Centro de confianza
Información de referencia en inglés sobre protección de datos, proveedores y seguridad.
Documento de referencia en inglés. El cuerpo original se conserva sin modificar sus compromisos. Para aclaraciones sobre su alcance o vigencia, utiliza los contactos indicados en esta página.
Fluyio is a marketing automation platform handling subscriber data, email content and integration credentials. We take that responsibility seriously, and we would rather describe exactly what we do today than promise certifications and guarantees we do not have yet.
Data handling
Where data is stored, how it is protected and how long we keep it.
GDPR & privacy
Roles, data processing agreement, EU location and your subscribers' rights.
Subprocessors
Third parties that process data on our behalf.
Incident response
What we do when something goes wrong.
Responsible disclosure
How to report a vulnerability and our safe-harbour terms.
At a glance
| Topic | Status |
|---|---|
| Data location | Production runs on our own server in the European Union. Backups stay in the EU. |
| Encryption in transit | TLS on every endpoint; HSTS with includeSubDomains and preload. |
| Dashboard authentication | Passwords hashed with bcrypt; optional two-factor authentication (TOTP); Google sign-in; session cookie flagged HttpOnly (and Secure in production). |
| API authentication | API keys stored as SHA-256 hashes and shown once; optional expiry; immediate revocation; rate limits per key. |
| Webhook secrets | Stored as SHA-256 hashes; rotation keeps the previous secret valid for 24 hours. Delivery of outgoing webhooks is not active yet. |
| Backups | Daily database backups, kept in the EU. |
| Certifications | None yet. Fluyio is not SOC 2 or ISO 27001 certified. |
| Status page and SLA | No public status page and no contractual SLA at this time. Incidents are communicated by email to account owners. |
| Data processing agreement | Available on request to [email protected]. |
Security questions for procurement
If your security or legal team needs to evaluate Fluyio, write to [email protected] for the DPA and to [email protected] for technical questions. We answer questionnaires on a best-effort basis; we do not have a pre-filled SIG or CAIQ.
Reporting a vulnerability
If you believe you have found a security issue, email [email protected] with the details. See the disclosure policy for the safe-harbour terms.
Something missing from this page? Email [email protected] and we will add it.