Security at Flowen

1. Our security philosophy

Flowen is built on EU infrastructure, by a Swedish company, with no foreign ownership. Customer data stays within the EU/EEA. Strong cryptography is the default rather than an option.

This page describes the measures we have in place today, and the ones we are working on. We would rather tell you what is not finished than imply that everything is.

2. Hosting and infrastructure

• EU hosting. Production data is stored and processed on servers in the EU: OVHcloud in France, with backups at Hetzner in Germany and Storegate in Sweden. Two services in the chain are run by US-owned companies: email is sent through Microsoft 365 (Microsoft Ireland, EU Data Boundary), and receipt scanning, when used, runs on Azure Document Intelligence. These companies can in principle be subject to US law such as the CLOUD Act.
• DDoS protection through OVH's always-on mitigation infrastructure.
• Three locations. Production at OVHcloud in France, a nightly mirror to Hetzner in Germany and a daily encrypted backup to Storegate in Sweden, so the loss of one site does not mean the loss of your data.
• Network isolation. Administrative endpoints are restricted, and internal services are not reachable from the internet.

3. Encryption

4. Authentication and access control

• Email verification is required before an account is activated.
• JWT-based authentication with separate access and refresh tokens.
• Role-based access control at team and resource level. Each customer is a separate space, and every data request is checked against the user's active team. We test this continuously and fix gaps as we find them.
• Password reset through signed, time-limited tokens sent by email.
• OAuth for integrations (Microsoft Graph, LinkedIn, Facebook), delegating authentication to the provider.
• Deleted projects are kept in a recoverable state, so accidental deletion can be undone on request.

5. Infrastructure hardening

• SSH key authentication only — password login is disabled.
• fail2ban blocks brute-force attempts automatically.
• Secrets are managed in a self-hosted Vaultwarden instance in our own EU environment. We do not use third-party password managers internally.
• Security updates are applied to production servers on a regular basis.
• Zero-downtime deploys through PM2 reload, so patches can be applied without interrupting the service.
• Interactive access to the production server is limited to the application owner. Deployments run through an automated pipeline with its own key.

6. Backup and recovery

• Nightly backups of the database, taken at 03:00 and encrypted before leaving the production server. Uploaded files are copied nightly as well (see section 3).
• Three locations within the EU: the production server in France, a server in Germany and Storegate in Sweden.
• Automatic verification. Each database backup is checked for plausible size and correct encryption before it is transferred, and file archives are checked for size at the destination. If a check fails, the run stops and an alert is raised rather than overwriting a working backup with a broken one.
• Retention: database backups are kept 7 days on the production server and 30 days in Germany. Encrypted copies at Storegate are not deleted automatically, and the file mirror in Germany keeps files that have been deleted in Flowen. Backups are used only for restoration.
• Restore testing. A full restore of the database is tested every three months against a separate environment, never against production. The most recent test was on 7 November 2026. Restores of uploaded files and chat data will be included from the next test.

7. Subprocessors

We use the following subprocessors. The list is kept current, and customers are notified at least 30 days before a new subprocessor is engaged.

Every subprocessor is a company established within the EU. Microsoft Ireland is part of a US-owned group; see section 2. Fortnox and Ongoing are engaged only for customers who have activated the respective integration.

Development tools. Our source code is hosted on GitHub, deployments run through GitHub Actions, and AI assistants from Anthropic are used in development under rules that prevent them from reaching production. These are not subprocessors for customer data.

8. Monitoring

Flowen logs application errors internally, with the context needed to investigate them. We do not use third-party error tracking that would send potentially sensitive data outside the EU.

Web analytics are self-hosted with Umami at analytics.flowen.eu, which uses neither cookies nor tracking pixels.

9. Compliance

10. Incident response

We have a documented procedure for personal data breaches. In short:

1. Containment — immediate steps to limit the impact.
2. Assessment — which data and which customers are affected.
3. Notification — affected customers are informed without undue delay, and in any case in time for them to meet their own 72-hour deadline.
4. Regulatory notification — the Swedish Authority for Privacy Protection (IMY) is notified within 72 hours where we are the controller. Where the customer is the controller, we provide the information they need to report.
5. Follow-up — root cause analysis within two weeks, followed by preventive measures.

The full procedure is provided to customers on request and at audit.

In October 2026 we handled three security incidents. On 3 October, files were lost through a faulty cleanup job, and most were restored from backup. The incident mainly affected our own company; the two external teams that lost files have been informed directly. On 11 October, an internal search index was found exposed to the internet; it contained no customer data. On 12 October, we found a file route that could be reached without signing in, and removed it. Each incident led to documented changes.

11. Vulnerability disclosure

We welcome reports from the security community.

12. What we are working on

We would rather name the gaps than imply the current state is complete.

13. Documents

• Privacy Policy
• Terms of Service
• AI Act compliance statement
• Legal overview

14. Contact