Security
Your financial data is the most sensitive thing you can hand a tool. This page explains how we protect it.
Hosted in the EU
SaaSFlow runs on Google Cloud in the EU (region europe-west1, Belgium), and our production database is hosted by PlanetScale in the same region. The underlying data centers carry ISO 27001 and SOC 2 certifications.
Encrypted everywhere
All data travels over TLS-encrypted connections and is encrypted at rest. Bank connections run through regulated providers (finAPI, Plaid), so your online banking credentials never touch SaaSFlow.
Strict access control
Administrative access to production systems requires individual accounts with multi-factor authentication. Access to customer data is limited to a small number of named people, follows the need-to-know principle, and is logged.
Tenant separation
Every record belongs to exactly one customer organization and is filtered by it at every access layer. Development, staging and production are separate environments, and production data stays out of test systems: automated checks block personal data from entering the codebase.
Disciplined engineering
Every change goes through code review and automated checks in version control, and reaches production only through automated deployments. Security patches for our dependencies are applied on a regular schedule.
Backups and availability
Automated database backups with a documented restore procedure, monitoring with alerting, and DDoS protection in front of the application keep the service available and your data recoverable.
AI features only with your approval
AI features never run on their own. Someone in your company has to approve each AI provider inside the product first, in a dialog that names the provider, the model, the processing location and the shared data categories. An approval can be withdrawn at any time, which blocks new runs.
GDPR, in writing
SaaSFlow is built and operated in Germany. The documents that govern how we handle your data are public:
Reporting a vulnerability
If you believe you have found a security issue in SaaSFlow, email us at [email protected]. Your report goes straight to the engineering team.
See your real numbers today
Connect Stripe and your bank, and SaaSFlow builds your P&L, subscription metrics, and forecasts. Free under €10k MRR, no credit card required.