Trust Center
Everything you need to evaluate Flowtriq as a vendor: our security architecture, compliance posture, privacy practices, and legal documentation — all in one place. Operated by traztech, a Canadian company.
GDPR
EU General Data Protection Regulation. Article-by-article mapping, data subject rights, lawful bases, and sub-processor list.
ImplementedNIS2 Directive
EU Network and Information Security Directive 2. How Flowtriq maps to Article 21 security measures for covered entities.
Full mappingData Flow Document
What data is transmitted, where it goes, which sub-processors handle it, and how long it is retained.
PublishedEU Frameworks
ePrivacy Directive, DORA, Cyber Resilience Act, EU AI Act, German BDSG, Swiss nDSG, and ISO 27001 controls alignment.
PublishedPIPEDA (Canada)
Canada's federal privacy law. The 10 fair information principles mapped to Flowtriq's practices. Includes CASL note.
ImplementedSOC 2 / PCI / HIPAA
Compliance brief covering SOC 2 Type II, PCI-DSS 4.0, and HIPAA safeguard mappings for audit teams.
PublishedSecurity Practices
Infrastructure, encryption, access control, audit logging, application security, and vulnerability disclosure.
PublishedIncident Response
How Flowtriq detects, contains, and communicates security incidents — timelines, notifications, and breach register.
PublishedBusiness Continuity
Uptime SLA, infrastructure redundancy, disaster recovery, maintenance windows, and the agent-first availability model.
PublishedSub-Processors
Current list of third-party data processors, their locations, purposes, and applicable transfer mechanisms.
PublishedCookie Policy
Every cookie Flowtriq sets: name, purpose, duration, and category. Strictly necessary, functional, and analytics.
PublishedData Retention
How long each category of data is kept, when it is deleted, and what legal obligations extend the timeline.
PublishedVulnerability Disclosure
Responsible disclosure policy: scope, process, safe harbor, and how to report a security finding.
PublishedCompliance Status Overview
| Requirement | Status | Notes |
|---|---|---|
| Privacy Policy (GDPR Art. 13/14) | Implemented | Published at flowtriq.com/legal, effective March 10, 2026. |
| Data Processing Agreement (DPA) | Implemented | Published at flowtriq.com/legal, effective March 18, 2026. Available for customer execution. |
| Data Subject Rights Handling | Implemented | 30-day response SLA. Access, erasure, portability, and rectification via [email protected]. |
| Data Center Location | Implemented | Primary application servers located in Canada. See Data Flow document. |
| Encryption in Transit (TLS) | Implemented | HTTPS enforced across all surfaces. HSTS with one-year max-age. |
| Access Control (GDPR Art. 32, NIS2 Art. 21) | Implemented | RBAC with 4 roles. TOTP + email 2FA. Session management with secure cookies. |
| Audit Logging (GDPR Art. 32, NIS2 Art. 21) | Implemented | Tamper-evident SHA-256 hash-chained audit log. All user and system actions recorded. |
| Sub-processor Data Protection | Implemented | All sub-processors have data protection obligations. DPF-certified processors include Stripe, Google, Cloudflare, and LinkedIn. Full list in Data Flow document. |
| NIS2 Article 21 Security Measures | Substantially met | Incident detection, RBAC, cryptography, MFA, logging, and business continuity controls all implemented. Full mapping on NIS2 page. |
| PIPEDA Compliance | Implemented | Flowtriq is a Canadian company (traztech). All 10 fair information principles addressed. See PIPEDA page. |
| ISO 27001 Controls Alignment | Strong alignment | Substantial Annex A controls implemented: RBAC, MFA, audit logging, TLS, encrypted credentials, incident detection. See EU Frameworks page. |
For enterprise procurement, DPA execution, or vendor security questionnaires, contact [email protected]. For data subject requests, contact [email protected].
For vendor questionnaires, DPA execution, pen test report requests (NDA required), or custom security reviews, contact [email protected]. For data subject requests: [email protected].