SECURITY AT FLOWPLE
Built to protect sensitive client information.
Flowple uses layered access, authentication, transmission, logging, and data-lifecycle controls across the post-retainer collection workflow. This page explains the controls we can describe today and clearly labels work still in progress.
Security information last reviewed July 16, 2026
CURRENT PLATFORM CONTROLS
Security controls designed around the workflow.
Security depends on how technology, people, and processes work together. The following describes current Flowple control areas without implying that every control has been independently audited.
Role-based access
Flowple uses role-based permissions to limit what team members can access and manage within supported product workflows.
Multi-factor authentication
Flowple supports multi-factor authentication as part of its account-protection controls.
Secure transmission
Flowple protects information during transmission using secure connections configured for the production environment.
Audit logging
Flowple records supported security and workflow events to improve accountability and help investigate activity.
Controlled retention and deletion
Flowple uses documented controls for retaining and deleting supported customer data. Timing and behavior can depend on the data type, account state, backup lifecycle, contractual terms, and applicable obligations.
IDENTITY AND ACCESS
Access should match each person's responsibilities.
Flowple combines account authentication with role-based product permissions. Firms should configure access according to their own staffing, matter responsibilities, and internal policies.
| Control | Public description | Status |
|---|---|---|
| Role-based permissions | Limits supported actions and access according to the user's assigned role. | Current platform control |
| Multi-factor authentication | Adds an additional authentication step where enabled or required. | Current platform control |
DATA PROTECTION
Protection through transmission, storage, and review.
Transmission
Flowple uses secure transmission for supported production data flows.
Integrations
Integration security depends on the verified authorization method, requested access, supported transfer direction, and third-party platform controls.
ACCOUNTABILITY
Visibility into supported security and workflow events.
Flowple uses audit logging for supported events. The exact events, availability, retention period, customer visibility, and export options are documented in the current product materials.
DATA LIFECYCLE
Clear controls for how long information remains.
Retention and deletion follow documented product, operational, and contractual procedures. Different data types may follow different timelines, including active records, uploaded files, logs, backups, and information retained for legal or security reasons.
Active use
Data is available to authorized users within the supported workflow.
Retention
Data remains according to the applicable product settings, policy, or contractual commitment.
Deletion request or account closure
The applicable deletion process begins after verified requirements and dependencies are evaluated.
Backup expiration
Deleted production data may remain in protected backups until the relevant backup lifecycle completes.
SHARED RESPONSIBILITY
Cloud-provider controls and Flowple controls are not the same thing.
Flowple uses third-party infrastructure to operate the service. A provider's compliance reports apply to the provider's systems and control responsibilities. Flowple remains responsible for its application, configurations, access, operations, and other controls within that environment.
COMPLIANCE STATUS
Clear status. No borrowed badges.
| Program | Current status | Details |
|---|---|---|
| SOC 2 | Program in progress | Flowple's SOC 2 program is in progress. Flowple does not currently represent that it has completed a SOC 2 examination or received a SOC 2 report. |
| HIPAA | No blanket compliance claim | Whether HIPAA applies depends on the customer, the information involved, and the services being performed. Flowple does not make a blanket HIPAA-compliance claim on this page. Contact Flowple before using the service for a workflow that requires HIPAA-specific contractual commitments. |
| Business Associate Agreement | Verify before describing | Contact Flowple to confirm whether a Business Associate Agreement is available for the proposed use case. |
| Independent penetration testing | Not currently claimed | Flowple does not currently publish a completed independent penetration-testing claim. |
Compliance status last reviewed July 16, 2026.
A note about HIPAA-related workflows.
HIPAA obligations depend on the parties, the data, and the services involved. A law firm should evaluate whether it is acting for a covered entity or business associate and whether its use of Flowple would involve protected health information. Firms should consult their legal or compliance advisers and obtain any required contractual commitments before using a vendor for a regulated workflow.
This information is general and is not legal advice.
Controlled operational access.
Flowple limits operational access according to role and business need. Additional details about support and administrative access are available during security review.
SECURITY REVIEW
Need to evaluate Flowple for your firm?
Our team can answer security and data-handling questions and share the documentation currently available for an appropriate due-diligence review.
Do not include passwords, access tokens, client documents, or sensitive matter details.
Report a security concern.
If you believe you have identified a security issue involving Flowple, contact our security team with a clear description and non-sensitive reproduction details.
Do not send credentials, access tokens, personal client documents, or exploit sensitive customer data.
Security questions, answered clearly.
Does Flowple have a SOC 2 report?
Not currently. Flowple's SOC 2 program is in progress. Flowple does not represent that it has completed a SOC 2 examination or received a SOC 2 report.
Is Flowple HIPAA compliant?
Flowple does not make a blanket HIPAA-compliance claim. HIPAA applicability depends on the customer, the data, and the services involved. Contact Flowple about the proposed workflow and any required contractual commitments.
Does Flowple sign Business Associate Agreements?
Contact Flowple to confirm the current contractual options for the proposed use case.
How does Flowple control user access?
Flowple uses role-based access and supports multi-factor authentication. Exact permission and MFA-enforcement behavior depends on the current product configuration.
Is information encrypted?
Flowple protects information during transmission using secure production connections.
Does Flowple log user activity?
Flowple uses audit logging for supported security and workflow events. Available events, retention, visibility, and export options depend on the current implementation.
What happens when data is deleted?
Deletion behavior depends on the data type, account state, operational systems, backup lifecycle, contractual terms, and applicable obligations. Review Flowple's current privacy and data-handling terms for details.
Does AWS's SOC 2 report cover Flowple?
No. Cloud-provider reports cover the provider's applicable controls. Flowple remains responsible for its own application, configuration, access, and operational controls.
Review security with the people responsible for it.
Tell us what your firm needs to evaluate, and we'll provide accurate information about Flowple's current controls and program status.