SecurityOverview
How FlowSight keeps cognitive analytics local, governs optional sharing, and applies security, data-protection, and responsible-AI controls with straight answers.
Local-first cognitive context
Screen-derived context is designed to stay on the worker device. Account, billing, and explicitly published proof of work payloads follow our privacy programme and DPA.
Local processing
Core analysis is architected to run on your machine. Network features use encrypted connections where applicable.
Risk-based security reviews
We apply access controls, monitoring, vulnerability management, and vendor reviews proportionate to risk.
GDPR, AI governance & trust programme
We describe our practices accurately: compliance is an ongoing programme of controls, policies, and contracts, not a one-line badge.
We support EU/EEA/UK data protection requirements with transparent notices, lawful bases, data subject rights, subprocessors assessments, and international transfer safeguards (such as Standard Contractual Clauses where applicable).
We align internal controls with the AICPA Trust Services Criteria (Security, and where applicable Availability and Confidentiality) as part of a roadmap toward independent assurance. A SOC 2 Type II report, when available, is typically provided to customers under confidentiality, it does not replace your own legal or compliance review.
Industry-specific regimes (for example HIPAA or ISO 27001 certification) require separate contractual and technical measures; contact us if your organisation needs a regulated deployment.
The AI Coach is clearly identified, outputs remain subject to human review, and workplace use is bounded away from individual employment decisions, emotion recognition, and social scoring. Our public notice documents the intended purpose, limitations, data flow, and deployer responsibilities.
Read the AI transparency noticeSecurity Questions?
Have questions about FlowSight's security practices or compliance? Our team is here to help.
Contact Security Team