SOC 2 Type II · ISO 27001:2022 certified
The confidentiality, integrity and availability of the data we handle are vital to our clients and to us. This page sets out how Neoflo identifies and mitigates risk, the controls we run, and the certifications that back them.
SOC 2 Type II
ISO 27001
GDPR
CCPA
AES-256
Private VPC
Certifications & compliance
SOC 2 Type II
Independent examination of our security, availability and confidentiality controls over time.
ISO 27001:2022
Certified to the international standard for information security management systems.
GDPR
EU data protection compliance built in from the start, from data handling to breach notification.
CCPA
California consumer data privacy compliance, with a clear privacy notice and data rights handling.
AES-256 encryption
Data encrypted at rest, with transmission confidentiality controls for data in transit.
Deployment options
Options for stricter environments, including private VPC deployment. Your data stays yours.
Security posture
Controls are tracked and evidenced automatically, so the posture you see is the posture we run.
See live controls ↗
Product security
3 controls
Practices across our people, processes, tools and training that safeguard the product.
Situational awareness for incidents
Vulnerability remediation process
Centralised management of flaw remediation
Data security
5 controls
Safeguards that keep information from corruption, theft or unauthorised access.
Network security
5 controls
Preventing, detecting and monitoring unauthorised access to network resources.
App security
1 control
Application practices that prevent unauthorised access and modification.
Conspicuous link to privacy notice
Endpoint security
3 controls
Securing end-user devices so they can’t be used as a way in.
Malicious code protection (anti-malware)
Full device or container-based encryption
Endpoint security validation
Corporate security
23 controls
How our people, structure and reviews keep the whole company secure.
How we handle your data
01
Connects, doesn’t replace
Neoflo works both ways with your ERP and the tools your team already uses. Nothing to rip out.
02
Least-privilege access
Access is governed by documented access control policy, with roles and responsibilities segregated.
03
Every action on the record
Each action, line item, assignment and approval is logged, with an audit trail from day one.
Policies & documents
Our information security management system is written down, reviewed and audited. A selection is below; full documents are available on request through the Trust Center.
Information Security Policy
Access Control Policy
Encryption Policy
Data Protection Policy
Data Classification Policy
Data Retention Policy
Data Breach Notification Policy
Incident Management Policy
Business Continuity & Disaster Recovery Policy
Risk Assessment & Management Policy
Vendor Management Policy
Endpoint Security Policy
Communications & Network Security Policy
Privacy By Design Policy
HR Security Policy
Asset Management Policy
System Acquisition & Development Lifecycle Policy
Acceptable Usage Policy
ISMS Manual
Code of Business Conduct
+20 more on the Trust Center ↗
Security reviews
Reports and policy documents are shared on request through our Trust Center. Our team can also walk your security and audit stakeholders through how Neoflo works.
Low-risk start
Watch it run on your real documents and your own systems, before you commit to anything.