Everything you’re asked for before signing. In one place.
Hosting, encryption, certifications, contractual documents, sub-processors: the page to forward to your IT team, your DPO or your professional body.
Four commitments. Verifiable.
Hosted in FranceScaleway, Paris region. No customer data outside the European Union, backups included.
Encrypted everywhereTLS 1.2+ in transit, AES-256 at rest, KMS-managed keys with yearly rotation. SHA-256 fingerprint for every file.
Controlled accessPer-member roles, SAML / OIDC SSO, personal links for your contacts. Every action in the audit log, kept for 3 years.
Sub-processors listedHosting, e-mail, SMS and automatic reading: four sub-processors, all in the EU, listed and notified in case of change.
Certifications and commitments.
| Requirement | Status | Detail |
|---|---|---|
| GDPR | In place | Processing register, signable DPA, appointed DPO, sub-processors listed |
| EU hosting | In place | Scaleway, Paris region; encrypted backups kept for 30 days |
| Encryption | In place | TLS 1.2+ in transit, AES-256 at rest |
| Audit log | In place | Time-stamped, exportable, kept for 3 years |
| SAML / OIDC SSO | In place | Custom plan |
| Penetration test | Yearly | By an independent third party; summary on request |
| Responsible disclosure | In place | security@hubflow.cloud, acknowledgement within 72 hours |
| ISO 27001 | In progress | Audit scheduled |
| SOC 2 Type II | Planned | Roadmap |
| HDS (health data) | No | Not certified to date; dedicated offer under consideration |
The documents. To read, or to request.
Terms of sale
Plans, billing, duration, termination, export and deletion.
Terms of use
The rules for your team members, contributors and recipients.
Data processing agreement (DPA)
Standard version, signable online.
Privacy policy
Data processed, purposes, retention periods, data subject rights.
Sub-processor list
Hosting, e-mail, SMS, automatic reading. All in the EU.
Architecture and security
Hosting, encryption, isolation, retention periods.
Security policy
On request, under a non-disclosure agreement.
Latest penetration test summary
On request.
Security questionnaire
Send us yours: we complete it within 10 business days.
Missing a document for your file?
Book my demo Write to security@hubflow.cloud, or ask for it during the demo.