What we do. And what we don’t have yet.
An honest page: the architecture, the certifications we hold, those in progress, and the documents you can request.
Hosted in France. Encrypted everywhere.
HostingFrench cloud provider, Paris and Gravelines regions. Daily encrypted backups, kept for 30 days.
EncryptionTLS 1.2+ in transit, AES-256 at rest. KMS-managed keys, rotated annually.
IsolationData isolated per organization. Internal access only with justification, and logged.
FingerprintsEach file gets a SHA-256 fingerprint on arrival, verifiable at any time.
Everything is in order.
GDPRHosting in FranceEncryption at rest and in transitFull audit logSHA-256 file fingerprintsRole-based access controlSSO (SAML, OIDC)DPA availableTracked deletion
Achieved, in progress, planned.
| Requirement | Status | Details |
|---|---|---|
| GDPR | In place | Records of processing, DPA, sub-processors listed, DPO appointed |
| Hosting in France | In place | No customer data outside the EU |
| Audit log | In place | Exportable, kept for 3 years |
| SSO SAML / OIDC | In place | Firm plan |
| Penetration test | Yearly | Report summary on request |
| ISO 27001 | In progress | Audit scheduled |
| SOC 2 Type II | Planned | Roadmap |
| HDS (French health data hosting) | No | Not certified to date; dedicated offering under review |
You set the retention period. We stick to it.
Per file, resource or sendEach object has its own retention period, inherited from the template or set manually.
Tracked deletionEvery deletion is logged, with the fingerprint of the deleted file.
Export before deletionYou’re notified 30 days ahead; export remains possible until the last day.
TerminationFull export, then deletion of all your data within 30 days.
To download or on request.
Data processing agreement (DPA)
Standard version, can be signed online.
Security policy
On request, under a non-disclosure agreement.
Summary of the latest penetration test
On request.
List of sub-processors
Hosting, email, SMS, automatic reading.
Responsible disclosure
security@hubflow.cloud, response within 72 hours.
Security questionnaire
We fill in yours.
A question this page doesn’t cover?
Book my demo Write to the security team, or ask it during the demo.