Security
Your financial data is the most sensitive thing you can hand a tool. This page explains how we protect it.
Hosted in the EU
SaaSFlow and its production database run on Google Cloud in Frankfurt, Germany (region europe-west3). Uploaded files stay in the EU too, in Google Cloud's EU multi-region. The underlying data centers carry ISO 27001 and SOC 2 certifications.
Encrypted everywhere
All data travels over TLS-encrypted connections and is encrypted at rest. Bank connections run through regulated providers (finAPI, Plaid), so your online banking credentials never touch SaaSFlow.
Strict access control
Administrative access to production systems requires individual accounts with multi-factor authentication. Access to customer data is limited to a small number of named people, follows the need-to-know principle, and is logged.
Tenant separation
Every record belongs to exactly one customer organization and is filtered by it at every access layer. Development, staging and production are separate environments, and production data stays out of test systems: automated checks block personal data from entering the codebase.
Disciplined engineering
Every change goes through code review and automated checks in version control, and reaches production only through automated deployments. Security patches for our dependencies are applied on a regular schedule.
Backups and availability
Automated database backups with a documented restore procedure, monitoring with alerting, and DDoS protection in front of the application keep the service available and your data recoverable.
AI features stay in the EU
AI features never run on their own. They start when someone in your company requests a report, asks a question or uploads a file. The models (Anthropic's Claude and Google's Gemini) run on Google Cloud in EU data centers, the same provider that hosts SaaSFlow. No other AI provider receives your data.
GDPR, in writing
SaaSFlow is built and operated in Germany. The documents that govern how we handle your data are public:
Reporting a vulnerability
If you believe you have found a security issue in SaaSFlow, email us at support@saasflow.com. Your report goes straight to the engineering team.
See your real numbers today
Connect Stripe and your bank, and SaaSFlow builds your P&L, subscription metrics, and forecasts. Free under €10k MRR, no credit card required.