Your data, stored in the UK.

Flowella runs on Microsoft Azure in London. This page sets out how we protect the data your customers share with you on WhatsApp, which providers handle it, and how to ask a question or report a problem.

See who handles your data
Read the full sub-processor list
Flo, the Flowella mascot, holding up a shield with a padlock and a green tick
Hosting
Microsoft Azure, UK South (London)
Encryption
TLS in transit, AES-256 at rest
ICO registration
ZC245084
Report a vulnerability
security@flowella.io

How we protect your data.

The safeguards built into Flowella, from where it runs to who can see what.

  • Hosted in the UK

    The app, API and database run on Microsoft Azure in UK South (London). Stored files keep a resilience copy in UK West (Cardiff), and database backups are kept for 14 days.

  • Encrypted in transit and at rest

    HTTPS with HSTS on every Flowella address, TLS on database, cache and file connections, and AES-256 encryption at rest by Microsoft Azure.

  • Secrets locked away

    Access tokens for Meta and HubSpot, webhook secrets and Flow keys are encrypted again with AES-256-GCM, using a key kept outside the database. Passwords and API keys are stored only as hashes.

  • Role-based access

    Every record belongs to one organisation, checked on each request, and roles decide what each team member can do. Our own staff console is limited to a few platform administrators.

  • Changes recorded

    Changes made in the Flowella app, including any made by our own staff in the admin console, are written to an audit log.

  • Signed webhooks, guarded sign-in

    We check Meta’s and HubSpot’s signatures on the webhooks we receive and sign the ones we send. Sign-in slows down after repeated failed attempts, and the account holder is told.

Who else handles your data.

Flowella uses a short list of providers to run the service. Each processes personal data only for its part of the job, under its data processing terms with us.

The sub-processor list gives the data each provider handles, where it is processed and when it applies.

The providers behind Flowella

Questions about security and data.

Can’t find what you need? Email privacy@flowella.io about data protection, or security@flowella.io to report a vulnerability.

Read our privacy policy
Where is my data stored?

In the United Kingdom. The Flowella app, API and database run on Microsoft Azure in UK South (London), and stored files keep a resilience copy in UK West (Cardiff). Some providers process data elsewhere for their part of the service, and the sub-processor list says where.

Does Meta see my WhatsApp messages?

Yes, as your provider. WhatsApp messages travel through Meta’s WhatsApp Business Platform (Cloud API) on the WhatsApp Business Account you connect, encrypted between your customer’s WhatsApp and Meta. Meta processes them under the WhatsApp Business terms you accept with Meta and keeps Cloud API message data for up to 30 days.

Does Flowella store message content?

Yes. Your inbox and your Flows need it, so Flowella stores message text, media references and Flow responses in its database in the UK, encrypted at rest.

Who is responsible for my customers’ data?

You are the data controller for the data you collect with Flowella, and Flowella Limited processes it on your instructions. Meta processes WhatsApp messages as your provider, under your terms with Meta.

Do you use AI on my data?

Only in features you choose to use. The AI Document Reader workflow action sends the document you give it to OpenAI to read the fields you ask for, and runs only when your workflow uses it.

Can I get a data processing agreement?

Yes. Email privacy@flowella.io to ask for one.

How do I report a security problem?

Email security@flowella.io. Our security.txt file has the details.

Flo jumping for joy with her fist in the air and a phone in her hand

Questions before you start?

Book a 30-minute demo with Adam, our founder, and bring your security questions. Or start a free 14-day trial, with no card needed.

Book a demo Try on WhatsApp (opens in a new tab)
Or start a free 14-day trial