Is HEFLO a Secure BPM Software?

HEFLO hosts data on Amazon Web Services in regional data centers. Your process data (the models, forms, documents and attachments your teams work with, plus the database that stores them) is held in your region: AWS Ireland (eu-west-1) for the European Union, São Paulo for Latin America. The isolation goes beyond the database. Application, data and reporting services are deployed independently in each region, so process execution happens where the data lives and is not routed back to a central location. Backups follow the same rule: EU recovery points are copied to Frankfurt and stay inside the EU. A defined set of supporting services (account and sign-in, e-mail delivery, search indexing, AI features and telemetry) runs from other AWS regions, so a limited amount of data is processed outside your region under Standard Contractual Clauses. The transfer question below has the full picture.

HEFLO protects data at three levels. Within the region, the database layer is replicated across three separate availability zones, so losing one zone does not mean losing the service or your data. Aurora takes daily backups with point-in-time recovery over a 35-day window, letting a database be restored to a specific moment rather than only to the last snapshot. Beyond that, AWS Backup copies recovery points to a second region every day, into a locked vault that protects them from accidental or malicious deletion. For European customers those copies go from Ireland to Frankfurt, so backups never leave the EU. Your process data and its backups are held to the same regional rule, which is where many cloud platforms quietly break their own promise. A business continuity plan built on this backup architecture is currently being implemented; customers who need formal recovery objectives can request its current status from the security team.

Yes, every customer can. Beyond HEFLO's own backups, you can enable a continuous data stream that consolidates your Aurora and DynamoDB data into a dedicated relational (MySQL) database for your environment. Use it to build your own BI and reporting, keep it as an independent backup, or have HEFLO push a daily export straight to your own Amazon S3 bucket, using your own API key. A full, ready-to-import MySQL copy of your process data lands in infrastructure you control, every day. The replica is encrypted and not publicly accessible, and for European customers it stays in the EU, in line with data residency. It is the direct answer to lock-in: your data is never trapped inside HEFLO.

Static and dynamic application security testing (SAST/DAST) run inside the CI/CD pipeline, so code is checked for vulnerabilities before it ships. In production, Amazon Inspector continuously scans HEFLO's compute layer (servers, containers, and serverless functions) for known vulnerabilities, a web application firewall filters traffic at the edge, and all administrative activity is recorded in AWS CloudTrail.

Yes. HEFLO commissions penetration tests carried out by an independent security firm that is paid to break in, not HEFLO's own team. This is adversarial testing by people with no incentive to find the platform secure, and it is what separates a real security posture from a self-assessment. A summary of the most recent test is available to customers and prospects under NDA, so your security team can read the findings for themselves.

Yes. HEFLO supports RGPD compliance through EU data residency, an Article 28 Data Processing Agreement (DPA), Standard Contractual Clauses for any transfer, an appointed Data Protection Officer (dpo@corp.heflo.com), records of processing activities, and support for the right to erasure. These mechanisms let your legal and DPO teams document how personal data is processed and protected.

Yes, for a defined and limited set of supporting services, and each one is documented. Your process data (models, forms, documents, attachments, the database and its backups) stays in your region. What is processed elsewhere is: account and sign-in data, replicated between regions so your users can sign in from anywhere and so the service survives the loss of a region; e-mail delivery; search indexing; optional AI features, which receive process documentation and automation settings and no personal data; and operational telemetry such as logs, metrics and traces, kept for a short retention period. Every one of these transfers is covered by HEFLO's Data Processing Agreement and Standard Contractual Clauses, and is listed in HEFLO's records of processing activities, which your DPO can request. If your organisation requires strict single-region processing, HEFLO offers private cloud and on-premises deployment.

HEFLO relies on a small, documented set of subprocessors: AWS for hosting, Crisp for customer messaging, Google for supporting services, and OpenAI for optional AI features. Every subprocessor is covered by HEFLO's Data Processing Agreement, and customers are notified before any change to the list so they can assess the impact.

HEFLO is preparing its ISMS in alignment with ISO/IEC 27001. The management system already governs encryption, access control, hosting, resilience, and incident response using the ISO/IEC 27001 framework as its reference model. HEFLO does not currently claim formal certification, and this page will be updated if that status changes.

No. HEFLO does not use customer data to train AI models. AI features follow data minimization, are optional, and can be disabled. This means teams can adopt HEFLO's AI capabilities without exposing their process data to model training.

Yes. HEFLO supports SSO and SIEM integration through webhooks, log export in CSV, IP allowlisting, and customer-owned backups written to the customer's own S3 bucket. For organizations with stricter requirements, HEFLO offers private cloud and on-premises deployment options. Procurement and vendor-risk teams can request the full security package to complete their assessment.