Security at BotnFlow
Your data security is our top priority. We implement industry-leading security measures to protect your business and your customers' data.
SOC 2
Type II Compliant
Independently audited security, availability, and confidentiality controls.
ISO 27001
Certified
International standard for information security management systems.
GDPR
Compliant
Full compliance with the EU General Data Protection Regulation.
99.9%
Uptime SLA
Enterprise-grade availability for Business plan customers.
Data Encryption
All data is protected with industry-standard encryption at every layer.
Data in Transit
- ✓TLS 1.2+ encryption on all connections
- ✓HTTPS enforced everywhere (HSTS enabled)
- ✓Perfect Forward Secrecy (PFS)
- ✓Certificate pinning for mobile APIs
- ✓A+ rating on SSL Labs
Data at Rest
- ✓AES-256 encryption for all stored data
- ✓Encrypted database backups
- ✓Secure key management (HSM-backed)
- ✓Encrypted file storage for media uploads
- ✓Automatic key rotation
Infrastructure Security
Enterprise-grade infrastructure designed for reliability, scalability, and security.
Cloud Infrastructure
- ✓Multi-region deployment with automatic failover
- ✓Auto-scaling for high availability
- ✓Geographic redundancy across availability zones
- ✓Isolated tenant environments
Network Security
- ✓Enterprise-grade DDoS protection
- ✓Web Application Firewall (WAF)
- ✓Intrusion Detection System (IDS)
- ✓Private VPC with network segmentation
Backup & Recovery
- ✓Daily automated backups
- ✓Point-in-time recovery capability
- ✓Cross-region backup replication
- ✓Disaster recovery plan with < 4h RTO
Access Controls
Multi-layered access controls protect your account and data.
Authentication
- ✓Bcrypt password hashing with unique salts
- ✓Two-Factor Authentication (2FA) via TOTP
- ✓Session management with automatic timeout
- ✓OAuth 2.0 for third-party integrations
- ✓Password strength enforcement
Authorization
- ✓Role-Based Access Control (RBAC)
- ✓Granular permission settings per team member
- ✓API key scoping with fine-grained permissions
- ✓IP allowlisting for API access (Business plan)
- ✓Least-privilege principle for all internal access
Monitoring & Audit
- ✓Comprehensive audit logging of all actions
- ✓Real-time security event monitoring
- ✓Automated anomaly detection & alerting
- ✓Login history and session tracking
- ✓API request logging and rate limiting
Internal Security
- ✓Employee background checks
- ✓Mandatory security awareness training
- ✓Principle of least privilege for staff access
- ✓Separate staging and production environments
- ✓Code reviews and security-focused CI/CD
Application Security
Security is built into every layer of our development process.
Secure Development
- ✓OWASP Top 10 protection (XSS, SQLi, CSRF, etc.)
- ✓Automated SAST & DAST scanning in CI/CD
- ✓Dependency vulnerability scanning
- ✓Peer code reviews for all changes
- ✓Secure coding guidelines and training
Testing & Validation
- ✓Regular third-party penetration testing
- ✓Automated vulnerability scanning (weekly)
- ✓Bug bounty / responsible disclosure program
- ✓Security regression testing
- ✓API security testing for all endpoints
Incident Response
We have a documented incident response plan to handle security events swiftly.
Detection
Automated monitoring systems detect anomalies and potential threats 24/7.
< 15 minAssessment
Security team triages the incident, determines severity and impact scope.
< 1 hourContainment
Immediate actions to isolate the threat and prevent further damage.
< 4 hoursNotification
Affected customers and authorities are notified per legal requirements.
< 72 hoursData Privacy & Compliance
Compliance Framework
- ✓GDPR compliant (EU data protection)
- ✓CCPA/CPRA compliant (California privacy)
- ✓Data Processing Agreements (DPA) available
- ✓Standard Contractual Clauses (SCCs) for EU transfers
- ✓Regular compliance audits and assessments
Data Handling
- ✓Data minimization - we collect only what's needed
- ✓Configurable data retention policies
- ✓Right to data export and deletion
- ✓No selling of personal data to third parties
- ✓Anonymization of data used for analytics
Report a Vulnerability
We value the security research community. If you discover a vulnerability in our platform, please report it responsibly. We are committed to working with researchers to resolve issues quickly.
- ✓We respond to reports within 48 hours
- ✓No legal action against responsible disclosure
- ✓Public acknowledgment (with your permission)
Security FAQ
Where is my data stored?
Your data is stored in SOC 2 Type II certified cloud infrastructure with multi-region redundancy. We use encryption at rest (AES-256) and in transit (TLS 1.2+) for all data.
Can I get a copy of your SOC 2 report?
Yes, SOC 2 Type II reports are available to customers and prospects under NDA. Contact our security team at security@botnflow.com to request a copy.
Do you offer a Data Processing Agreement (DPA)?
Yes, we provide a GDPR-compliant DPA to all customers. It is included in Business plans and available upon request for Pro plans. Contact legal@botnflow.com.
How do you handle data deletion requests?
We process data deletion requests within 30 days as required by GDPR. You can initiate deletion from your account settings or by contacting privacy@botnflow.com.
Is my customer conversation data used for AI training?
No. Your individual conversation data is never used to train AI models for other customers. We only use aggregated, anonymized data for platform-wide improvements.
What happens to my data if I cancel my account?
You have 30 days after cancellation to export your data. After that, all data is permanently deleted from our systems, including backups, within 90 days.
Questions About Security?
Our security team is here to answer your questions and provide additional documentation.
Related: Privacy Policy • Terms of Service • GDPR Rights Center