LEGAL · DATA SECURITY

Data Security

Last updated: 1 May 2026

PsychFlo processes sensitive behavioural metadata on behalf of employers globally. This page describes the technical and organisational security measures we apply to protect that data.

SECURITY POSTURE SUMMARY

✓TLS 1.3 encryption in transit

✓AES-256 encryption at rest

✓EU data residency by default (configurable)

✓Row-level security (Supabase RLS)

✓Role-based access controls

✓Audit logging on all data access

⏳Third-party pen test scheduled

⏳ISO 27001 certification

1. Encryption

Encryption in transit

All data transmitted between client browsers, our application servers, and third-party APIs is encrypted using TLS 1.3. HTTP connections are automatically redirected to HTTPS. API endpoints do not accept unencrypted connections.

Encryption at rest

All data stored in our database (Supabase, hosted on AWS eu-west-2, London) is encrypted at rest using AES-256. Database backups are encrypted using the same standard. Encryption keys are managed by Supabase's key management service and rotated on a scheduled basis.

API credential handling

Integration credentials (OAuth tokens, API keys) provided by client organisations are stored encrypted at the application layer using AES-GCM. Raw credentials are never logged or included in error outputs. Client secrets are never exposed via any API response.

2. Infrastructure and Hosting

PsychFlo is built on infrastructure from established, security-certified providers:

Vercel (Application)

Next.js application hosted on Vercel's Edge Network. DDoS protection, WAF, and automatic TLS certificate management. EU edge nodes used by default for data residency compliance.

Supabase (Database)

Postgres database hosted on AWS eu-west-1. Row-level security (RLS) enforced at the database layer — no application-level bypass is possible. Point-in-time recovery available.

LemonSqueezy (Payments)

Card payments are processed and stored by LemonSqueezy, our merchant of record. PsychFlo never stores, transmits, or logs card numbers or CVV values.

Resend (Email)

Transactional emails sent via Resend (EU infrastructure). No personal data is included in email logs beyond the recipient address and send timestamp.

3. Access Controls

Access to PsychFlo systems and data is controlled on a need-to-know basis:

✓Platform access is authenticated via Supabase Auth (email/password + optional SSO). Sessions are JWT-based with configurable expiry.

✓Row-level security (RLS) policies in the database ensure that each organisation's data is isolated — it is architecturally impossible for one client's data to be queried by another client's session.

✓Within client organisations, role-based access controls (RBAC) separate HR Admin capabilities (full data access, user management) from Manager views (team-level risk scores only) and Employee views (opt-out only).

✓PsychFlo staff access to production data is restricted to named personnel. All access is logged. Staff access requires MFA.

✓No third-party vendor has access to client employee data unless required for platform operation (see Privacy Policy, Section 7: Sub-Processors) and covered by a sub-processor agreement.

4. Data Residency

EU data residency by default — configurable on request

All employee behavioural data is stored and processed within the EU by default. The only sub-processor outside this region is Anthropic (US), which processes anonymised, aggregated signal summaries only — no personal data is sent to the Claude API. This is covered by a Data Processing Agreement with standard contractual clauses (SCCs) under GDPR Article 46.

5. Audit Logging

PsychFlo maintains comprehensive audit logs to support incident investigation and regulatory compliance:

→All data access events are logged with timestamp, user ID, and resource accessed

→All AI output generation events are logged with input parameters and output summary

→All HR Admin actions (overrides, suppressions, user management) are logged with actor and timestamp

→Integration sync events are logged with status, record count, and any error conditions

→Audit logs are retained for 12 months and cannot be modified by platform users

6. Penetration Testing and Security Review

We are committed to independent validation of our security controls:

Internal security review

In place

Security review of application code, API endpoints, and database access patterns is conducted by the founding team prior to each major release. OWASP Top 10 checklist applied to all new endpoints.

Third-party penetration test

Scheduled

We are scheduling a third-party penetration test with a CREST-accredited provider prior to enterprise client onboarding. Results will inform a remediation roadmap.

Ongoing vulnerability scanning

In place

Dependency vulnerability scanning runs automatically via GitHub Dependabot on all production dependencies. Critical vulnerabilities trigger immediate remediation.

7. Incident Response

In the event of a security incident or suspected data breach, PsychFlo follows a documented incident response procedure:

Contain

Immediate containment of the affected system or data pathway. Affected credentials revoked within 1 hour of detection.

Assess

Assessment of scope, categories of data affected, and likely cause. Initial assessment completed within 4 hours.

Notify

Affected client organisations notified without undue delay and within 72 hours — consistent with GDPR Article 33 obligations.

Remediate

Root cause identified and remediated. Post-incident report provided to affected clients within 10 business days.

8. Responsible Disclosure

If you have identified a potential security vulnerability in PsychFlo, we ask that you contact us responsibly before public disclosure:

Security Contact

Email: info@psychflo.com

Subject: “Security Disclosure” — we will acknowledge within 24 hours and aim to remediate critical issues within 72 hours.