Automation infrastructure at FlowMate is built on a component-based architecture, with strict access control, network segmentation, and continuous internal review at every layer. This page explains how.
Flow data is not stored. When an automation runs, data is processed in transit to execute the flow you've configured, and is not persisted afterward.
The one exception is activity logs, records of what ran, when, and whether it succeeded. These are kept for 30 days to operate and troubleshoot the service, then automatically deleted. You can view your own activity logs at any time.
Automation execution at FlowMate runs as a set of isolated internal components rather than a single monolithic system. This limits the blast radius of any single failure or compromise, and lets us apply access control at each layer rather than relying on one perimeter.
Single entry point: all external traffic passes through one API gateway. No internal service is directly reachable from the public internet.
Authentication at the gateway: every request is authenticated and authorized before it reaches any internal service.
Network segmentation: internal services, data processing, and orchestration run in separate network segments with controlled access between them, following the principle of least privilege.
Multi-factor authentication is mandatory for all internal access to FlowMate systems.
Role-based access control: internal roles are scoped to what a person needs to do their job, from read-only access to specific administrative functions. No blanket admin access.
Regular access reviews: internal access rights are reviewed on a recurring basis to ensure they remain current and necessary.
Tenant-based permissions for partners: SaaS and AI platform partners embedding FlowMate manage their own users under a tenant model, with admin-level control over who can access what within their own account.
In transit: all data in transit is encrypted using TLS.
At rest: stored credentials and secrets are encrypted using industry-standard encryption.
Internal integrity checks: messages passed between internal components are cryptographically signed to detect and block tampering attempts.
Continuous monitoring: automated alerting flags issues such as failed authentication attempts, invalid API credentials, or service outages.
Audit logging: platform and account activity is logged for security and troubleshooting purposes.
Defined incident response procedures: documented steps guide how security incidents are identified, contained, and resolved.
Backups and recovery: hourly backups are retained for 2 days, and daily backups for 7 days. The disaster recovery plan is tested monthly.
Secure coding guidelines apply across the development team, covering input validation, secure communication, and secure configuration.
Code changes go through review, including regular security-focused review.
Internal security assessments are conducted on a recurring basis, involving the full development team.
Deployments follow a versioned process to protect production integrity.
GDPR: as a German company, personal data is processed in accordance with GDPR.
SOC 2 Type II: in progress, targeted for Q1 2027.
See the Privacy Policy and Data Processing Agreement for the legal detail behind these practices.
This page covers what most customers, partners, and integration reviewers need. If you're running a formal vendor assessment or need to go deeper, on scopes, data flows, or anything else, we're glad to walk through it directly.
Book a Security Review© 2026 FlowMate GmbH, Cologne. All rights reserved.
