Legal & Compliance

Privacy Policy

Effective Date: September 28, 2026

1. Our Commitment to Enterprise Security

At Flowtaris AI, security and privacy are foundational. This Privacy & Data Protection Policy outlines our strict protocols for handling enterprise data, specifically concerning our AI integrations with ERP systems (NetSuite, SAP, Coupa, Workday). We operate under a Zero-Trust Architecture and maintain strict adherence to global privacy frameworks.

2. Enterprise Data & AI Model Training (Zero Retention)

Your data remains your data. Flowtaris AI guarantees that customer data is never used to train foundational AI models. We employ a strict Zero-Data-Retention policy for all GenAI interactions:

  • No Cross-Tenant Contamination: Your proprietary financial data is isolated within single-tenant, dedicated vector databases.
  • Ephemeral Processing: Prompts and completions processed through our LLM gateways are never logged, stored, or reviewed by humans.
  • Private Instances: We utilize private, isolated instances of AI models via secure APIs (Azure OpenAI, AWS Bedrock) governed by strict BAA and DPA agreements preventing data retention.

3. Information We Process

As a Data Processor, Flowtaris AI only processes information strictly necessary to execute the autonomous workflows authorized by your organization:

  • **Transactional Data: Invoices, purchase orders, and receipts processed via our OCR and document intelligence engine.
  • **System Telemetry: Anonymized integration health metrics and API latency logs to ensure SLA compliance.
  • **Administrative Data: RBAC (Role-Based Access Control) credentials, SSO tokens, and audit logs of user actions within the Flowtaris portal.

4. Encryption & Infrastructure Security

All customer data is secured using military-grade encryption standards:

  • **Data at Rest: Encrypted using AES-256 block-level encryption.
  • **Data in Transit: Secured via TLS 1.3 across all internal and external network boundaries.
  • **Data Residency: Customers may elect to have their data hosted exclusively in US, EU (Frankfurt), or UK data centers to comply with local data sovereignty laws (e.g., GDPR).

5. Compliance & Audits

Flowtaris AI is working toward formal certification. Current status:

  • SOC 2 Type II: audit in progress.
  • ISO 27001: certification in progress.
  • GDPR & CCPA: we sign Data Processing Agreements and support data subject rights requests.
  • HIPAA: BAA capability in progress. Please contact us before sending any protected health information (PHI).

Security documentation is available to customers under NDA.

6. Data Subject Rights & Incident Response

We are establishing a 24/7 security operations capability. If a security incident affects your data, we will notify you without undue delay, as set out in your Data Processing Agreement. Data Subject Access Requests (DSARs) can be raised by emailing support@flowtaris.com.

7. Contact Us

For security assessments, DPA enquiries or privacy concerns, please contact our team: