Security

Security is a design requirement for every service. We apply least privilege, defence in depth, and the principle that customer data is used only to deliver the service the customer asked for.

Data is encrypted in transit with TLS 1.2 or higher and at rest with strong encryption. Secrets and credentials are stored in managed secret stores, never in source code. Integrations use scoped, revocable access, and read-only access wherever the service allows.

Staff access to production systems is limited to those who need it, requires multi-factor authentication, is logged, and is reviewed regularly. Customers on the Scale plan can use single sign-on and audit logs.

We run on reputable cloud infrastructure with network isolation, hardened configurations and automatic patching. Customer environments are logically separated. Data residency options are available, including EU hosting.

We review code changes, scan dependencies for known vulnerabilities, test before release, and fix critical issues as a priority. We commission independent penetration testing at least annually as the company matures.

Data is backed up regularly and restores are tested. We monitor availability and performance and maintain an incident response plan with defined roles, escalation and customer communication.

If we confirm a personal data breach affecting customer data, we notify affected customers without undue delay and, where required, within 72 hours of becoming aware, with the information needed for them to meet their own obligations.

Our processing is aligned with the GDPR. A SOC 2 programme is in progress; we do not claim certification until an independent audit has been completed. We do not use customer data to train models shared with other customers.

Staff sign confidentiality agreements and receive security training. Sub-processors are assessed before use and bound by data protection terms. A current list is available on request.

If you believe you have found a security issue, email info@totoflow.us with details. Please give us reasonable time to fix it before disclosure, and do not access data that is not yours. We will acknowledge reports promptly and will not take action against good-faith research.