What FlowOS does today, what we define with you before any deployment, and what we do not have yet. For IT, legal and compliance teams who need to sign off.
Where the application and data are hosted, and the providers used, are defined with each customer before deployment. Hosting can be limited to European providers.
On the AI side, FlowOS relies on several model providers: Anthropic (Claude), OpenAI, Google (Gemini) and Mistral. An "EU only" mode restricts usage to Mistral, a European provider. Data sent to a model provider is processed by that provider under its own terms.
Passwords salted and hashed with scrypt, random session tokens, rate-limited login attempts to block brute-force attacks.
Two-factor authentication with app codes (TOTP). Single sign-on with your Google or Microsoft business accounts (OpenID Connect), when configured.
Administrator, manager and member roles, checked server-side before any data access. In FlowOS ERP, each role's permissions also apply to questions asked in natural language.
Sign-ins, invitations, permission changes, documents, shares and model calls are recorded in an audit log that administrators can review and export (CSV in FlowOS ERP).
Model provider and connector API keys stay on the server, never in the browser. Encrypted connections (HTTPS) and HTTP security headers (HSTS, iframe embedding protection, nosniff, no-referrer).
Autonomy levels per action type. In FlowOS ERP, payments and deletions always require human approval, whatever level is chosen.
Where the application and data are hosted, which providers are used, with the option to limit them to European providers. A private deployment or one on your infrastructure can be assessed with your teams.
Allowed model providers, "EU only" mode if needed, and each provider's data terms, reviewed with you.
Data processing agreement (DPA) with each customer, retention periods, service and support commitments, reversibility: everything is set out in the contract.
Before any deployment, we share our security documentation, answer your teams' questionnaires, sign a data processing agreement (DPA) and can organize a security review with your IT department.
Thinking Platforms does not train its own models on its customers' data. FlowOS uses the model providers' professional API offerings; the choice of provider and its data terms are reviewed with you.
The audit log keeps track of who did what, and when. Usage caps per agent and per organization, and immediate account deactivation by an administrator, keep you in control.
Before deployment, we tell you which model providers are used and in which mode.
We send you our security documentation, answer your questionnaires and, if needed, organize a security review with your IT department.
Contact the team →