Security and DPDP readiness
What an IT or security review asks about Flowy, answered in one place, including what we have not done yet. The full white paper is available on request.
At a glance
| Where data lives | Google Cloud, Mumbai (asia-south1): database, documents, backups and secrets. |
|---|---|
| Encryption | TLS 1.2+ in transit; AES-256 at rest; Aadhaar, PAN, bank account and MFA seeds encrypted again in the application (AES-256-GCM). |
| Sign-in | Passwords to NIST SP 800-63B; TOTP second factor, mandatory for administrator roles; single sign-on with Google Workspace, Microsoft Entra ID or Zoho Directory, set up for your company on request. |
| Access | Five roles, enforced on the server on every request; every query scoped to your company. |
| Audit | Hash-chained trail of every change and every sensitive read, which you can verify yourself. |
| DPDP Act 2023 | Flowy is your Data Processor; you are the Data Fiduciary. |
| Certifications | None yet. No SOC 2, no ISO 27001, no independent penetration test. See what is missing below. |
Where your data lives
Everything Flowy stores for you is held in Google Cloud's Mumbai region: the database and its backups (Cloud SQL), documents (Cloud Storage), the application (Cloud Run), and secrets, including the key that encrypts Aadhaar numbers. Secret replication is pinned to Mumbai rather than left on Google's multi-region default, so the statement "your data stays in India" includes the keys.
One exception, and it is optional. Some features call Google's Gemini API, which may process outside India: reading CVs and checking identity documents in the joining flow (personal data), and drafting job descriptions and policy handbooks (your company's text, not employee records). They are controlled by one setting and can be switched off entirely. When they are off, CVs are read by Flowy's own parser and documents go to a person for checking. These features are switched off on Flowy's production service today (checked 28 September 2026), so no data goes to Gemini. They would be switched on only with your agreement.
Who can see what
- Roles on the server. Super admin, CXO, HR admin, manager and employee. The server checks the role on every request, read from the database, so a change of role takes effect on the next request, not at the next sign-in. Hiding a button in the browser is never treated as security.
- Company isolation. Every query is scoped to the signed-in user's company. Flowy's own administrators can act for a client only by naming that client on each request, and those requests are audited.
- Staffing agencies get their own logins with permissions you grant and revoke; revocation takes effect on their next request.
- Sessions end everywhere at once on a password change, a reset, a role change or "sign out everywhere".
Sign-in
- Passwords follow NIST SP 800-63B: length scaled by role (12 characters for staff, 14 for HR admins, 16 for Flowy's administrators), known-breached and common passwords refused, no forced periodic rotation. Stored with bcrypt, cost 12.
- Second factor: TOTP, compatible with any authenticator app, mandatory for super admin, HR admin and CXO. Codes cannot be replayed; ten single-use recovery codes. TOTP is not phishing-resistant; passkeys are on the roadmap.
- Single sign-on (OpenID Connect): Google Workspace, Microsoft Entra ID and Zoho Directory, one identity provider per company, with break-glass accounts for when the provider is down. It is live, and set up per company on request. SAML 2.0 and SCIM provisioning are not available yet.
Encryption
- TLS 1.2 or higher on every connection; HSTS with preload.
- AES-256 at rest on every storage layer, with Google-managed keys.
- A second, application-layer encryption (AES-256-GCM) on Aadhaar, PAN, bank account numbers and MFA seeds, so a database backup alone does not reveal them.
Audit trail
Every change, and every read of full employee records, bulk exports, document downloads, payslips and compensation, is recorded: who, their role at the time, what, when, from where, and whether it was allowed. Sensitive values are never written into the log. Each entry is hashed with the one before it, so altering or deleting an entry breaks the chain, and your auditor can check the chain for themselves.
The DPDP Act 2023
- Roles. Your company is the Data Fiduciary for your employees' and candidates' personal data. Flowy is your Data Processor and processes it only as you instruct through the product.
- Consent, where consent is the basis. Candidates applying through your careers page give consent against a versioned notice; the notice version, what was agreed, when, and any withdrawal are recorded. Live, and switched on per company.
- Retention. You set how long each kind of record is kept. Candidate records are deleted when their period ends, visitor records anonymised, and a leaver's non-statutory details cleared while the statutory payroll record is kept for its own period. Every purge can be run as a dry run first and is logged. Live, and switched on per company.
- Breaches. We notify you, as the Data Fiduciary, without undue delay, with the facts known at the time and updates as the investigation proceeds. The audit trail establishes what was accessed, by whom and from where.
What we have not done yet
From the security white paper of 17 August 2026, checked against production on 28 September 2026. OpenID Connect single sign-on has closed part of one gap since; the rest are open.
| Gap | What it means for you |
|---|---|
| No SOC 2 or ISO 27001, no independent penetration test | Our controls are described in enough detail to assess directly, but nobody independent has attested to them. |
| No SAML or SCIM | OpenID Connect providers only; joiners and leavers are not provisioned from your directory automatically. |
| No customer-managed keys | Google holds the storage encryption keys. |
| No web application firewall; rate limits per instance | No managed filtering in front of the application. |
| The database has a public IP address; the service runs as a default service account | Access is still authenticated and encrypted, but the network surface and the service's permissions are wider than they need to be. |
| No cross-region standby; no published, tested recovery time | A Mumbai region outage is a Flowy outage. Every other Google region is outside India, so this is a trade against residency. |
| Audit log not exported to write-once storage | Tampering is detectable, not impossible. |
| TOTP rather than passkeys | Real-time phishing of a code remains possible. |
Sub-processors
| Who | For | Where |
|---|---|---|
| Google Cloud Platform | Hosting, database, documents, secrets | Mumbai |
| Google Gemini API | CV reading and document checks; drafting job descriptions and policies. Not in use in production today. | May be outside India |
| Google (Gmail SMTP) | Sending notifications and payslips, from alert@goflowy.in |
Questions and reports
Security questions, due-diligence requests and vulnerability reports: alert@goflowy.in. We acknowledge a vulnerability report within two business days. Where this page and a signed agreement differ, the agreement governs.