Security
and trust.
Written for whoever has to sign off on letting an external firm near your systems. It describes what we actually do rather than what we are certified to do, and it says plainly where the limits are.
There are no compliance badges on this page. Flowstate Technologies LLP is not SOC 2 or ISO 27001 certified, and we are not going to display a logo suggesting otherwise — procurement teams verify those, and finding a false claim ends the conversation faster than not having the certificate.
What we can state accurately is the control set below. It is the same set those frameworks assess, and it is designed into how we work rather than assembled for an audit. If your procurement process requires a certified vendor, we would rather you know that now than three weeks into a conversation.
We also do this work in the other direction: preparing client systems and evidence for their own SOC 2, ISO 27001 or sector audits is a standing part of our consulting practice.
What we do, specifically.
Access to your systems
- Named individuals only. We do not use shared accounts or shared credentials on any client system.
- Least privilege by default: access is scoped to the specific systems an engagement requires, and nothing broader.
- Time-bound where the platform supports it. Elevated access is requested, granted for a window, and expires.
- Multi-factor authentication is mandatory on every account with access to client systems or code.
- Access is revoked on the day an engagement ends or a person rolls off, and we will confirm removal in writing on request.
Credentials and secrets
- Secrets are never committed to source control, and pipelines scan for accidental commits on every push.
- Client secrets live in your own secret manager wherever possible, so we hold a reference rather than a value.
- Where we must hold a credential, it is stored in an encrypted password manager with per-item access.
- We rotate anything we have held at the end of an engagement, and recommend you rotate independently.
Secure development
- Every change goes through a reviewed pull request. Nothing reaches production from a laptop.
- Pipelines block merge on type checking, tests, linting and dependency vulnerability scanning.
- Authorisation is enforced server-side and tested, never left to the interface hiding a control.
- Input is validated at every boundary; queries are parameterised without exception.
- Dependencies are pinned with a lockfile, and we keep the tree small deliberately — every package is attack surface.
Data handling
- We work with the least client data that gets the job done, and prefer synthetic or masked data in development.
- We do not copy production personal data onto local machines. Where debugging genuinely requires it, it happens in your environment.
- Devices are full-disk encrypted, patched, and screen-locked on a short timeout.
- Client data and code are returned or destroyed at the end of an engagement, confirmed in writing on request.
What we build for you
- Encryption in transit as standard; encryption at rest with managed keys where the platform provides it.
- Role-based access control enforced in the data layer, with field-level restriction on sensitive records.
- Append-only audit history: who changed what, when and from where — including reads of sensitive data.
- PII classified, with a documented retention rule and scheduled deletion rather than a policy nobody executes.
- Data residency honoured where law or your contract requires it, chosen at the architecture stage.
- Backups with a restore that has actually been performed and timed, not merely configured.
Our own operations
- Company accounts use SSO with MFA enforced and hardware keys for administrative access.
- Onboarding and offboarding are checklists, so access grants and revocations do not depend on memory.
- Laptops are encrypted and centrally patched.
- Confidentiality obligations are contractual for everyone who touches client work, including any subcontractor.
Who else could
touch your data.
The third parties involved in delivering our work. Engagement-specific services are agreed with you rather than added quietly.
| Provider | Purpose | Region |
|---|---|---|
| Amazon Web Services | Application and data hosting | Region chosen per client |
| Microsoft Azure | Application and data hosting | Region chosen per client |
| Vercel | Website hosting and access logs | Global edge |
| Resend | Contact form email delivery | United States |
| GitHub | Source control and CI pipelines | United States |
| Google Workspace | Email, documents, calendar | United States / EU |
| Anthropic | LLM inference where an engagement uses AI | United States |
If you believe you have found a security issue in this website or in something we built, email sujal@flowstateauto.com with enough detail to reproduce it. We will acknowledge within two working days and keep you updated until it is closed.
We will not pursue legal action against anyone who reports a genuine issue in good faith, gives us reasonable time to fix it, and does not access or modify data belonging to other people while investigating. We do not currently run a paid bounty programme, and we will say so rather than leaving it ambiguous.
Please do not
- Run denial-of-service or load tests against production
- Access, modify or exfiltrate data belonging to anyone else
- Use social engineering against our team or our clients
- Disclose publicly before we have had a chance to fix it
Asked by
procurement.
Are you SOC 2 or ISO 27001 certified?
No, and we will not imply otherwise. Certification requires an independent audit against a defined scope over an observation period, and we have not completed one. What we do have is the underlying control set described on this page, which is what makes a future audit a documentation exercise rather than an engineering project. We also prepare clients for their own SOC 2 and ISO 27001 work as a consulting engagement.
Will you sign our NDA, DPA and security addendum?
Yes. We routinely sign non-disclosure agreements, data processing agreements and client security addenda, and we will complete your security questionnaire. If a clause is something we genuinely cannot comply with, we will tell you which one and why rather than signing and hoping.
Where will our data be stored?
Wherever your requirements dictate. Region selection is an architecture decision we make with you at the start, not a default we discover later. If data cannot leave a jurisdiction, we design for that — including self-hosted models rather than a third-party AI API where that is the constraint.
Do you use AI tools on client code?
Yes, with limits, and we will tell you exactly which. We use enterprise tiers configured so that submitted content is not retained for model training, and we do not paste client secrets or production personal data into any tool. Where a client prohibits it entirely, we comply and confirm that in writing.
Do you use subcontractors?
Occasionally, for specialist work. Anyone who touches client systems is bound by the same confidentiality and access controls as our own team, and we will disclose their involvement rather than presenting them as staff.
How do you handle a security incident?
Contain, notify, remediate, review. We aim to notify an affected client within 24 hours of confirming an incident that touches their data or systems — before we have all the answers, because you may have your own regulatory clock running. A written review follows once the incident is closed.
Need this in your own format?
Send us your security questionnaire, DPA or vendor assessment and we will complete it. If there is a requirement we cannot meet, that answer comes back too.