Try it FREE

Security at ERPFlow

What follows is what's implemented today — not a roadmap, and not a list of things we intend to do.

Our Data Processing Addendum incorporates this page as Annex II — the current public statement of ERPFlow's technical and organisational measures. (2026-07-27)

  • Your data is isolated in the database itself

    Every table carries row-level security policies, deny-by-default, so a query can only ever return rows belonging to your organization. That boundary is enforced by PostgreSQL rather than by application code — a mistake in a handler can't leak another company's data past it.

  • Hosted in the EU

    Your data lives on servers in Germany. It doesn't leave the EU in the ordinary course of running the service, and every sub-processor we use is listed publicly with what it does and where.

  • Encrypted in transit and at rest

    All traffic runs over TLS. Data at rest — including database backups and uploaded files — is encrypted on disk. Backups are encrypted independently, so a copy is useless without its key.

  • People see only what their role allows

    Role-based access control governs every resource, per action. You decide who can view invoices, who can edit staff records, who can see nothing but their own bookings. Permissions are checked server-side on every request, not hidden in the interface.

  • Every change is logged

    Creates, updates and deletes land in an activity log you can search by user, record and action. Inventory and asset movements carry their own immutable trail — so when a number looks wrong, you can see exactly what changed it and who was responsible.

  • Automated, encrypted backups

    The database is backed up automatically on a schedule, encrypted, and restore procedures are documented and rehearsed rather than assumed.

  • You can take everything with you

    Download your whole organization whenever you want: one archive of every record as CSV that imports straight back, plus a separate archive of every file you've uploaded. No export fee, no support ticket, no proprietary format. Leaving is a button, not a negotiation.

  • GDPR, in practice not just in policy

    We publish our sub-processor register, honour access and deletion requests, and keep analytics behind explicit consent — no tracking cookies load until you accept them. Our privacy notice says what we collect in plain language.

  • Secrets stay server-side

    Database credentials, API keys and signing secrets live on the server, scoped to the services that need them — not in the codebase, not in tickets, not on laptops. When a role changes or someone leaves, access and credentials are revoked promptly.

  • The team is bound to confidentiality and trained

    Everyone authorised to touch customer data has committed to confidentiality in writing and is trained on data protection and information security for their role, with refreshers at least annually. Our DPA makes both commitments contractual (clauses 5.1 and 5.2).

  • Breaches are notified within 72 hours

    If a personal-data breach affects your data, we notify you without undue delay — at the latest within 72 hours of becoming aware of it — with what happened, which data is affected, and what we are doing about it. The window is a contractual commitment in our DPA (clause 10), not a goal.

More detail: Sub-processor register · Privacy notice

What we don't claim

We hold no SOC 2 or ISO 27001 certification and have not commissioned a third-party penetration test. We don't publish an uptime SLA outside Enterprise agreements. We'd rather you learn that here than discover it during procurement — and if any of it is a blocker for you, say so and we'll give you an honest timeline rather than a sales answer.

What buyers ask us

Are you SOC 2 or ISO 27001 certified?
Not today. We hold no formal certification and we'd rather say so than imply otherwise. The controls described above are implemented and in use; if a certification is a requirement for you, tell us and we'll talk about the timeline honestly.
Where exactly is my data stored?
On servers in Germany, within the EU. Our sub-processor register lists every third party involved in running the service, what they do, and where they operate.
Who at ERPFlow can see my data?
Access to production is limited to the engineers who operate the service, and is used for support and incident response only. We don't sell data, share it with advertisers, or use your business records to train models.
What happens if I delete my organization?
The deletion dialog offers both exports first — records and files — so you leave with a copy. After deletion, data is removed from live systems; encrypted backups age out on their normal retention cycle.
How do I report a vulnerability?
Email us with the details and we'll acknowledge it. We'd much rather hear about a problem from you than from an incident.
Do you pseudonymise stored data?
No. Business software has to show real names to the people authorised to see them, so we protect live records with per-tenant row-level isolation, encryption in transit and at rest, and role-based access control rather than pseudonymisation. Our DPA incorporates this page as Annex II — the current statement of measures — so what you read here is exactly what is in place.

Still deciding? Book a demo

Start free. Scale as you grow.

Run your whole business in one place — and pay for it like a founder, not an enterprise.

Try it FREEBook a demo

No card · No trial clock · Export everything · Cancel anytime