FlowOS security brief October 2026
This document summarizes the security measures in place in FlowOS, what we define with each customer before deployment, and what we do not have yet.
Scope of this document.
FlowOS is the AI operating system for your employees: agents, documents, scheduled tasks and connectors to your company's tools. This document describes the measures applied to protect the confidentiality, integrity, and availability of your data and of the processing derived from it.
It is intended for IT, security, legal and compliance teams evaluating FlowOS. Contractual commitments (hosting, data processing agreement, service levels, reversibility) are defined with each customer before deployment.
Hosting defined with you.
Where the FlowOS application and data (documents, conversations, logs) are hosted, and the infrastructure providers used, are defined with each customer before deployment. Hosting can be limited to European providers.
Model providers
FlowOS routes requests to several model providers: Anthropic (Claude), OpenAI, Google (Gemini) and Mistral. The "EU only" mode restricts usage to Mistral, a European provider. Data sent to a model provider is processed by that provider under its own terms.
The thinkingplatforms.com website
The marketing website is hosted by OVH SAS (Roubaix, France). This applies to the website only, not to the FlowOS application.
Our security commitments.
| Topic | Status | Details |
|---|---|---|
| GDPR | DPA with each customer | Data processing agreement signed with each customer |
| Security questionnaires | On request | We answer your teams' questionnaires |
| Security review | Available | With your IT department, before deployment |
We share our security documentation and answer your teams' questions directly.
Everything goes through the FlowOS server.
The browser never talks directly to model providers or connectors. Requests go through the FlowOS server, which checks the user's identity and permissions before accessing data.
FlowOS ERP
The FlowOS ERP AI layer accesses business data through a single gateway, with the permissions of the user's role (executive, sales, finance, operations, employee, administrator), including for questions asked in natural language.
Private deployment
A private deployment or one on your own infrastructure can be assessed with your teams, depending on your constraints.
Encrypted connections, protected secrets.
- In transit: encrypted connections (HTTPS), with HSTS when the service is served over HTTPS.
- At rest: depends on the hosting defined with you; we specify it before deployment.
- Passwords: salted and hashed with scrypt, never stored in plain text.
- API keys: model provider and connector keys stay on the server and are never sent to the browser.
- HTTP headers: X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy no-referrer.
Permissions checked on every request.
- Authentication: email and password, two-factor authentication with app codes (TOTP), single sign-on with Google or Microsoft business accounts (OpenID Connect) when configured.
- Sessions: random tokens with a limited lifetime.
- Roles: administrator, manager and member, checked server-side before any data access.
- Brute force: login attempts are rate-limited.
- Accounts: an administrator can disable an account or reset its two-factor authentication, effective immediately.
Who did what, and when.
FlowOS records important actions in an audit log specific to each organization, which administrators can review:
- Sign-ins, failed sign-ins and two-factor authentication changes
- Invitations, role changes and account deactivations
- Documents, folders and share links
- Model calls and agent usage
- Connectors added or removed
- In FlowOS ERP: data entries, questions, AI preparations and actions, approvals and rejections
Commitments set out in the contract.
- Data breach: in the event of a personal data breach affecting you, we inform you without undue delay, as required by the GDPR and the data processing agreement.
- Service levels: response and support times defined with you in the contract.
- Vulnerability reports: write to contact@thinkingplatforms.com.
We do not train models on your data.
Thinking Platforms does not train its own models on its customers' data. FlowOS uses the model providers' professional API offerings; the choice of provider and its data terms are reviewed with you.
Models used
Before deployment, we tell you which model providers are used and in which mode, for example "EU only".
Guardrails
Autonomy levels per action type. In FlowOS ERP, payments and deletions always require human approval. Usage caps per agent and per organization.
A question, a questionnaire, a review?
Write to us at contact@thinkingplatforms.com. We answer your teams' questions and, if needed, organize a security review with your IT department.
Get our security documentation
Measures in place, answers to common IT questions and points to define together.