• Docs
  • Blog
  • Pricing
Get started

Trust Center

Workload data stays on the nodes you attach.

dFlow Cloud is the control plane at app.dflow.sh. This page covers GDPR, the Australian DPA, privacy, subprocessors, and how to reach us. SOC 2 is coming soon. Australian DPA and GDPR are compliant.

We are moving our trust center to trust.dflow.sh↗Opens in a new tab

AttestationsAttestations
  • SOC 2Coming soon
  • Australian DPACompliant
  • GDPRCompliant
  • Privacy and data processingAvailable
  • Customer cloud and workload complianceCustomer responsibility
OverviewSecurityComplianceSubprocessorsDocumentsFAQ

Overview

Custody

dFlow operates the hosted control plane. You attach the Worker Nodes. Application and database data run on those nodes.

Where it runsWhere it runs

  • Control

    Control plane

    dFlow Cloud

    app.dflow.sh

    dFlow operates the hosted control plane. Account identity, billing, and platform configuration live here.

  • Nodes

    Worker Nodes

    You attach

    Your cloud · dFlow capacity

    Attach existing machines, connect supported cloud accounts, or use managed Worker Node capacity in selected regions.

  • Workload

    Workload data

    Stays on those nodes

    Git · images · databases

    Application and database data run on the Worker Nodes attached to your environments.

Data categoriesData categories

  • Account and identity

    Name, email, session, organisation membership

    Operate dFlow Cloud accounts

  • Billing

    Stripe customer, subscription, invoice, and wallet state

    dFlow Cloud commercial relationship

  • Platform configuration

    Applications, environments, domains, services, and non-secret variables

    Deliver deployment and operations features

  • Infrastructure metadata

    Server hostnames, SSH keys, Azure account links, firewall rules

    Provision and manage Worker Nodes

  • Deployment and operations

    Build logs, deployment history, service logs, and node metrics

    Operate and troubleshoot workloads

  • Customer content

    Connected Git repositories, container images, and database data on your nodes

    Customer-controlled workload data

Trusted byTrusted by
  • AWS
  • Azure
  • DigitalOcean
  • Google Cloud Platform

Infrastructure providers listed on our trust center. These accounts can also be attached as Worker Nodes.

Architecture, security, and operations documentation lives at docs.dflow.sh.↗Opens in a new tab

Program

Security

These practices cover the dFlow control plane and the product surfaces that reach your Worker Nodes.

dFlow recognises that the confidentiality, integrity and availability of information and data created, maintained and hosted by us are vital to the success of the business and privacy of our partners.

As a service provider/product, we understand the importance in providing clear information about our security practices, tools, resources and responsibilities within dFlow so that our customers can feel confident in choosing us as a trusted provider.

This Security Posture highlights high-level details about our steps to identify and mitigate risks, implement best practices, and continuously develop ways to improve.

ProgramProgram

  • Access management

    Organisation membership uses role-based permissions. Teams can define custom roles with plan limits, and sign-in supports email and password with optional magic link or GitHub OAuth. Enterprise workspaces can use SAML or OIDC single sign-on (SSO) when it is enabled for the organisation.

  • Infrastructure and network

    Worker Node management uses SSH. Azure has a native account integration, including security groups. AWS, Google Cloud, DigitalOcean, and Hetzner can be attached as manual Worker Nodes. Tailscale is used for private connectivity between the control plane and nodes.

  • Monitoring and availability

    Operational status is published at status.dflow.sh. Worker Nodes can use Beszel and Netdata when those tools are installed, and service logs and deployment history are available in the product.

  • Application security

    Public application traffic is routed through the platform proxy with TLS. Sign-in flows can use Cloudflare Turnstile when enabled.

ControlsControls

  • Tenant isolation

    Applications, servers, integrations, SSH keys, security groups, billing, and team membership are scoped to an Organisation.

  • Secrets and configuration

    Environment variables and service configuration are stored in the control plane. Git, registry, and cloud integration credentials follow organisation permissions.

  • Data protection

    Database services support backups and restore flows in the product. Those backups cover database services you configure in dFlow and are not a substitute for your own disaster-recovery planning.

  • Operational visibility

    Deployments, builds, service logs, and infrastructure actions are visible in the dashboard. Some records include the member who triggered the change.

Controls you can map to access reviews, change management, and backup planning.

Monitored controlsMonitored controls

Here are the controls implemented at dFlow to ensure compliance, as a part of our security program.

Product security

  • Situational Awareness For Incidents

    Entity maintains a record of information security incidents, its investigation, and the response plan that was executed in accordance with the policy and procedure defined to report and manage incidents.

  • Vulnerability Remediation Process

    Entity identifies vulnerabilities on the Company platform through the execution of regular vulnerability scans.

  • Centralized Management of Flaw Remediation Processes

    Entity tracks all vulnerabilities and remediates them as per the policy and procedure defined to manage vulnerabilities.

Data security

  • Termination of Employment

    Entity ensures logical access that is no longer required in the event of termination is made inaccessible in a timely manner.

  • Inventory of Infrastructure Assets

    Entity develops, documents, and maintains an inventory of organizational infrastructure systems, including all necessary information to achieve accountability.

