain English summary.
A Modern Slavery Statement and a Carbon Reduction Plan.

Read the policies

Found something?

Tell us before you tell anyone else, and we will not pursue a report made in good faith. This is what the Acceptable Use Policy means by our bug reporting programme, and it is the one route to test us without breaching it. Email hello@flomation.co with "Security" in the subject line, and include what you did, what you saw, and anything we need to reproduce it.

Email the team

Bring it to your own infrastructure

If the answer to a question here is "not close enough", self-hosting removes most of it. Run the same flows on your own hosts, in your own network, under your own controls.

Start free Ask us something specific