Trust
floo protects customer data with least-privilege access controls, workload isolation, encryption, and continuous monitoring.
- Operator
- floo labs Inc
- Reviewed
- September 28, 2026
Security
- Workload isolation
- Customer applications are isolated from one another at runtime.
- Encryption
- Stored customer secrets are encrypted at rest. Traffic to floo endpoints uses TLS.
- Access control
- Organization membership and role are checked before data is returned. Removing a member invalidates active sessions.
- Monitoring and audit
- Sensitive organization actions are logged. Production errors and service health are monitored.
Subprocessors
| Provider | Service |
|---|---|
| Google Cloud | cloud infrastructure and managed services |
| Neon | managed Postgres databases |
| GitHub | source control and code delivery |
| WorkOS | authentication and identity |
| Stripe | payments and billing |
| Resend | transactional email |
| Sentry | monitoring and observability |
| Slack | customer support and operational communications |
| Upstash | cloud infrastructure and managed services |
| Mintlify | documentation hosting |
Data handling
floo does not sell personal information or use advertising trackers. Privacy requests and Data Processing Agreement requests go to privacy@getfloo.com.
- build logs and deploy history
- 90 days
- runtime logs
- 7 days
- account and app records after account closure
- deleted from active systems within 30 days
Compliance
SOC 2 Type II
A formal SOC 2 Type II audit is on our roadmap.
Planned
Documents
Security questionnaires and additional documentation are available on request from team@getfloo.com.