  • Data Backups

    Entity backs up relevant user and system data regularly to meet recovery time and recovery point objectives and verifies the integrity of these backups.

Network security

  • Limit Network Connections

    Entity ensures that the production databases access and Secure Shell access to infrastructure entities are protected from public internet access.

  • Transmission Confidentiality

    Entity has set up processes to utilize standard encryption methods, including HTTPS with the TLS algorithm, to keep transmitted data confidential.

  • Capacity & Performance Management

    Entity has set up methods to continuously monitor critical assets to generate capacity alerts to ensure optimal performance, meet future capacity requirements, and protect against denial-of-service attacks.

  • Data used in Testing

    Entity ensures that customer data used in non-Production environments requires the same level of protection as the production environment.

App security

  • Conspicuous Link To Privacy Notice

    Entity displays the most current information about its services on its website, which is accessible to its customers.

  • Secure system modification

    Entity has procedures to govern changes to its operating environment.

Endpoint security

  • Malicious Code Protection (Anti-Malware)

    Where applicable, Entity ensures that endpoints with access to critical servers or data must be protected by malware-protection software.

  • Full Device or Container-based Encryption

    Where applicable, Entity ensures that endpoints with access to critical servers or data must be encrypted to protect from unauthorized access.

  • Endpoint Security Validation

    Entity has set up measures to perform security and privacy compliance checks on the software versions and patches of remote devices prior to the establishment of the internal connection.

Corporate security

  • Code of Business Conduct

    Entity has a documented policy to define behavioral standards and acceptable business conduct.

  • Organizational Structure

    Entity maintains an organizational structure to define authorities, facilitate information flow and establish responsibilities.

  • Roles & Responsibilities

    Entity has established procedures to communicate with staff about their roles and responsibilities.

  • Competency Screening

    Entity has procedures to ensure that all security-related positions are staffed by qualified individuals who have the necessary skill set.

  • Personnel Screening

    Entity has established procedures to perform security risk screening of individuals before authorizing access.

  • Security & Privacy Awareness

    Entity provides information security and privacy training to staff that is relevant to their job function.

  • Performance Review

    Entity requires that all employees in client serving, IT, Engineering, and Information Security roles are periodically evaluated regarding their job responsibilities.

  • Automated Reporting

    Entity has provided information to employees, via various Information Security Policies/procedures, on how to report failures, incidents, concerns, or other complaints related to the services or systems provided by the entity in the event there are problems.

  • Incident Reporting Assistance

    Entity has provided information to customers on how to report failures, incidents, concerns, or other complaints related to the services or systems provided by the Entity in the event there are problems.

  • Assigned Cybersecurity & Privacy Responsibilities

    Entity's Senior Management assigns the role of Information Security Officer who is delegated to centrally manage, coordinate, develop, implement, and maintain an enterprise-wide cybersecurity and privacy program.

  • Internal Audit using Sprinto

    Entity uses Sprinto, a continuous monitoring system, to track and report the health of the information security program to the Information Security Officer and other stakeholders.

  • Segregates Roles and Responsibilities

    Entity's Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers.

  • Asset Ownership Assignment

    Entity has set up mechanisms to assign and manage asset ownership responsibilities and establish a common understanding of asset protection requirements.

Status

Compliance

SOC 2 is coming soon. Australian DPA and GDPR are compliant. Formal attestations apply to the surfaces dFlow operates. Customer cloud accounts and workload design remain your responsibility unless a signed agreement says otherwise.

What each one meansWhat each one means

  • SOC 2

    Coming soon

    SOC 2 is a voluntary compliance standard for service organizations, developed by the American Institute of CPAs (AICPA), which specifies how organizations should manage customer data. The standard is based on the following Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.

  • Australian DPA

    Compliant

    The Australian Data Protection Act outlines privacy requirements and data protection obligations for organizations operating within Australia.

  • GDPR

    Compliant

    The General Data Protection Regulation, a comprehensive data protection law in the EU, governs how organizations must protect personal data and privacy.

  • Privacy and data processing

    Available

    Our Privacy Policy describes how dFlow handles personal data. Contact [email protected] for privacy and data-processing questions.

  • Customer cloud and workload compliance

    Customer responsibility

    Workloads run in accounts, regions, and networks you select. Provider attestations and regulated workload design remain your responsibility.

  • Privacy Policy
  • Cookie Policy
  • Terms of Service

Vendors

Subprocessors

Subprocessors dFlow uses to process data in its infrastructure and business operations, including vendors that operate dFlow Cloud, the marketing site, and shared platform services.

VendorsVendors

  • Cloudflare

    Hosting providers. Object storage, DNS, Turnstile bot protection, and related edge services.

  • Better Stack

    IT infrastructure. Client-side log ingestion and operational telemetry from the product.

  • GitHub App

    Version control systems. OAuth sign-in and GitHub App flows for platform authentication and repository access.

  • Stripe

    Finance. Payments, invoicing, wallet balance, and subscription billing for dFlow Cloud.

  • AWS

    IT infrastructure. AWS accounts can also be attached as manual Worker Nodes.

  • Buffer

    Marketing.

