Skip to main content
okflows

Security

Security and Data Protection

OK | Flows is designed to protect form data in transit and during processing with practical controls for production workflows.

Assurance boundaries

Current public claims are intentionally limited to controls visible in the implementation. Certification, regulated-data eligibility, and service levels require separate evidence and agreements.

Independent certification

Not currently claimed

No public SOC 2, ISO 27001, or equivalent certification is represented by this page.

Privacy compliance

Deployment review

Legal basis, notices, retention, processor terms, and data-subject workflows depend on the deployment.

Regulated workloads

Not approved by default

Healthcare and other regulated-data use requires a specific legal, security, and contractual review.

Availability commitment

No public SLA

Availability targets and remedies must be defined explicitly in the applicable hosting and commercial agreement.

Practical controls

The production safeguards that matter across transport, data handling, and operations.

Transport and Delivery

  • Configured CloudPage endpoints must use HTTPS.
  • CloudPage delivery includes a payload signature, timestamp, nonce, and idempotency key.
  • The deployment template validates clock skew and uses a replay-guard Data Extension.

Data Handling

  • Form owners control form structure, mappings, and destination configuration.
  • Draft capture can be enabled to preserve partial progress.
  • Operational cleanup jobs should be configured to avoid stale draft accumulation.

Operational Recommendations

  • Rotate secrets regularly and avoid committing credentials to source control.
  • Use least-privilege credentials for external services and integrations.
  • Log delivery errors and monitor failures to detect integration drift early.

Data Privacy

The current product does not implement advertising or data-broker workflows. Response data is processed by the configured infrastructure and can be delivered to destinations selected by the form owner, as described in our Privacy Policy.

Experience seamless payments.
Experience seamless payments.

Security inquiries

For compliance questionnaires or security reviews

Contact Security