Trust center
Trust is earned in the details.
Current, plain-language status of FlashTower's security, privacy, and compliance program, including what is not done yet.
Program status
Certifications, assessments, and agreements
Each line says exactly where FlashTower stands. Nothing is listed as complete until it has happened.
- In progress
SOC 2
SOC 2 readiness in progress. FlashTower has no SOC 2 report and is not SOC 2 certified.
- Planned
HIPAA Business Associate Agreement
Not offered yet. Protected health information must not be uploaded without a signed BAA.
- Planned
Independent penetration test
Not yet performed.
- Planned
ISO/IEC 27001 certification
Not certified.
- Planned
External legal review of public terms
Not yet performed.
Controls
Security controls in place today
- In place
Database-enforced tenant isolation (row-level security)
Automated cross-tenant tests run on every change.
- In place
Multi-factor authentication enforced in the database
Customer data requires a two-factor session for accounts that enrolled a second factor; FlashTower administrators always use MFA.
- In place
Role-based access control
Six organization roles; server-side and database enforcement.
- In place
Append-only audit log
Available to Owners, Admins, and Security Admins.
- In place
Encryption in transit (TLS, HSTS) and at rest
Connector credentials and preserved evidence are additionally encrypted by the application (AES-256-GCM).
- In place
Secure development pipeline
Lint, type checks, automated tests, CodeQL, and secret scanning on every change.
- In place
Incident response and breach notification process
Documented plan, runbooks, and customer notification commitments.
- In place
Responsible disclosure program
Reports to security@flashtower.com.
- In place
Customer data export and deletion requests
Owners can request export or deletion from organization settings.
- In place
Daily database backups
About 7 days of restore points; point-in-time recovery is not enabled yet. Recovery targets: 24-hour recovery point, 24-hour recovery time.
Healthcare and HIPAA
FlashTower is designed to support HIPAA-regulated environments: tenant isolation in the database, MFA, audit logging, redaction before logs and error reports, and encrypted evidence storage. FlashTower does not sign Business Associate Agreements yet, so protected health information must not be uploaded. FlashTower is not HIPAA certified; no government or industry body certifies HIPAA compliance.
About our reports
What a FlashTower report does — and does not — mean
FlashTower reports map findings to frameworks such as the NIST AI RMF, NIST CSF 2.0, the HIPAA Security Rule, SOC 2 Trust Services Criteria, ISO/IEC 27001:2022, and the OWASP Top 10 for LLM Applications. Those mappings help teams organize remediation. They are not an audit opinion.
Framework references indicate that a finding is topically mapped to a control or category in the referenced framework. They are provided to help organize remediation work. A FlashTower assessment is not an audit, certification, attestation, or legal opinion, and does not establish that an organization is or is not compliant with any law, regulation, or standard.
Subprocessors →
The providers we use, what each processes, and where.
Data processing →
How we process customer data on your behalf.
Business Associate Agreement →
Published for review. FlashTower does not offer a BAA yet.
Privacy policy →
What we collect, why, how long we keep it, and your rights.
Security practices →
The technical controls that protect your data.
Responsible disclosure →
How to report a vulnerability, and our safe-harbor commitment.
Data retention, export, and deletion →
How long we keep each category of data, and how to export or delete it.
Security incident terms →
How and when we notify you of a security incident affecting your data.
Security documents
Our Enterprise Security Packet includes a security overview, answers to common security questionnaires, architecture details, and our key policies. Request it at security@flashtower.com.
Each organization also sets its own data-retention period (30 days to 10 years; two years by default).
Contacts
- Security and vulnerability reports
- security@flashtower.com
- Privacy and data requests
- privacy@flashtower.com
- Customer support
- support@flashtower.com
- Billing
- billing@flashtower.com