SOC 2 Type II audit in progress · EU, US and India data residency · a DPA you can sign
Trust Center →Trust Center
Everything your security review needs
FlowTux reads from the tools your team already uses, stores integration credentials, and can run remediation actions on enrolled devices. This page collects what a procurement or security reviewer asks for, with links to the documents themselves rather than a summary of them.
At a glance
- SOC 2 Type II
Audit in progress
Not yet certified — we do not claim it until the audit completes.
- Data residency
US · EU · India
Chosen at workspace creation. Ticket data and backups stay in region.
- SSO & SCIM
SAML 2.0 + SCIM 2.0
Okta, Microsoft Entra ID, Google Workspace. Enforce SSO per domain.
- AI training on your data
Never
Customer data is not used to train foundation models, and not sold.
- DPA with SCCs
Available
GDPR, UK GDPR, and India DPDP Act aligned.
- Breach notification
Within 72 hours
Documented incident handling, with live uptime and incident history.
Documents and controls
Security overview
Infrastructure, encryption, access control, SSO and SCIM, device-agent limits, audit logging, and incident response.
Read →Data Processing Agreement
Article 28 scope, standard contractual clauses, security measures, and deletion terms. A contract you can sign.
Read →Privacy Policy
What we collect, why, how long we keep it, and the rights you can exercise from in-product settings.
Read →Data residency
Pick the United States, the European Union, or India when the workspace is created. Ticket data and backups stay in region.
Read →How we measure
What we count as an auto-resolved ticket, how the action allow-list works, and what Tux AI never does unattended.
Read →System status
Live uptime and incident history, published continuously.
Open →Sub-processors
Vendors FlowTux engages to process customer data. Systems you connect yourself — Slack, GitHub, Sentry, Jira, PagerDuty, Notion, or Microsoft Teams — are not sub-processors. The authoritative list, with notification terms, lives in the DPA.
| Vendor | Purpose | Location |
|---|---|---|
| Google Cloud Platform (Google LLC) | Application hosting and infrastructure, and AI processing of ticket, diagnostic, and assistant content | United States |
| Google Cloud Platform (Google Cloud EMEA Limited) | Application hosting and infrastructure for workspaces created in the European Union region | European Union |
| Microsoft Azure (Microsoft Corporation) | Cloud hosting and infrastructure | India |
| Meta Platforms, Inc. (WhatsApp Business) | WhatsApp message delivery | United States |
Security questionnaires
If your review needs a completed questionnaire, a penetration-test summary, or terms we have not published, ask and a named engineer will answer — not a support queue.