Snapshot 57028
Normalized text
Scripts and page chrome removed; this is what change detection compares.
See what's new in QFlow: Revenue, Conversions, Sales Ramp, Renewals, and Accounting. Read the July product notes Privacy, Security, and Architecture Last updated: September 30, 2026 CONTENTS At a Glance Security FAQ Architecture and Controls This page is a general security FAQ and architecture overview for procurement and infosec reviews. At a Glance SOC 2 Type II Certified: Security, Availability, Processing Integrity, Confidentiality, and Privacy Zero Customer Data Sharing: Customer Data is not sold or used to train shared models Enterprise-Grade Encryption: AES-256 encryption at rest, TLS 1.2+ in transit Continuous Monitoring: 24/7 security monitoring and incident response Regular Security Assessments: Annual penetration testing and quarterly vulnerability scans Trust & Transparency: Security updates maintained in our Trust Center Security FAQ 1) Are trial environments covered by confidentiality protections? Yes. Trial and paid usage are covered by QFlow confidentiality protections in our agreements, including Service Terms and related documents. If an NDA is in place, it also applies. 2) Will customer data remain confidential and not be shared externally? Customer Data is treated as confidential and is not sold. QFlow only discloses Customer Data as required to deliver the service (for example, approved subprocessors), as directed by the customer through enabled integrations or features, or where required by law. Some product capabilities can route data to third-party systems based on customer configuration. Those third-party systems are outside of QFlow operational control and are governed by their own terms and privacy/security commitments. 3) Is customer data used to train shared models? No. QFlow does not use one customer's data to train shared models across customers. Where model fine-tuning is used, it is done using that customer's data in isolation for that customer context only. AI-enabled features are optional and can be disabled. 4) How is customer data stored and secured? QFlow uses managed cloud infrastructure and layered security controls to protect Customer Data. Encryption in transit and at rest. Logical segregation by customer organization and role-based access controls. Centralized authentication and session controls. Operational logging, monitoring, and incident response processes. Backup and recovery procedures. 5) Are you SOC 2 certified? Yes. QFlow is SOC 2 certified in the areas of Security, Availability, Processing Integrity, Confidentiality, and Privacy. 6) What written documentation can be provided? Security and compliance documentation is available through our Trust Center and legal terms pages. For procurement questionnaires or formal confirmation letters, contact support. Trust Center: trust.qflow.ai Service Terms Privacy Policy Data Processing Addendum (DPA) Security contact: support@qflow.ai 7) Do you conduct penetration testing and vulnerability assessments? Yes. QFlow conducts annual third-party penetration testing and quarterly vulnerability scans. Critical and high-severity findings are remediated promptly according to our vulnerability management program. Penetration test reports can be made available to customers under NDA. 8) How do you handle security incidents? QFlow maintains a formal incident response plan with defined procedures for detection, containment, eradication, and recovery. Customers are notified of security incidents that may impact their data in accordance with contractual obligations and applicable law. Our security team is available 24/7 for incident escalation. 9) What access controls are in place? QFlow implements role-based access controls (RBAC) with the principle of least privilege. Administrative access is strictly limited, requires multi-factor authentication (MFA), and is logged for audit purposes. All access is reviewed regularly, and accounts are deprovisioned immediately upon employee termination. 10) How is application security managed? Security is integrated throughout our development lifecycle: Secure coding standards and developer security training Code review requirements for all production changes Automated security testing in CI/CD pipelines Dependency scanning for known vulnerabilities Regular security updates and patch management 11) Where is customer data hosted? QFlow infrastructure is hosted on AWS in the United States. We use multiple availability zones for redundancy and high availability. Data residency requirements can be discussed for enterprise customers with specific compliance needs. 12) Do you have business continuity and disaster recovery plans? Yes. QFlow maintains documented business continuity and disaster recovery procedures, including automated backups, tested recovery procedures, and redundant infrastructure. Our target RTO (Recovery Time Objective) and RPO (Recovery Point Objective) metrics are available in our Trust Center. 13) How do you ensure employee security awareness? All QFlow employees complete security awareness training during onboarding and annually thereafter. Training covers data protection, phishing awareness, secure handling of credentials, incident reporting, and privacy obligations. Employees with access to production systems receive additional specialized training. 14) What compliance frameworks do you follow? QFlow is SOC 2 Type II certified and follows industry-standard security frameworks including NIST Cybersecurity Framework and OWASP guidelines. We maintain GDPR compliance for data processing activities and can support customers with their own compliance requirements. 