Is HEFLO a Secure BPM Software?

Yes. HEFLO is engineered with security by design and runs on Amazon Web Services. Security is not a single feature but a documented Information Security Management System (ISMS) that governs encryption, access, hosting, resilience, and incident response across the platform. HEFLO's ISMS is maintained in alignment with ISO/IEC 27001, giving BPM teams a platform they can trust with sensitive process data.

HEFLO hosts data on Amazon Web Services in regional data centers. Customer data for the European Union is stored exclusively in AWS Ireland (eu-west-1), and data from EU customers never leaves the EU. Latin American customers are served from the São Paulo region. This regional isolation is what makes European data residency and RGPD compliance verifiable rather than assumed.

HEFLO encrypts all data at rest with AES-256 and all data in transit with TLS 1.2 or higher, using 2048-bit certificates and SHA-256. Encryption keys are managed through AWS Key Management Service (KMS). Encryption is applied by default across the platform, so process data, attachments, and forms are protected without any configuration by the customer.

HEFLO enforces multi-factor authentication (MFA) and supports single sign-on through SAML 2.0 and OIDC, integrating with Azure AD, Okta, and ADFS. Access inside the platform is governed by granular role-based access control (RBAC) following the principle of least privilege. Developers do not have access to the production environment, separating who builds the platform from who can reach live customer data.

Yes. HEFLO supports RGPD compliance through EU data residency, an Article 28 Data Processing Agreement (DPA), Standard Contractual Clauses for any transfer, an appointed Data Protection Officer (dpo@corp.heflo.com), records of processing activities, and support for the right to erasure. These mechanisms let your legal and DPO teams document how personal data is processed and protected.

HEFLO relies on a small, documented set of subprocessors: AWS for hosting, Crisp for customer messaging, Google for supporting services, and OpenAI for optional AI features. Every subprocessor is covered by HEFLO's Data Processing Agreement, and customers are notified before any change to the list so they can assess the impact.

Yes. HEFLO commissions an annual penetration test performed by an independent third party. Static and dynamic application security testing (SAST/DAST) run inside the CI/CD pipeline, and AWS GuardDuty and Inspector provide continuous threat detection. A summary of the latest penetration test is available to customers and prospects under NDA.

HEFLO operates under a contractual service-level agreement above 99% availability. The platform runs on a multi-availability-zone architecture with automatic failover, so a single point of failure does not take the service down. Live availability is published on the public status page at heflo.statuspage.io.

HEFLO maintains a formal disaster recovery plan with a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 30 minutes. Recovery is tested every two months to confirm those targets are met, backed by a documented Business Continuity Plan, Disaster Recovery Plan, and Business Impact Analysis.

HEFLO follows a formal incident response plan. Affected customers are notified in line with RGPD requirements, and every significant event is followed by a root cause analysis and post-mortem. HEFLO has recorded zero significant security incidents over the last twelve months.

HEFLO is preparing its ISMS in alignment with ISO/IEC 27001. The management system already governs encryption, access control, hosting, resilience, and incident response using the ISO/IEC 27001 framework as its reference model. HEFLO does not currently claim formal certification, and this page will be updated if that status changes.

No. HEFLO does not use customer data to train AI models. AI features follow data minimization, are optional, and can be disabled. This means teams can adopt HEFLO's AI capabilities without exposing their process data to model training.

Yes. HEFLO supports SSO and SIEM integration through webhooks, log export in CSV, IP allowlisting, and customer-owned backups written to the customer's own S3 bucket. For organizations with stricter requirements, HEFLO offers private cloud and on-premises deployment options. Procurement and vendor-risk teams can request the full security package to complete their assessment.