Compliance
FluxCascade maintains compliance with industry standards and regulations to ensure your data is handled securely and responsibly.
Certifications & Standards
SOC 2 Type II
FluxCascade is SOC 2 Type II certified, demonstrating our commitment to:
- Security – Protecting against unauthorized access
- Availability – System uptime and reliability
- Confidentiality – Protecting confidential information
- Processing Integrity – Accurate and complete processing
- Privacy – Proper handling of personal information
Our SOC 2 report is available to customers and prospects under NDA. Contact security@fluxcascade.com to request.
GDPR
For users in the European Union, we comply with the General Data Protection Regulation:
| Requirement | How We Comply |
|---|---|
| Lawful Basis | Consent and legitimate interest |
| Data Minimization | Only collect necessary data |
| Right to Access | Data export available |
| Right to Erasure | Account deletion available |
| Data Portability | Configuration export |
| Breach Notification | 72-hour notification process |
| DPA Available | Standard DPA for customers |
CCPA
For California residents, we comply with the California Consumer Privacy Act:
- Right to Know – Disclosure of data collected
- Right to Delete – Account and data deletion
- Right to Opt-Out – We don't sell personal information
- Non-Discrimination – Equal service regardless of privacy choices
HIPAA
For healthcare customers handling Protected Health Information (PHI):
- Business Associate Agreement (BAA) available
- Encryption meets HIPAA requirements
- Access controls and audit logging
- Breach notification procedures
Contact compliance@fluxcascade.com for BAA requests.
Data Processing Agreements
We provide Data Processing Agreements (DPAs) that cover:
- Nature and purpose of processing
- Types of personal data
- Categories of data subjects
- Sub-processor list
- Security measures
- Audit rights
- Data transfer mechanisms
Request a DPA: legal@fluxcascade.com
Sub-Processors
We use the following sub-processors:
| Sub-Processor | Purpose | Location |
|---|---|---|
| Cloud Infrastructure Provider | Hosting and compute | USA / EU |
| Database Provider | Data storage | USA / EU |
| Email Service Provider | Transactional email | USA |
| Analytics Provider | Product analytics | USA |
| Support Platform | Customer support | USA |
Subscribe to sub-processor updates: compliance@fluxcascade.com
Data Residency
Default
Data is processed and stored in the United States.
EU Data Residency
Enterprise customers can request EU data residency:
- Processing in Ireland/EU region
- Data never leaves EU boundaries
- Compliant with GDPR data localization requirements
Contact sales for EU data residency options.
Security Questionnaires
We can complete security questionnaires including:
- SIG (Standard Information Gathering)
- CAIQ (Consensus Assessments Initiative Questionnaire)
- Custom vendor security assessments
Request at security@fluxcascade.com
Audit Rights
Enterprise customers have:
- Right to audit (with reasonable notice)
- Access to third-party audit reports (SOC 2)
- Compliance documentation
Incident Response
Our incident response process:
Detection
- 24/7 monitoring
- Automated alerting
- Security event logging
Response
- Immediate investigation
- Containment measures
- Root cause analysis
Notification
- Customer notification within 72 hours for data breaches
- Regulatory notification as required
- Post-incident report
Recovery
- Service restoration
- Preventive measures
- Documentation updates
Vendor Security
We assess third-party vendors for:
- Security certifications
- Data protection practices
- Contractual security requirements
- Ongoing compliance monitoring
Employee Security
Our team follows security practices:
- Background checks for employees
- Security training
- Access control (least privilege)
- Secure development practices
- Regular security awareness training
Penetration Testing
- Annual third-party penetration tests
- Continuous vulnerability scanning
- Bug bounty program for responsible disclosure
- Prompt remediation of findings
Responsible Disclosure
Found a security issue? We appreciate responsible disclosure:
Email: security@fluxcascade.com
We commit to:
- Acknowledging reports within 24 hours
- Providing updates on remediation
- Not pursuing legal action against good-faith reporters
- Recognition (if desired) for valid reports
Documentation
Request compliance documentation:
- SOC 2 Type II Report
- Data Processing Agreement
- Security Whitepaper
- Penetration Test Summary
Contact compliance@fluxcascade.com
Related
- Data Privacy – How we handle your data
- Encryption – Technical security measures
- Terms of Service – Legal terms
- Privacy Policy – Full privacy policy