15) How do you manage third-party vendors? All third-party vendors and subprocessors undergo security review before engagement. We maintain a current list of subprocessors in our Trust Center and notify customers of changes as required by our agreements. Vendor access is limited to what is necessary for service delivery. Architecture and Controls (More Detail) QFlow is designed to support advanced analytics and AI workflows without sacrificing security and privacy fundamentals. Multi-Tenant Architecture & Data Isolation QFlow operates a secure multi-tenant architecture with comprehensive isolation controls: Logical Segregation: Customer data is logically segregated at the database and application layers using tenant identifiers Role-Based Access: Granular permissions ensure users can only access data within their organization context Environment Separation: Production, staging, and development environments are strictly isolated Query Validation: All data access queries are validated to prevent cross-tenant data leakage Network Segmentation: Application tiers are segmented with firewall rules limiting lateral movement Infrastructure Security QFlow infrastructure is built on AWS with defense-in-depth security controls: Cloud Infrastructure: AWS services with inherent security controls and compliance certifications Network Security: VPC isolation, security groups, and network ACLs restrict traffic DDoS Protection: AWS Shield and CloudFront provide DDoS mitigation Load Balancing: Application load balancers distribute traffic and improve resilience Auto-Scaling: Automatically scales to handle traffic spikes and maintain availability Encryption & Key Management Customer Data is protected using enterprise-grade encryption at all stages: In Transit: TLS 1.2+ for all data transmission with strong cipher suites At Rest: AES-256 encryption for data stored in databases and object storage Key Management: AWS KMS for centralized key management with automatic rotation Certificate Management: Automated certificate provisioning and renewal Secrets Management: Encrypted storage for API keys, credentials, and sensitive configuration Security Monitoring & Operations QFlow maintains 24/7 security monitoring and operational controls: SIEM Integration: Centralized logging and security event monitoring Intrusion Detection: Network and host-based intrusion detection systems Anomaly Detection: Automated alerts for unusual access patterns or behaviors Audit Logging: Comprehensive audit trails for all administrative and data access Log Retention: Security logs retained for minimum 1 year for forensic analysis Incident Response: Documented procedures with 24/7 escalation capability Authentication & Access Control Robust identity and access management controls protect customer environments: Single Sign-On (SSO): SAML 2.0 support for enterprise identity providers Multi-Factor Authentication: MFA enforcement for administrative access Password Policies: Strong password requirements with complexity and expiration rules Session Management: Secure session handling with automatic timeout API Security: Token-based authentication with scoped permissions and rate limiting Principle of Least Privilege: Access grants limited to minimum necessary permissions Backup & Business Continuity QFlow maintains comprehensive backup and recovery capabilities: Automated Backups: Daily automated backups with point-in-time recovery capability Geographic Redundancy: Backups replicated across multiple AWS availability zones Recovery Testing: Regular disaster recovery drills to validate procedures RTO/RPO: Target 4-hour RTO and 1-hour RPO for critical systems High Availability: Multi-AZ deployment for production services Failover Procedures: Documented and tested failover processes Vendor & Subprocessor Management Third-party relationships are managed with security and compliance in mind: Security Reviews: All vendors undergo security assessment before engagement Contractual Protections: Data processing agreements and security requirements in contracts Subprocessor List: Current list maintained in Trust Center with update notifications Regular Audits: Ongoing assessment of vendor security posture Limited Access: Vendors granted minimum necessary access for service delivery Data Lifecycle Management Customer data handling follows defined processes throughout its lifecycle: Data Retention: Configurable retention policies aligned with customer requirements Data Export: Self-service data export capabilities in standard formats Data Deletion: Secure deletion procedures including cryptographic erasure Right to Be Forgotten: Processes to honor data subject deletion requests End of Service: Data return and deletion within 30 days of contract termination Need a Formal Security Package? For formal confirmation letters, trust documentation, or security review support, contact support@qflow.ai. © QFlow.ai, Inc.™ 2026 San Francisco, California Product Go-to-Market Stats Multi-quarter Revenue Projections In-quarter Sales Forecasting Revenue Forecasting QPilot (AI Analyst) Business Digest Multi-touch Attribution Campaign Effectiveness GTM Signal Response Measurement Activity & Capacity Analytics Rep Ramp Management Pipeline Forensics QFlow Connect QFlow Desktop Company About Blog Partners Careers Support Service Status Pricing QFlow Benefits For Finance Teams For Revenue Operations For Sales For Marketing Legal & Security Trust Portal Service Terms & Privacy Policy Security, Privacy, and Architecture Contact Book a Demo +1 (415) 735-6910 This website uses cookies to enhance user experience and to analyze performance and traffic.