Data security: what Flowella stores and who processes it

This page explains what customer data Flowella stores, where it’s hosted, how it’s protected and which other companies process it. For contract terms, ask Flowella for a data processing agreement.

​

What Flowella stores

Flowella stores the data it needs to run the Inbox, your Flows and the HubSpot integration. Files that contacts upload in a Flow are also uploaded to the Files tool in your connected HubSpot account. So are the PDFs that Generate Document creates.

​

Where your data is hosted

Flowella’s app, databases and file storage run in Microsoft Azure’s UK South region (London). Stored files are also copied to Azure’s UK West region (Cardiff) for resilience. Database backups stay in UK South. Microsoft Azure holds ISO/IEC 27001 and SOC 2 Type 2 certifications. Flowella itself doesn’t currently hold SOC 2 or ISO 27001 certification. Flowella connects directly to Meta’s WhatsApp Business Platform, with no other messaging provider in between. Your messages also pass through Meta, and Flow answers and events go to your HubSpot account.

​

Encryption

Flowella encrypts the data in its database at rest with AES-256, and protects data in transit with TLS (HTTPS). Connection details and webhook signing secrets are also encrypted individually before Flowella stores them.

​

Sub-processors

Flowella uses these companies to provide the service:

• Cloud hosting: Microsoft Azure hosts the app, databases and file storage, in the UK regions above.
• Payments: Stripe processes subscription payments and billing details.
• Email delivery: Resend sends Flowella’s service emails, such as sign-in links, invitations and notifications.
• Error monitoring: Sentry receives error reports from Flowella, so the team can find and fix problems. These can include session replays, with on-screen text masked.
• Website and app analytics: Google Analytics (through Google Tag Manager), Hotjar and HubSpot measure how people use Flowella’s website and app. Hotjar can record sessions to produce heatmaps. The cookie policy lists the cookies they set.
• AI document extraction: OpenAI processes documents, but only when a HubSpot workflow runs the AI Document Reader action. Flowella sends it the document, or the text taken from it, with the fields to extract. For one customer, OpenAI also analyses photos for an AI image feature built for them.
• Image storage: Cloudinary stores the images that AI image feature creates. It’s used only for that feature.

Some of these companies process data outside the UK: for example, Sentry in Germany, and Stripe, OpenAI and Cloudinary in the United States. Meta and HubSpot aren’t on this list. You connect your own WhatsApp Business Account and HubSpot account, and Flowella exchanges data with them to run the service.

​

Access to your data

​

Flowella staff

Only a small number of authorised Flowella staff, such as engineers and support staff, can access production systems. They do so only when they need to, for example to investigate a problem you reported. Flowella uses role-based access control and multi-factor authentication for its internal accounts, and logs and audits administrative access to servers and databases. Staff are bound by confidentiality and trained in data protection. Flowella keeps its software patched and up to date, and uses firewalls and network security controls. It monitors its systems for signs of a breach and has an incident response plan.

​

Your team

• Each person in your organisation has one of four roles. Only Owners and Admins can remove WhatsApp numbers, disconnect HubSpot, and manage API keys, developer apps, installed apps and webhooks. See Who can use each screen.
• Passwords need at least 8 characters, with an uppercase letter, a lowercase letter and a number. Magic links expire after 15 minutes.
• After repeated failed password attempts on an account, Flowella slows down further attempts and emails the account holder.
• Two-factor authentication for signing in to Flowella isn’t available yet.
• Changing a password doesn’t sign out other devices.

For sign-in details, see Sign in to Flowella and Account settings.

​

Partner apps

If you’ve connected a partner app with OAuth, an Owner or Admin can revoke its access. Open Settings → Installed apps and select Revoke next to the app. Its existing tokens stop working. See Review and revoke installed apps.

​

Data retention and deletion

• Flowella keeps contact details, such as phone numbers and WhatsApp profile names, while you use the service.
• Flowella keeps conversations, including messages, Flow answers and notes, until they’re deleted. You can’t set them to expire.
• When you remove a WhatsApp number from Flowella, Flowella deletes that number’s conversations, including their messages and notes, and its opt-out list. See Remove a number.
• If you delete a contact through the API or stop using Flowella, Flowella deletes or anonymises the contact’s records when you ask. It doesn’t delete contact records automatically on a schedule.
• Technical logs, such as records of the webhooks Flowella receives from WhatsApp and HubSpot, can include message content. Flowella keeps them while your account is active and deletes them with your account data, or sooner if you ask.
• If you cancel your Flowella account, Flowella deletes or anonymises the personal data linked to it within a reasonable period. The exception is data it must keep by law, such as tax records.
• Deleted data can remain in backups for a short time, until the normal backup cycle removes it.
• Deleting data in Flowella doesn’t remove what Flowella has already sent to HubSpot. Delete it in HubSpot too.

To have specific data, or all data for your account, deleted, contact Flowella support. Self-serve account deletion isn’t available.

​

Privacy requests

Flowella doesn’t sell personal data, and doesn’t use the content of your WhatsApp conversations and Flows for profiling or marketing. If one of your contacts asks to see or delete their data, email privacy@flowella.io, the address in the privacy policy. Flowella helps you fulfil the request.

​

Related