How we look after your data

• Database, user accounts, files, customer data etc.: EU (Frankfurt).
• Route optimization and map calculation: EU (Frankfurt).
• Offsite backup: Object storage under EU jurisdiction, with a different provider than the one running the database — with its own, separate access keys.
• Our own data centers: We don't have any. We host with established cloud providers whose data centers are ISO 27001- and SOC 2-certified. We're happy to state the name, region and account setup in writing.

• In transit: TLS 1.2 or newer on all communication.
• At rest: AES-256 with every provider we host with.
• Backups: Encrypted separately on top of that, before they leave our infrastructure.

1. 1

   Point-in-time recovery

   The database can be rolled back to any given second. It's a safety net with second-level precision — including when the accident happens at your end and a cleanup takes too much with it. Recovery takes about an hour.

2. 2

   Encrypted nightly copy with an entirely different provider

   If our database provider becomes unavailable, a complete copy sits somewhere else, under its own keys: database, user accounts and all files and images. At most 24 hours of data loss.

Put in the numbers an advisor usually asks for: maximum data loss (RPO) is seconds on the first layer and up to 24 hours on the second. Maximum recovery time (RTO) is about an hour on the first layer and hours on the second.

Most stop at the first layer. We run both, because the first one lives inside the very system it's meant to protect.

• An alarm fires if no completed backup has arrived within 26 hours. A job that stops running therefore raises an alarm too — not just a job that fails.
• The job refuses to upload a dump that is suspiciously small. A truncated file otherwise looks like a perfectly good backup.
• We restore for real, every quarter. The latest backup is pulled, decrypted and rebuilt, and we compare both row counts and security policies against the original. A backup nobody has tried to restore is a promise. We'd rather have the proof.

Support access: If you need help with setup or troubleshooting, we can access your data with your consent. Every lookup in your data for that purpose is logged and documented with a reason per incident. You can decline support access at any time in writing.

• Access to production data is limited to a small, named group at our end, following the principle of least privilege. Access is removed when someone leaves.
• Short-lived access tokens that renew automatically.
• Critical events in the database are audit-logged.
• Separate environments for development, testing and production, and automated tests before anything goes live.

We don't train models on your data. Neither we nor our AI providers use your data to train models, and the platform's own AI suggestions learn exclusively within your own company — never across customers.

Core operations sit in the EU. A few features use sub-processors that process data outside the EU. That happens under the European Commission's Standard Contractual Clauses (SCCs), and we have completed a Transfer Impact Assessment for each one.

The categories of sub-processors — with purpose, country and transfer basis — are public, and we send the full named list on request. The list forms part of our data processing agreement. If we add or replace a sub-processor, you're notified at least 30 days in advance and you can object.

• You can have it handed over at any time.
• Personal data on a contact can be deleted, so you can comply with an erasure request.
• On termination: you have 30 days to export. After that, all personal data is deleted from our production systems, and backups are overwritten no later than 90 days after termination. We confirm the deletion in writing.
• Files you send us for migration or import are deleted no later than 14 days after the import is complete — and we confirm that in writing.

We monitor operations in real time and log errors centrally. In the event of a personal data breach, we have a documented procedure, and you're notified within 24 hours if you're affected.

Point of contact: support@clientflow.nu · +45 35 95 35 08

We are the data processor for the personal data you put into Clientflow; you are the data controller. Our data processing agreement covers instructions, sub-processors with country and transfer basis, security measures, deletion, notification and liability — and we're happy to send it for signature.

See also