  • Hetzner

    IT infrastructure. Cloud and dedicated servers for managed Worker Node capacity offered through dFlow Cloud.

  • Google Workspace

    Identity providers.

  • Sentry

    Analytics. Application error monitoring and diagnostics.

  • Tailscale

    Security software. Private networking between the control plane and connected Worker Nodes.

  • Office 365

    IAM providers.

  • MongoDB

    Primary database for the control plane and website content managed through Payload.

  • Redis

    Queues, caching, and background job orchestration.

  • Resend

    Transactional email for account, inquiry, and platform notification flows.

  • Beszel

    Server and Worker Node monitoring where installed.

  • Featurebase

    Changelog, roadmap, and in-product feedback surfaces on the website.

  • Plausible Analytics

    Privacy-oriented website analytics on dflow.sh.

  • Contabo

    Infrastructure provider for managed Worker Node capacity offered through dFlow Cloud.

Subprocessors for dFlow and related services. Questions about this list or data processing? Email [email protected].

References

Documents

Policies, architecture references, and procurement entry points.

ReferencesReferences
  • Privacy PolicyPersonal data handling, GDPR rights, and supervisory authority complaint contacts.
  • Cookie PolicyHow dFlow uses cookies and similar technologies on dflow.sh and app.dflow.sh.
  • Terms of ServiceCommercial and acceptable-use terms for dFlow Cloud and related services.
  • Security and team managementDocumentation for SSH, security groups, RBAC, and organisation access.↗Opens in a new tab
  • Platform architectureControl plane, Worker Nodes, proxy, builds, and monitoring.↗Opens in a new tab
  • System statusCurrent availability for dFlow Cloud and related services.↗Opens in a new tab
  • Enterprise inquiriesDiscuss larger deployments, procurement, and security reviews.
  • Moving our trust centerWe are moving our trust center to trust.dflow.sh.↗Opens in a new tab
UpdatesUpdates
  • Operational statusCurrent availability for dFlow Cloud and related services.↗Opens in a new tab
  • ChangelogProduct updates, fixes, and improvements.
  • RoadmapPlanned platform and security work.
Security policiesSecurity policies

Here are the important security policies and documents which are a part of dFlow’s compliance program. We are moving our trust center to trust.dflow.sh.↗Opens in a new tab

  • Data Classification Policy

    Policy

  • Personal Data Breach Notification Procedure

    Policy

  • Vendor Management Policy

    Policy

  • System Acquisition and Development Lifecycle Policy

    Policy

  • Incident Management Policy

    Policy

  • Operations Security Procedure

    Policy

  • Business Continuity Plan

    Policy

  • Endpoint Security Policy

    Policy

  • SDLC Procedure

    Policy

  • Asset Management Procedure

    Policy

  • HR Security Procedure

    Policy

  • Data Retention Policy

    Policy

  • Compliance Procedure

    Policy

  • Access Control Procedure

    Policy

  • Incident Management Procedure

    Policy

  • PHI Data breach Notification Procedure

    Policy

  • Vendor Management Procedure

    Policy

  • Network Security Procedure

    Policy

  • Asset Management Policy

    Policy

  • Compliance Policy

    Policy

  • Encryption Policy

    Policy

  • Media Disposal Policy

    Policy

  • Data Breach Notification Policy

    Policy

  • Operation Security Policy

    Policy

  • Organization of Information Security Policy

    Policy

  • Access Control Policy

    Policy

  • Information Security Policy

    Policy

  • Communications & Network Security Policy

    Policy

  • Acceptable Usage Policy

    Policy

  • Risk Assessment & Management Policy

    Policy

  • HR Security Policy

    Policy

  • Physical & Environmental Security Policy

    Policy

  • Code of Business Conduct Policy

    Policy

  • Physical and Environmental Security Procedure

    Policy

  • Business Continuity & Disaster Recovery Policy

    Policy

  • System Description

    Document

Questions

Frequently asked questions

Short answers for security, privacy, and procurement reviews.

QuestionsQuestions

Privacy or security questions? Email [email protected].

  • GitHubOpens in a new tab
  • DiscordOpens in a new tab
  • LinkedInOpens in a new tab
StatusOpens in a new tab

Product

  • Pricing
  • Application hosting
  • Database hosting
  • Template hosting
  • AI workflow

Resources

  • Features
  • How it works
  • DocsOpens in a new tab
  • dFlow MCPOpens in a new tab
  • Blog
  • Changelog
  • Roadmap
  • Feedback
  • Developers Hub
  • dFlow vs.

Company

  • Enterprise
  • Partners
  • Join dFlow
  • Startup program
  • Affiliate program
  • Trust Center
  • Brand
  • Contact

Use cases

  • All use cases
  • Web applications
  • APIs and services
  • Data services
  • Workers and cron
  • AI apps and agents
  • Internal tools
  • Replace DIY cloud stack
  • Leave Kubernetes overhead
  • SOC 2Coming soon
  • Australian DPA
  • GDPR
  • Moving our trust centerOpens in a new tab

© 2026 dFlow

  • Privacy
  • Cookies
  • Terms
  • AnalyticaOpens in a new tab