Security
Automated decisions, kept secure.
The uFlow decision engine applies multiple layers of security designed to protect data, safeguard the confidentiality of information and support business continuity.
Cloud infrastructure
The infrastructure is hosted in the cloud with advanced physical and logical security measures, secure data centers, strict access control and constant monitoring. The serverless architecture is redundant across two availability zones in different regions.
Authentication and authorization
- Two-factor authentication (2FA) for account access.
- Attribute-based access control (ABAC) with specific roles and permissions.
Data encryption
- Data at rest: all stored information is encrypted.
- Data in transit: communication over secure protocols (HTTPS/TLS).
- Cryptographic validation tokens instead of credentials in messaging.
Threat protection
- Intrusion prevention systems that detect malicious activity.
- Continuous network monitoring for anomalies, with immediate response.
- ISO/IEC 27001:2022 certification. The platform is aligned with PCI DSS and to cloud architecture best-practice frameworks.
Backup and recovery
We run periodic backups stored in geographically dispersed locations, with a recovery point objective (RPO) of under 5 minutes in disaster scenarios.
Vendor assessment and due diligence
If your organization is evaluating uFlow as a vendor, we share our security documentation under a confidentiality agreement and answer due diligence questionnaires. Our team supports the technical, security and procurement review stages your process requires.
- Security documentation and certification scope available under NDA.
- Responses to vendor assessment and security questionnaires.
- Support from the uFlow team throughout the review.
Everything you need to know
How does uFlow protect data security?+
uFlow applies layered security: cloud infrastructure with a redundant serverless architecture, encryption at rest and in transit (HTTPS/TLS), 2FA authentication, ABAC access control and cryptographic validation tokens.
Does uFlow comply with recognized security standards?+
uFlow holds the ISO/IEC 27001:2022 certification — its only certification — and is aligned with PCI DSS and to cloud architecture best-practice frameworks. We also run periodic audits with penetration testing and code analysis.
What happens to my data in a disaster scenario?+
uFlow runs periodic, geographically dispersed backups with a recovery point objective of under 5 minutes of data loss in disaster recovery scenarios.
Does uFlow respect user privacy?+
The confidentiality of information is protected within the Information Security Management System (ISMS) certified under ISO/IEC 27001:2022, and data is processed in accordance with the agreements signed with each client.
Can I access the security documentation for a due diligence process?+
Yes. We share our security documentation and the scope of the ISO/IEC 27001:2022 certification under a confidentiality agreement, and we answer vendor assessment questionnaires. You can request it from the contact page.
Need our security documentation?
Transform your credit assessment process with the decision engine.